Package: wnpp Severity: wishlist Owner: Juan Manuel Méndez Rey <[email protected]> X-Debbugs-Cc: [email protected], [email protected], [email protected]
* Package name : golang-github-hashicorp-go-getter Version : 1.8.9 Upstream Contact: https://github.com/hashicorp/go-getter/issues * URL : https://github.com/hashicorp/go-getter * License : MPL-2.0 Programming Lang: Go Description : download files and directories from a URL (library) go-getter is a Go library for downloading files and directories from a wide range of sources using a single URL string as input. It supports local files, HTTP, Git, Mercurial, Amazon S3 and Google Cloud Storage, and can transparently decompress tar, gzip, bzip2, xz, zstd and zip archives. . A detector layer rewrites shorthand inputs such as "github.com/user/repo" or "./foo" into proper URLs, and downloads can be checksum-verified via a URL query parameter. . This package is a build dependency of syft (ITP https://bugs.debian.org/1124819), which uses it to fetch snap images given a URL. This is a re-introduction rather than a new package. The source was removed from unstable on 2026-01-20 (https://bugs.debian.org/1122179, RoQA; rc-buggy) over an unfixed https://bugs.debian.org/1083184, CVE-2024-3817, which had been open for 14 months. It remains in bullseye and bookworm at 1.4.1-1. Upstream 1.8.9 post-dates and fixes that CVE. The previous packaging was maintained by the Debian Go Packaging Team, and I intend to maintain the re-introduced package there too.
