Downloader: Record the actual remote URL in the RepositoryProvenance

Earlier fallbacks might have tampered with the original URL (e.g. by stripping credentials), so the `RepositoryProvenance` should record the actual URL being used for creating the `WorkingTree`. Signed-off-by: Sebastian Schuberth <[email protected]>
oss-review-toolkit · Sep 23, 2022 · 8e2ea6a · 8e2ea6a
1 parent 01fc038
commit 8e2ea6a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/downloader/src/main/kotlin/Downloader.kt b/downloader/src/main/kotlin/Downloader.kt
@@ -274,7 +274,7 @@ class Downloader(private val config: DownloaderConfiguration) {
  "Finished downloading source code revision '$resolvedRevision' to '${outputDirectory.absolutePath}'."
  }
 
- return RepositoryProvenance(pkg.vcsProcessed, resolvedRevision)
+ return RepositoryProvenance(pkg.vcsProcessed.copy(url = workingTree.getRemoteUrl()), resolvedRevision)
  }
 
  /**