CycloneDX / CycloneDX/cyclonedx-gomod

Different naming of Golang standard library between trivy and cyclonedx-gomod

Open
#587 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
187
Forks
40
Avg merge
1d 7h
Merged PRs (30d)
14

Description

### Description
When running trivy and cyclonedx-gomod to generate SBOMs different names for the golang standard libraray component are assigned. This makes merging of SBOMs only possible with a hard coded list of alternative names.

### Desired Behavior
Both trivy and cyclonedx-gomod assign the same name for the golang standard library **stdlib** to allow proper merging of SBOMs. Trivy uses the same identifier as the Go team does for vulnerabilities, e,g [check](https://github.com/golang/vulndb/blob/953c816d6fd6982a83defdb9d886092aafa37e57/data/osv/GO-2023-1621.json#L14).

### Actual Behavior
The golang standard library is named as follows:

trivy: stdlib

``` json
{
"bom-ref": "pkg:golang/stdlib@1.23.4",
"type": "library",
"name": "stdlib",
"version": "1.23.4",
"purl": "pkg:golang/stdlib@1.23.4",
"properties": [
{
"name": "aquasecurity:trivy:LayerDiffID",
"value": "sha256:f75706aada560f9fc3c035a44e9c8f8da8bf7317a39df18ae86c56fdd8344d66"
},
{
"name": "aquasecurity:trivy:LayerDigest",
"value": "sha256:9f888a47f0b0f4ecd36abfd90d4a77bc93fcedb6135f4d24fd36b6d6b232533c"
},
{
"name": "aquasecurity:trivy:PkgType",
"value": "gobinary"
}
]
},
```
cyclonedx-gomod: std

``` json
{
"bom-ref": "pkg:golang/std@go1.23.4?type=module",
"type": "library",
"name": "std",
"version": "go1.23.4",
"scope": "required",
"purl": "pkg:golang/std@go1.23.4?type=module\u0026goos=linux\u0026goarch=amd64"
},
```

### Reproduction Steps
Create SBOM from trivy source code (v0.59.0)
1. cyclonedx-gomod app -json -output cdx.sbom.json -std -main cmd/trivy
2. trivy image --format cyclonedx --output trivy.sbom.json aquasec/trivy:0.59.0

Contributor guide

Open the contributing guide

Research direction

Start by running the two reproduction commands against trivy 0.59.0 and compare the generated CycloneDX components for the Go standard library. Trace where cyclonedx-gomod assigns the standard-library module name and version, then verify the generated component uses stdlib consistently with Trivy and the Go vulnerability database identifier.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.