diff --git a/ext/versionfmt/dpkg/parser.go b/ext/versionfmt/dpkg/parser.go index 42fbd45e..2d6eefbc 100644 --- a/ext/versionfmt/dpkg/parser.go +++ b/ext/versionfmt/dpkg/parser.go @@ -96,10 +96,6 @@ func newVersion(str string) (version, error) { return version{}, errors.New("No version") } - if !unicode.IsDigit(rune(v.version[0])) { - return version{}, errors.New("version does not start with digit") - } - for i := 0; i < len(v.version); i = i + 1 { r := rune(v.version[i]) if !unicode.IsDigit(r) && !unicode.IsLetter(r) && !containsRune(versionAllowedSymbols, r) { diff --git a/ext/versionfmt/dpkg/parser_test.go b/ext/versionfmt/dpkg/parser_test.go index e4897211..36e40ff8 100644 --- a/ext/versionfmt/dpkg/parser_test.go +++ b/ext/versionfmt/dpkg/parser_test.go @@ -70,8 +70,10 @@ func TestParse(t *testing.T) { // Test invalid characters in epoch {"a:0-0", version{}, true}, {"A:0-0", version{}, true}, - // Test version not starting with a digit - {"0:abc3-0", version{}, true}, + // Test version not starting with a digit. + // While recommended by the specification, this is not strictly required and + // at least one vulnerable Alpine package deviates from this scheme. + {"0:abc3-0", version{epoch: 0, version: "abc3", revision: "0"}, false}, } for _, c := range cases { v, err := newVersion(c.str)