nancy: Is returning 500 error when accessing OSS Index

this has happened again - I’m getting 500s

Error: An error occurred: [500 Internal Server Error] error accessing OSS Index

It is almost certainly related. We have reportedly reproduced the problem and are looking into it internally. Sorry for the interruption; we will get this fixed ASAP.

Looks like this could be related to some changes made yesterday, May 23:

Some ecosystems will no longer be supported.As part of this change we will be dropping support for Drupal, Debian, Chocolatey, Alpine, Bower and Go Dep. Note: Go Mod will continue to be supported and we encourage all OSS Index users to upgrade to newer Go Mod modules.

Source: https://ossindex.sonatype.org/updates-notice

We found and fixed the problem. It was an edge case bug in a recent update to OSSIndex, and only certain components would have been affected.

Sorry for the disturbance, and special thanks to @JohnStarich for the helpful report - made it much easier to find the root cause.

A fix has been deployed. You should see Nancy working correctly now.

We’re looking into the recent 500 errors from OSSIndex. So far, the errors appear to be component coordinate specific (e.g. not universal). Still digging.

I can reliably reproduce with this API request:

curl -X 'POST' \
  'https://ossindex.sonatype.org/api/v3/component-report' \
  -H 'accept: application/vnd.ossindex.component-report.v1+json' \
  -H 'Content-Type: application/vnd.ossindex.component-report-request.v1+json' \
  -d '{
  "coordinates": [
    "pkg:golang/github.com/IBM-Cloud/go-etcd-rules@v1.5.14"
  ]
}'

{"code":500,"message":"There was an error processing your request. It has been logged (ID 0c64132875b54062)."}

The version doesn’t appear to matter. Any other public golang dependency I try appears to work.

We moved away from this index to vulncheck by Go community, works like a charm.