🔴 Single timeout context is shared across all retry attempts, making retries ineffective

The Timeout field is documented as "Timeout for each fetch attempt" (adapter_utils.go:24), but fetchHTTPWithMirrors creates a single context.WithTimeout at line 202 that spans ALL retry attempts including sleep delays between them.

reqCtx, cancel := context.WithTimeout(ctx, config.Timeout)
defer cancel()

In packageregistry/artifactv2/adapter_utils.go, move the context.WithTimeout call inside the retry loop so each attempt gets its own fresh timeout. Replace the single reqCtx at line 202-203 with a per-attempt context created inside the for loop (after the sleep delay). Each iteration should create its own context: reqCtx, cancel := context.WithTimeout(ctx, config.Timeout), and cancel should be deferred or called at the end of each iteration. Alternatively, rename the Timeout field documentation from "Timeout for each fetch attempt" to "Timeout for the entire fetch operation including retries" if the current behavior is intended.

Was this helpful? React with 👍 or 👎 to provide feedback.

🔴 GCS GetMetadata produces garbled checksum by converting raw MD5 bytes to string instead of hex-encoding

The GCS GetMetadata at storage/gcs.go:170 uses string(attrs.MD5) to convert the raw MD5 hash bytes to a string, producing non-printable binary characters instead of a hex-encoded checksum.

if attrs.MD5 != nil {
    checksum = string(attrs.MD5)
}

Was this helpful? React with 👍 or 👎 to provide feedback.

List returns relPath using OS-specific separators. Other parts of the codebase build storage keys with path.Join (forward slashes), so on Windows this will return keys with \ and break prefix-based callers. Consider normalizing via filepath.ToSlash(relPath) before appending.

StorageManager.Store fully buffers (and sometimes hashes) the artifact before checking the cache. For ArtifactIDStrategyConvention the ID can be generated without reading the content, so you can check Exists first and skip the expensive read when the artifact is already present.

fetchHTTPWithMirrors creates a single reqCtx with config.Timeout for the whole retry loop, but the struct comment says the timeout is per fetch attempt. As written, earlier delays/retries consume the same deadline and later attempts can fail immediately. Create a fresh per-attempt context (and make the retry sleep respect ctx.Done()), or update the comment if total-timeout is intended.

The Storage interface mixes context-less methods (Put/Get) with context-aware methods (Exists/List/Delete/GetMetadata). This makes it impossible to propagate cancellation/timeouts for the most expensive operations on backends like GCS. Consider adding context.Context to Put/Get (or adding new PutCtx/GetCtx methods) for a consistent contract.

In GetMetadata, attrs.MD5 is raw bytes; converting it with string(attrs.MD5) will produce non-printable data and is not a stable textual checksum. Encode it (e.g., hex/base64) or use GCS-provided hash fields consistently with other backends (filesystem uses SHA256 hex).

Exists currently only attempts a predicted-ID check for Convention strategy and only when metadataEnabled is true; otherwise it returns (false, "", nil) even if the artifact is already in storage. This breaks adapter-level caching and also ignores the MetadataStore.GetByArtifact capability already present in the interface for looking up existing artifacts by (ecosystem,name,version).

Path traversal risk during extraction: fileInfo.Path comes directly from the tar header and is joined into fileKey without validation. A malicious archive can use paths like ../artifact or absolute paths to escape baseKey and overwrite sibling keys. Sanitize/validate entry paths (reject absolute paths and any cleaned path starting with ..), and ensure the final key remains within baseKey.

fetchConfig doc says RetryAttempts of 0 means "no retries" (single attempt), but applyFetchConfigDefaults overwrites RetryAttempts==0 with the default (3). This makes it impossible to disable retries and contradicts the contract; treat 0 as a valid value and only default when the caller truly left it unset (e.g., use a pointer/optional or a separate boolean).

storeArtifactWithMetadata records StorageKey using computeStorageKeyFromID(artifactID, ""), which ignores any configured storage prefix (WithStoragePrefix / StorageConfig.KeyPrefix). This will store incorrect metadata when a prefix is used; compute the key with the active prefix (or have StorageManager expose a helper for the effective key).

In StorageManager.Exists, returning true purely because metadata exists can lead to false positives (e.g., metadata present but artifact missing/corrupted in the underlying storage). This can cause cache hits where Get later fails. Consider checking both metadata and the storage backend (or making metadata a hint and still verifying storage existence).