golang-github-hashicorp-go-getter - Debian Package Tracker

general

source: golang-github-hashicorp-go-getter (main)
version: 1.8.9-1
maintainer: Debian Go Packaging Team (DMD)
uploaders: Juan Manuel Méndez Rey (DMD) (DM)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.4.1-1
oldstable: 1.4.1-1
testing: 1.8.9-1
unstable: 1.8.9-1

versioned links

1.4.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.8.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

golang-github-hashicorp-go-getter-dev

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:02:03
Last run: 2026-11-11T06:48:51.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:02:16
Last run: 2026-11-07T04:59:14.000Z
Previous status: unknown

stable: fail (log)
The tests ran in 0:00:15
Last run: 2025-08-11T01:57:26.000Z
Previous status: unknown

Created: 2025-08-11 Last update: 2026-11-12 06:34

A new upstream version is available: 1.8.10 high

A new upstream version 1.8.10 is available, you should consider packaging it.

Created: 2026-11-03 Last update: 2026-11-12 06:32

7 security issues in trixie high

There are 7 open security issues in trixie.

7 important issues:

CVE-2023-0475: HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.
CVE-2024-3817: HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.
CVE-2024-6257: HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.
CVE-2022-26945: go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.
CVE-2022-30321: go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.
CVE-2022-30322: go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0.
CVE-2022-30323: go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0.

Created: 2023-06-11 Last update: 2024-10-03 01:30

6 security issues in buster high

There are 6 open security issues in buster.

1 important issue:

CVE-2024-6257: HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

5 issues postponed or untriaged:

CVE-2023-0475: (postponed; to be fixed through a stable update) HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.
CVE-2022-26945: (postponed; to be fixed through a stable update) go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.
CVE-2022-30321: (postponed; to be fixed through a stable update) go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.
CVE-2022-30322: (postponed; to be fixed through a stable update) go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0.
CVE-2022-30323: (postponed; to be fixed through a stable update) go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0.

Created: 2024-06-26 Last update: 2024-06-27 17:57

23 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit c6d4efbb753df8a518e704088dd33db4409448ae
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Fri Oct 30 01:30:34 2026 +0100

    d/control: depend on golang-golang-x-oauth2-dev, not the google split
    
    get_gcs.go imports golang.org/x/oauth2 and nothing under
    golang.org/x/oauth2/google, and that root package lives in
    golang-golang-x-oauth2-dev. The google split still reaches the build
    through golang-google-cloud-dev and golang-google-api-dev, which both
    depend on it.

commit 0cec153bf115db11d4d1fb3061ac4631bdd780fe
Merge: 1c2d993 44a3e29
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Thu Oct 29 22:32:17 2026 +0000

    Merge branch 'gg-6-fixups' into 'master'
    
    Fix the clean build, ship only the library, backport CVE-2026-19585
    
    See merge request go-team/packages/golang-github-hashicorp-go-getter!8

commit 1c2d99372355128c6d55378b77f0ffc7d8dbc9b6
Merge: 60366fe 03df6de
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Thu Oct 29 22:18:13 2026 +0000

    Merge branch 'gg-5-ci' into 'master'
    
    Use salsa-ci instead of the go-team pipeline
    
    See merge request go-team/packages/golang-github-hashicorp-go-getter!7

commit 60366fedf09bce181005d02c32e9360075673bad
Merge: 172653d 8fe8a0a
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Thu Oct 29 22:18:11 2026 +0000

    Merge branch 'gg-4-metadata' into 'master'
    
    Watch v5, gbp config; drop d/clean
    
    See merge request go-team/packages/golang-github-hashicorp-go-getter!6

commit 172653d327b8a9d08b87b9e699a7d3a88decd935
Merge: add507a 5a4ecc9
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Thu Oct 29 22:18:10 2026 +0000

    Merge branch 'gg-3-copyright' into 'master'
    
    Refresh d/copyright for 1.8.9
    
    See merge request go-team/packages/golang-github-hashicorp-go-getter!5

commit add507a9624313a177f90cf2dad7b947f110a353
Merge: f871c05 a99fc2e
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Thu Oct 29 22:18:09 2026 +0000

    Merge branch 'gg-2-dhgo' into 'master'
    
