Skip to content

Commit e45fa10

Browse files
zpavlinoviczpavlinovic
committed
cmd/govulncheck: better mask new (sbom) versions
Using +dirty to match binary versions produced by new go build stamping feature is not sufficient. In general, the build version will depend on the git state and the vuln repo version. We hence only emit sbom messages for the prebuild binaries. Updates golang/go#70523 Change-Id: Id55307b4cef2af3f4ff4685bb34f001554fa4dd4 Reviewed-on: https://go-review.googlesource.com/c/vuln/+/632155 Reviewed-by: Dmitri Shuralyov <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Ian Cottrell <[email protected]>
1 parent bf472d2 commit e45fa10

File tree

20 files changed

+266
-306
lines changed

20 files changed

+266
-306
lines changed

‎cmd/govulncheck/main_test.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ func runTestCase(t *testing.T, tcName, testDir string) {
9393

9494
os.Setenv("moddir", modulesDir)
9595
os.Setenv("testdir", testfilesDir)
96-
runTestSuite(t, testfilesDir, govulndbURI.String(), cfg.Fixups, *update)
96+
runTestSuite(t, testfilesDir, govulndbURI.String(), cfg, *update)
9797
}
9898

9999
// Limit the number of concurrent scans. Scanning is implemented using
@@ -117,7 +117,7 @@ var (
117117
// testSuite creates a cmdtest suite from testfilesDir. It also defines
118118
// a govulncheck command on the suite that runs govulncheck against
119119
// vulnerability database available at vulndbDir.
120-
func runTestSuite(t *testing.T, testfilesDir string, vulndbDir string, fixups []fixup, update bool) {
120+
func runTestSuite(t *testing.T, testfilesDir string, vulndbDir string, cfg *config, update bool) {
121121
parallelLimiterInit.Do(func() {
122122
limit := (runtime.GOMAXPROCS(0) + 3) / 4
123123
if limit > 2 && unsafe.Sizeof(uintptr(0)) < 8 {
@@ -173,14 +173,17 @@ func runTestSuite(t *testing.T, testfilesDir string, vulndbDir string, fixups []
173173
if err := govulncheck.HandleJSON(buf, gather); err != nil {
174174
return nil, err
175175
}
176+
if !cfg.EnableSBOM {
177+
gather.SBOMMessages = nil
178+
}
176179
sorted = &bytes.Buffer{}
177180
h := govulncheck.NewJSONHandler(sorted)
178181
if err := gather.Write(h); err != nil {
179182
return nil, err
180183
}
181184
}
182185
out := sorted.Bytes()
183-
for _, fix := range fixups {
186+
for _, fix := range cfg.Fixups {
184187
out = fix.apply(out)
185188
}
186189
return out, err

‎cmd/govulncheck/test_utils.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@ type config struct {
7777
SkipBuild bool `json:"skipBuild,omitempty"`
7878
// Strip indicates if binaries should be stripped
7979
Strip bool `json:"strip,omitempty"`
80+
// EnableSBOM indicates if sbom should be
81+
// printed in JSON.
82+
EnableSBOM bool `json:"sbom,omitempty"`
8083

8184
Fixups []fixup `json:"fixups,omitempty"`
8285
}

‎cmd/govulncheck/testdata/common/config.json‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{
2+
"sbom": false,
23
"fixups": [
34
{
45
"pattern": "Scanning your code and (\\d+) packages across (\\d+)",
@@ -43,10 +44,6 @@
4344
{
4445
"pattern": "path\": \"stdlib\",\n *\"version\": \"(.*)\"",
4546
"replace": "path\": \"stdlib\",\n \"version\": \"v1.18.0\""
46-
},
47-
{
48-
"pattern": "\"version\": \"(.*)dirty\"",
49-
"replace": "\"version\": \"(devel)\""
5047
}
5148
]
5249
}

‎cmd/govulncheck/testdata/common/testfiles/binary-call/binary_call_json.ct‎

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -27,40 +27,6 @@ $ govulncheck -format json -mode binary ${common_vuln_binary}
2727
"message": "Checking the binary against the vulnerabilities..."
2828
}
2929
}
30-
{
31-
"SBOM": {
32-
"go_version": "go1.18",
33-
"modules": [
34-
{
35-
"path": "golang.org/vuln",
36-
"version": "(devel)"
37-
},
38-
{
39-
"path": "github.com/tidwall/gjson",
40-
"version": "v1.6.5"
41-
},
42-
{
43-
"path": "github.com/tidwall/match",
44-
"version": "v1.1.0"
45-
},
46-
{
47-
"path": "github.com/tidwall/pretty",
48-
"version": "v1.2.0"
49-
},
50-
{
51-
"path": "golang.org/x/text",
52-
"version": "v0.3.0"
53-
},
54-
{
55-
"path": "stdlib",
56-
"version": "v1.18.0"
57-
}
58-
],
59-
"roots": [
60-
"golang.org/vuln"
61-
]
62-
}
63-
}
6430
{
6531
"osv": {
6632
"schema_version": "1.3.1",

‎cmd/govulncheck/testdata/common/testfiles/binary-call/binary_vendored_json.ct‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -27,36 +27,6 @@ $ govulncheck -format json -mode binary ${common_vendored_binary}
2727
"message": "Checking the binary against the vulnerabilities..."
2828
}
2929
}
30-
{
31-
"SBOM": {
32-
"go_version": "go1.18",
33-
"modules": [
34-
{
35-
"path": "golang.org/vendored",
36-
"version": "(devel)"
37-
},
38-
{
39-
"path": "github.com/tidwall/gjson",
40-
"version": "v1.6.5"
41-
},
42-
{
43-
"path": "golang.org/x/text",
44-
"version": "v0.3.0"
45-
},
46-
{
47-
"path": "private.com/privateuser/fakemod",
48-
"version": "v1.0.0"
49-
},
50-
{
51-
"path": "stdlib",
52-
"version": "v1.18.0"
53-
}
54-
],
55-
"roots": [
56-
"golang.org/vendored"
57-
]
58-
}
59-
}
6030
{
6131
"osv": {
6232
"schema_version": "1.3.1",

