CycloneDX / CycloneDX/cyclonedx-gomod

Indirect dependencies not added BOM file while generation BOM using Cyclonedx

Open
#485 4 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
Go
Stars
187
Forks
40
Avg merge
1d 7h
Merged PRs (30d)
14

Description

I used cyclonedx-gomod to generate a BOM file, but some internal dependencies were not included. Although most indirect dependencies were added, the following two were not:

github.com/stretchr/objx v0.5.0 (indirect)
google.golang.org/appengine v1.6.7 (indirect)

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the BOM generated by cyclonedx-gomod for a Go module containing github.com/stretchr/objx v0.5.0 and google.golang.org/appengine v1.6.7. Compare the module dependency data with the generated BOM and verify that both indirect dependencies appear when the issue is fixed.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.