Before going into the parsing bug. **Fetch service shouldn't parse `go.mod` and `go.sum` as that essentially goes against the idea of a proxy service.** Many build pipelines run `go mod tidy` which can potentially update the `go.mod` and `go.sum`, so parsing them isn't full proof and actual artifacts downloaded during the build should be present rather than relying on a potentially outdated lock file. ### Bug Description The metadata parsing is incorrect for `application/x.go.module.git-repo`. ```json { "artifact-metadata-version": "0.1", "request-inspection": { "craft.rockcraft": { "opinion": "Pending", "reason": "valid URL for rockcraft download" }, "craft.snapcraft": { "opinion": "Pending", "reason": "valid URL for snapcraft download" }, "craft.sourcecraft": { "opinion": "Pending", "reason": "valid URL for sourcecraft download" }, "git.upload-pack": { "opinion": "Pending", "reason": "valid URL for git upload-pack", "annotations": { "client-request": [ "command=fetch", "agent=git/2.43.0", "", "thin-pack", "no-progress", "include-tag", "ofs-delta", "deepen 1", "want 452bdf49c8b34e026352ec988055190f60b5d2c5", "done" ], "command": "fetch", "is-shallow": true, "num-wants": 1, "project": "bowenfan-text", "protocol": "version=2", "repository": "https://git.staging.snapcraftcontent.com:443/ubuntu/public/sourcecraft/bowenfan-text", "server": "git.staging.snapcraftcontent.com", "wants": [ "452bdf49c8b34e026352ec988055190f60b5d2c5" ] } } }, "response-inspection": { "craft.rockcraft": { "opinion": "Unknown", "reason": "git repository does not contain a rockcraft.yaml file" }, "craft.snapcraft": { "opinion": "Unknown", "reason": "git repository does not contain a snapcraft.yaml file" }, "craft.sourcecraft": { "opinion": "Approved", "reason": "sourcecraft repository found" }, "git.upload-pack": { "opinion": "Unknown", "reason": "git fetch response is valid but content is unknown", "annotations": { "git-checkout-path": "/var/snap/fetch-service/common/spool/2344f06816d745cfb081c6e4d6554b50/cache/git-3265196343" "heads": { "0.1-24.04_edge": "452bdf49c8b34e026352ec988055190f60b5d2c5" }, "server-response": [ "shallow-info", "shallow 452bdf49c8b34e026352ec988055190f60b5d2c5", "", "packfile" ], "tags": { "r1": "452bdf49c8b34e026352ec988055190f60b5d2c5" } } }, "go.module.git": { "opinion": "Approved", "reason": "go module found", "annotations": { "module": "github.com/kr/text" } } }, "result": "Approved", "metadata": { "type": "application/x.go.module.git-repo", "sha1": "af7100d1c92ef01f69d64ec68d491ffb5bd1e1e6", "sha256": "bee7dd40faaa175c670b3437e4ff2a6dd0446c226e617049226792bbb761029e", "size": 10761, "name": "text", "version": "r1", "vendor": "kr", "description": "", "author": "", "license": "MIT" }, ``` The other package: ```json { "artifact-metadata-version": "0.1", "request-inspection": { "craft.rockcraft": { "opinion": "Pending", "reason": "valid URL for rockcraft download" }, "craft.snapcraft": { "opinion": "Pending", "reason": "valid URL for snapcraft download" }, "craft.sourcecraft": { "opinion": "Pending", "reason": "valid URL for sourcecraft download" }, "git.upload-pack": { "opinion": "Pending", "reason": "valid URL for git upload-pack", "annotations": { "client-request": [ "command=fetch", "agent=git/2.43.0", "", "thin-pack", "no-progress", "include-tag", "ofs-delta", "deepen 1", "want ca086ffa507c7c1f5577959ccf258468375ad071", "done" ], "command": "fetch", "is-shallow": true, "num-wants": 1, "project": "bowenfan-pretty", "protocol": "version=2", "repository": "https://git.staging.snapcraftcontent.com:443/ubuntu/public/sourcecraft/bowenfan-pretty", "server": "git.staging.snapcraftcontent.com", "wants": [ "ca086ffa507c7c1f5577959ccf258468375ad071" ] } } }, "response-inspection": { "craft.rockcraft": { "opinion": "Unknown", "reason": "git repository does not contain a rockcraft.yaml file" }, "craft.snapcraft": { "opinion": "Unknown", "reason": "git repository does not contain a snapcraft.yaml file" }, "craft.sourcecraft": { "opinion": "Approved", "reason": "sourcecraft repository found" }, "git.upload-pack": { "opinion": "Unknown", "reason": "git fetch response is valid but content is unknown", "annotations": { "git-checkout-path": "/var/snap/fetch-service/common/spool/2344f06816d745cfb081c6e4d6554b50/cache/git-890371728", "heads": { "0.2-24.04_edge": "ca086ffa507c7c1f5577959ccf258468375ad071" }, "server-response": [ "shallow-info", "shallow ca086ffa507c7c1f5577959ccf258468375ad071", "", "packfile" ], "tags": { "r1": "ca086ffa507c7c1f5577959ccf258468375ad071" } } }, "go.module.git": { "opinion": "Approved", "reason": "go module found", "annotations": { "go": "1.12", "module": "github.com/kr/pretty" } } }, "result": "Approved", "metadata": { "type": "application/x.go.module.git-repo", "sha1": "b6276b28b0ad2e849db8d7668fab388e825673db", "sha256": "0cbf2ecceeeff05770855aab1416d6f295ccd6748deb241441cce51bef8ac8c5", "size": 10464, "name": "pretty", "version": "r1", "vendor": "kr", "description": "", "author": "", "license": "MIT" }, ``` Here is the original `go.mod` it was supposed to parse: ``` module "github.com/kr/text" require "github.com/kr/pty" v1.1.1 ``` Currently, go mod is parsed manually, which isn't recommend imo. Ideally `golang.org/x/mod/modfile` should be used. For reference, see how syft parses go.mod file: https://github.com/anchore/syft/blob/c53f2fbad369b7c19d28b3b63511c95a04e33ff1/syft/pkg/cataloger/golang/parse_go_mod.go#L35-L114 Current implementation should be changed to that imo: https://github.com/canonical/fetch-service/blob/be430cb11d46c2002562681721d0e04d50265676/inspectors/gomod/go_module_git.go#L184-L217 Additionally, the code should also parse the `go.sum` file if that's present as that contains other valuable information. When doing that, the artifact hash in `go.sum` and the fetched artifact hash should also be matched. ### To Reproduce This was picked from: https://git.staging.snapcraftcontent.com/ubuntu/public/sourcecraft/bowenfan-text/tree/go.mod?h=r1 ### Relevant log output ```shell N/A ```