Fix composer dist URL rewriting and browse source for extensionless filenames

GitHub zipball URLs end in a bare commit hash with no file extension.
rewriteDistURL now appends .zip when the filename has no extension and
the dist type is zip. expandMinifiedVersions deep copies inherited
values so in-place URL rewriting no longer corrupts shared references.
browse.go infers .zip for extensionless filenames so existing cached
artifacts can still be opened.

Author: andrew

internal/handler/composer.go

@@ -182,9 +182,10 @@ func expandMinifiedVersions(versionList []any) []any {
 		}
 
 		// Merge inherited fields into a new map, then overlay current fields.
+		// Deep copy values to avoid shared references between versions.
 		merged := make(map[string]any, len(inherited)+len(vmap))
 		for k, val := range inherited {
-			merged[k] = val
+			merged[k] = deepCopyValue(val)
 		}
 		for k, val := range vmap {
 			merged[k] = val
@@ -199,6 +200,26 @@ func expandMinifiedVersions(versionList []any) []any {
 	return expanded
 }
 
+// deepCopyValue returns a deep copy of JSON-like values (maps, slices, scalars).
+func deepCopyValue(v any) any {
+	switch val := v.(type) {
+	case map[string]any:
+		m := make(map[string]any, len(val))
+		for k, v := range val {
+			m[k] = deepCopyValue(v)
+		}
+		return m
+	case []any:
+		s := make([]any, len(val))
+		for i, v := range val {
+			s[i] = deepCopyValue(v)
+		}
+		return s
+	default:
+		return v
+	}
+}
+
 // filterAndRewriteVersions applies cooldown filtering and rewrites dist URLs
 // for a single package's version list.
 func (h *ComposerHandler) filterAndRewriteVersions(packageName string, versionList []any) []any {
@@ -266,6 +287,14 @@ func (h *ComposerHandler) rewriteDistURL(vmap map[string]any, packageName, versi
 		filename = url[idx+1:]
 	}
 
+	// GitHub zipball URLs end with a bare commit hash (no extension).
+	// Append .zip so the archives library can detect the format.
+	if !strings.Contains(filename, ".") {
+		if distType, _ := dist["type"].(string); distType == "zip" {
+			filename += ".zip"
+		}
+	}
+
 	parts := strings.SplitN(packageName, "/", vendorPackageParts)
 	if len(parts) == vendorPackageParts {
 		newURL := fmt.Sprintf("%s/composer/files/%s/%s/%s/%s",

internal/server/browse.go

@@ -17,6 +17,17 @@ import (
 
 const contentTypePlainText = "text/plain; charset=utf-8"
 
+// archiveFilename returns a filename suitable for archive format detection.
+// Some ecosystems (e.g. composer) store artifacts with bare hash filenames
+// that have no extension. This adds .zip when the original has no extension
+// and the content is likely a zip archive.
+func archiveFilename(filename string) string {
+	if !strings.Contains(filename, ".") {
+		return filename + ".zip"
+	}
+	return filename
+}
+
 // getStripPrefix returns the path prefix to strip for a given ecosystem.
 // npm packages wrap content in a "package/" directory.
 func getStripPrefix(ecosystem string) string {
@@ -176,7 +187,7 @@ func (s *Server) browseList(w http.ResponseWriter, r *http.Request, ecosystem, n
 
 	// Open archive with appropriate prefix stripping
 	stripPrefix := getStripPrefix(ecosystem)
-	archiveReader, err := archives.OpenWithPrefix(cachedArtifact.Filename, artifactReader, stripPrefix)
+	archiveReader, err := archives.OpenWithPrefix(archiveFilename(cachedArtifact.Filename), artifactReader, stripPrefix)
 	if err != nil {
 		s.logger.Error("failed to open archive", "error", err, "filename", cachedArtifact.Filename)
 		http.Error(w, "failed to open archive", http.StatusInternalServerError)
@@ -271,7 +282,7 @@ func (s *Server) browseFile(w http.ResponseWriter, r *http.Request, ecosystem, n
 
 	// Open archive with appropriate prefix stripping
 	stripPrefix := getStripPrefix(ecosystem)
-	archiveReader, err := archives.OpenWithPrefix(cachedArtifact.Filename, artifactReader, stripPrefix)
+	archiveReader, err := archives.OpenWithPrefix(archiveFilename(cachedArtifact.Filename), artifactReader, stripPrefix)
 	if err != nil {
 		s.logger.Error("failed to open archive", "error", err, "filename", cachedArtifact.Filename)
 		http.Error(w, "failed to open archive", http.StatusInternalServerError)
@@ -486,15 +497,15 @@ func (s *Server) compareDiff(w http.ResponseWriter, r *http.Request, ecosystem,
 
 	stripPrefix := getStripPrefix(ecosystem)
 
-	fromArchive, err := archives.OpenWithPrefix(fromArtifact.Filename, fromReader, stripPrefix)
+	fromArchive, err := archives.OpenWithPrefix(archiveFilename(fromArtifact.Filename), fromReader, stripPrefix)
 	if err != nil {
 		s.logger.Error("failed to open from archive", "error", err)
 		http.Error(w, "failed to open from archive", http.StatusInternalServerError)
 		return
 	}
 	defer func() { _ = fromArchive.Close() }()
 
-	toArchive, err := archives.OpenWithPrefix(toArtifact.Filename, toReader, stripPrefix)
+	toArchive, err := archives.OpenWithPrefix(archiveFilename(toArtifact.Filename), toReader, stripPrefix)
 	if err != nil {
 		s.logger.Error("failed to open to archive", "error", err)
 		http.Error(w, "failed to open to archive", http.StatusInternalServerError)