[pkg-go] Bug#1148633: ITP: golang-github-hashicorp-go-getter -- download files and directories from a URL (library)

[Juan Manuel Méndez Rey]

Package: wnpp
Severity: wishlist
Owner: Juan Manuel Méndez Rey <juan.mendezr at proton.me>
X-Debbugs-Cc: debian-devel at lists.debian.org, debian-go at lists.debian.org, pkg-go-maintainers at lists.alioth.debian.org

* Package name    : golang-github-hashicorp-go-getter
  Version         : 1.8.9
  Upstream Contact: https://github.com/hashicorp/go-getter/issues
* URL             : https://github.com/hashicorp/go-getter
* License         : MPL-2.0
  Programming Lang: Go
  Description     : download files and directories from a URL (library)

 go-getter is a Go library for downloading files and directories from a wide
 range of sources using a single URL string as input. It supports local files,
 HTTP, Git, Mercurial, Amazon S3 and Google Cloud Storage, and can
 transparently decompress tar, gzip, bzip2, xz, zstd and zip archives.
 .
 A detector layer rewrites shorthand inputs such as "github.com/user/repo" or
 "./foo" into proper URLs, and downloads can be checksum-verified via a URL
 query parameter.
 .
 This package is a build dependency of syft (ITP https://bugs.debian.org/1124819),
 which uses it to fetch snap images given a URL.

This is a re-introduction rather than a new package. The source was removed
from unstable on 2026-01-20 (https://bugs.debian.org/1122179, RoQA; rc-buggy)
over an unfixed https://bugs.debian.org/1083184, CVE-2024-3817, which had been
open for 14 months. It remains in bullseye and bookworm at 1.4.1-1.

Upstream 1.8.9 post-dates and fixes that CVE. The previous packaging was
maintained by the Debian Go Packaging Team, and I intend to maintain the
re-introduced package there too.