Incorrect download url from build_golang_download_url()

[chinyeungli]

I'm using build_golang_download_url() to generate the download URL, but the resulting link is missing the letter v before the version number.
https://github.com/package-url/packageurl-python/blob/main/src/packageurl/contrib/purl2url.py#L482

For instance,
pkg:golang/golang.org/x/oauth2@0.29.0 returns https://proxy.golang.org/golang.org/x/oauth2/@v/0.29.0.zip which is incorrect. The correct download url should be https://proxy.golang.org/golang.org/x/oauth2/@v/v0.29.0.zip

[TG1999]

@chinyeungli thanks!

How do we know that this is the correct input PURL

pkg:golang/golang.org/x/oauth2@0.29.0

And not this

pkg:golang/golang.org/x/oauth2@v0.29.0 ?

[chinyeungli]

I am talking about the download url:
https://proxy.golang.org/golang.org/x/oauth2/@v/0.29.0.zip leads to
not found: golang.org/x/oauth2@0.29.0: invalid version: unknown revision 0.29.0
while
https://proxy.golang.org/golang.org/x/oauth2/@v/v0.29.0.zip can download the file.

[TG1999]

What I want to understand is that how do I know shall I add a leading v for a purl? Do I need to do it for all golang purls? Add a v if it does not have one?

That's why I asked shall not the input PURL itself has a leading v in its version if it's needed for download URL.

[chinyeungli]

it seems all the download URL from proxy.golang.org/ requires a v prefix before the version number.

[TG1999]

Hmm I see

so for golang purls where we already have a leading v like this

pkg:golang/xorm.io/xorm@v0.8.2

I will use the version as is

and for purls that does not have a leading v I will add a leading v. Does this makes sense ?

[chinyeungli]

yes