    Switch to dh-go with debhelper-compat 14
    
    See merge request go-team/packages/golang-github-hashicorp-go-getter!4

commit f871c0539811b0c739601a65ef03c06a56e0e7c3
Merge: e7d874d c0e817f
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Thu Oct 29 22:18:07 2026 +0000

    Merge branch 'gg-1-upstream' into 'master'
    
    New upstream version 1.8.9
    
    See merge request go-team/packages/golang-github-hashicorp-go-getter!3

commit 44a3e29083ebd26a28c10ee600fc046d46f47124
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Thu Oct 29 23:00:56 2026 +0100

    d/watch: list the tags through the GitHub API
    
    The /tags page carries only the ten newest tags, and upstream's v2 line
    and its per-directory tags fill them, so uscan no longer found 1.8.9 and
    salsa's test-uscan job failed. The API lists every tag. The download URL
    is unchanged, and the tarball it fetches is byte identical to the orig
    in pristine-tar.

commit b098af377b7180616e13ed21519db614480f43da
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Oct 28 02:57:11 2026 +0100

    FTP-master checklist fixes for 1.8.9-1
    
    - Backport the upstream fix for CVE-2026-19585 (S3/GCS path traversal,
      fixed in 1.8.10) as a DEP-3 patch.
    - Install test-fixtures/ and run the archive permissions tests; the old
      comment claimed the fixtures were missing from the tarball.
    - Build-Depend on git and mercurial <!nocheck> so the git and hg getter
      tests run; skip the five git tests that clone from github.com.
    - d/copyright: restore Dmitry Smirnov and GPL-3+ or MPL-2.0 for debian/*,
      and reword the holder comment.
    - d/changelog: drop "Team upload." (lintian unnecessary-team-upload) and
      name CVE-2026-19585.
    - Override broken-zip and package-contains-vcs-control-dir for two test
      fixtures the test suite reads.

commit ec4655415e3107bbbc559ef07bba3610e6176a93
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Oct 28 02:28:42 2026 +0100

    Ship only the library, skip offline-impossible tests, keep fixtures intact
    
    The arch:all -dev installed /usr/bin/go-getter, which lintian rejects.
    The S3, GCS and http2 tests need the network, and two permissions tests
    read files missing from the tarball. dh_strip_nondeterminism rewrote the
    compressed fixtures, which broke their checksum tests under autopkgtest.

commit 054a30891adeff6198bb9414cb45d6760a50030a
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Tue Oct 13 02:21:59 2026 +0200

    Map github.com/cheggaaa/pb to pb.v1 and restore the aws-sdk-go-base Build-Depends

commit 03df6de8a0e0818b5b536b714c7c7e8937be4668
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Fri Sep 25 16:45:20 2026 +0200

    Use salsa-ci instead of the go-team pipeline

commit 8fe8a0a7b31d2712e1a06daed1c73947e61eb73a
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Fri Sep 25 16:45:18 2026 +0200

    Watch v5, gbp config; drop d/clean
    
    d/clean listed module_test.go, excluded because golang-github-hashicorp-terraform-dev
    never existed. 1.8.9 no longer has that file.

commit 5a4ecc94fd9af3ed92dd5b7f214da50a306d82a6
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Fri Sep 25 16:45:15 2026 +0200

    Refresh d/copyright for 1.8.9

commit a99fc2e588f3246039e927ea86a65403fe7cfd49
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Fri Sep 25 16:45:13 2026 +0200

    Switch to dh-go with debhelper-compat 14
    
    Keeps --with=golang: dh-go 1.68 no longer provides dh-sequence-golang, so
    without it dh_golang never runs and Static-Built-Using comes out empty.

commit c0e817ff36adce783be23c04d11fd4c0b80de195
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Fri Sep 25 16:44:58 2026 +0200

    New upstream version 1.8.9
    
    1.4.1-1 was removed from unstable on 2026-01-20 (RoQA, rc-buggy) over five
    CVEs. 1.8.9 is past all of them; the most recent, CVE-2025-8959, was fixed
    in 1.7.9.

commit 4ac01eeef34cfa1ca83463d443aebe093652167b
Merge: e7d874d b2002b9
Author: Juan Manuel Mendez Rey <vejeta@gmail.com>
Date:   Fri Sep 25 16:44:56 2026 +0200