‎cmd/govulncheck/testdata/common/testfiles/binary-module/binary_module_json.ct‎

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -27,40 +27,6 @@ $ govulncheck -format json -mode binary -scan module ${common_vuln_binary}
2727
"message": "Checking the binary against the vulnerabilities..."
2828
}
2929
}
30-
{
31-
"SBOM": {
32-
"go_version": "go1.18",
33-
"modules": [
34-
{
35-
"path": "golang.org/vuln",
36-
"version": "(devel)"
37-
},
38-
{
39-
"path": "github.com/tidwall/gjson",
40-
"version": "v1.6.5"
41-
},
42-
{
43-
"path": "github.com/tidwall/match",
44-
"version": "v1.1.0"
45-
},
46-
{
47-
"path": "github.com/tidwall/pretty",
48-
"version": "v1.2.0"
49-
},
50-
{
51-
"path": "golang.org/x/text",
52-
"version": "v0.3.0"
53-
},
54-
{
55-
"path": "stdlib",
56-
"version": "v1.18.0"
57-
}
58-
],
59-
"roots": [
60-
"golang.org/vuln"
61-
]
62-
}
63-
}
6430
{
6531
"osv": {
6632
"schema_version": "1.3.1",

‎cmd/govulncheck/testdata/common/testfiles/binary-package/binary_package_json.ct‎

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -27,40 +27,6 @@ $ govulncheck -format json -mode binary -scan package ${common_vuln_binary}
2727
"message": "Checking the binary against the vulnerabilities..."
2828
}
2929
}
30-
{
31-
"SBOM": {
32-
"go_version": "go1.18",
33-
"modules": [
34-
{
35-
"path": "golang.org/vuln",
36-
"version": "(devel)"
37-
},
38-
{
39-
"path": "github.com/tidwall/gjson",
40-
"version": "v1.6.5"
41-
},
42-
{
43-
"path": "github.com/tidwall/match",
44-
"version": "v1.1.0"
45-
},
46-
{
47-
"path": "github.com/tidwall/pretty",
48-
"version": "v1.2.0"
49-
},
50-
{
51-
"path": "golang.org/x/text",
52-
"version": "v0.3.0"
53-
},
54-
{
55-
"path": "stdlib",
56-
"version": "v1.18.0"
57-
}
58-
],
59-
"roots": [
60-
"golang.org/vuln"
61-
]
62-
}
63-
}
6430
{
6531
"osv": {
6632
"schema_version": "1.3.1",

‎cmd/govulncheck/testdata/common/testfiles/source-call/source_call_json.ct‎

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -22,40 +22,6 @@ $ govulncheck -C ${moddir}/vuln -format json ./...
2222
"message": "Checking the code against the vulnerabilities..."
2323
}
2424
}
25-
{
26-
"SBOM": {
27-
"go_version": "go1.18",
28-
"modules": [
29-
{
30-
"path": "golang.org/vuln"
31-
},
32-
{
33-
"path": "github.com/tidwall/gjson",
34-
"version": "v1.6.5"
35-
},
36-
{
37-
"path": "github.com/tidwall/match",
38-
"version": "v1.1.0"
39-
},
40-
{
41-
"path": "github.com/tidwall/pretty",
42-
"version": "v1.2.0"
43-
},
44-
{
45-
"path": "golang.org/x/text",
46-
"version": "v0.3.0"
47-
},
48-
{
49-
"path": "stdlib",
50-
"version": "v1.18.0"
51-
}
52-
],
53-
"roots": [
54-
"golang.org/vuln",
55-
"golang.org/vuln/subdir"
56-
]
57-
}
58-
}
5925
{
6026
"osv": {
6127
"schema_version": "1.3.1",

‎cmd/govulncheck/testdata/common/testfiles/source-call/source_multientry_json.ct‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -23,27 +23,6 @@ $ govulncheck -format json -C ${moddir}/multientry .
2323
"message": "Checking the code against the vulnerabilities..."
2424
}
2525
}
26-
{
27-
"SBOM": {
28-
"go_version": "go1.18",
29-
"modules": [
30-
{
31-
"path": "golang.org/multientry"
32-
},
33-
{
34-
"path": "golang.org/x/text",
35-
"version": "v0.3.5"
36-
},
37-
{
38-
"path": "stdlib",
39-
"version": "v1.18.0"
40-
}
41-
],
42-
"roots": [
43-
"golang.org/multientry"
44-
]
45-
}
46-
}
4726
{
4827
"osv": {
4928
"schema_version": "1.3.1",

‎cmd/govulncheck/testdata/common/testfiles/source-call/source_replace_json.ct‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -23,27 +23,6 @@ $ govulncheck -C ${moddir}/replace -format json ./...
2323
"message": "Checking the code against the vulnerabilities..."
2424
}
2525
}
26-
{
27-
"SBOM": {
28-
"go_version": "go1.18",
29-
"modules": [
30-
{
31-
"path": "golang.org/replace"
32-
},
33-
{
34-
"path": "golang.org/x/text",
35-
"version": "v0.3.0"
36-
},
37-
{
38-
"path": "stdlib",
39-
"version": "v1.18.0"
40-
}
41-
],
42-
"roots": [
43-
"golang.org/replace"
44-
]
45-
}
46-
}
4726
{
4827
"osv": {
4928
"schema_version": "1.3.1",

0 commit comments

Comments
 (0)