    Update upstream source from tag 'upstream/1.8.9'

commit b2002b97f23f767c12b3350d6aae53e20d67c4ee
Author: Juan Manuel Méndez Rey <vejeta@gmail.com>
Date:   Tue Sep 22 02:39:28 2026 +0200

    New upstream version 1.8.9

commit e7d874db15fce99185275b907ce9bde3db05c971
Author: Damian Szuberski <szuberskidamian@gmail.com>
Date:   Sat Apr 29 15:34:46 2023 +1000

    Correct debian/watch
    
    Gbp-Dch: Ignore

commit 89f35cf43d6d8d2d47736e139849b7c7203ab9db
Author: Thorsten Alteholz <debian@alteholz.de>
Date:   Sun Jun 19 13:19:15 2022 +0200

    update watch file

commit f357fc002ba4ac5eb7dcdcaa823e23f02d37b7b1
Author: Aloïs Micard <creekorful@debian.org>
Date:   Wed Dec 1 11:53:28 2021 +0000

    [skip ci] update debian/gitlab-ci.yml (using pkg-go-tools/ci-config)
    
    See: https://salsa.debian.org/go-team/infra/pkg-go-tools
    Gbp-Dch: Ignore

commit d414c610f3fc3f7c4876b4c5a41b38d418c66763
Merge: c74e687 93c4f02
Author: Jelmer Vernooĳ <jelmer@debian.org>
Date:   Thu Jul 9 23:25:04 2020 +0000

    Merge branch 'lintian-fixes' into 'master'
    
    Set upstream metadata fields: Bug-Database, Bug-Submit, Repository, Repository-Browse
    
    See merge request go-team/packages/golang-github-hashicorp-go-getter!1

commit 93c4f02d50560a29480ded23da408db6fd2ad066
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Tue Jul 7 20:51:39 2020 +0000

    Set upstream metadata fields: Bug-Database, Bug-Submit, Repository, Repository-Browse.
    
    Changes-By: lintian-brush
    Fixes: lintian: upstream-metadata-file-is-missing
    See-also: https://lintian.debian.org/tags/upstream-metadata-file-is-missing.html
    Fixes: lintian: upstream-metadata-missing-bug-tracking
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-bug-tracking.html
    Fixes: lintian: upstream-metadata-missing-repository
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-repository.html

Created: 2026-11-02 Last update: 2026-11-10 13:17

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 1.8.9-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-11-03 Last update: 2026-11-03 10:32

news

[rss feed]

[2026-11-05] golang-github-hashicorp-go-getter 1.8.9-1 MIGRATED to testing (Debian testing watch)
[2026-11-02] Accepted golang-github-hashicorp-go-getter 1.8.9-1 (source all) into unstable (Debian FTP Masters) (signed by: Simon Quigley)
[2026-01-20] Removed 1.4.1-1 from unstable (Debian FTP Masters)
[2024-11-02] golang-github-hashicorp-go-getter REMOVED from testing (Debian testing watch)
[2020-01-12] golang-github-hashicorp-go-getter 1.4.1-1 MIGRATED to testing (Debian testing watch)
[2020-01-10] Accepted golang-github-hashicorp-go-getter 1.4.1-1 (source) into unstable (Dmitry Smirnov)
[2019-09-28] golang-github-hashicorp-go-getter 1.4.0-1 MIGRATED to testing (Debian testing watch)
[2019-09-26] Accepted golang-github-hashicorp-go-getter 1.4.0-1 (source) into unstable (Dmitry Smirnov)
[2016-10-14] golang-github-hashicorp-go-getter 0.0~git20160316.0.575ec4e-1 MIGRATED to testing (Debian testing watch)
[2016-10-12] golang-github-hashicorp-go-getter REMOVED from testing (Debian testing watch)
[2016-03-25] golang-github-hashicorp-go-getter 0.0~git20160316.0.575ec4e-1 MIGRATED to testing (Debian testing watch)
[2016-03-19] Accepted golang-github-hashicorp-go-getter 0.0~git20160316.0.575ec4e-1 (source all) into unstable, unstable (Dmitry Smirnov)

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci