CycloneDX / CycloneDX/cyclonedx-gomod
Different naming of Golang standard library between trivy and cyclonedx-gomod
- Dominant language
- Go
- Stars
- 187
- Forks
- 40
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 14
Description
### Description
When running trivy and cyclonedx-gomod to generate SBOMs different names for the golang standard libraray component are assigned. This makes merging of SBOMs only possible with a hard coded list of alternative names.
### Desired Behavior
Both trivy and cyclonedx-gomod assign the same name for the golang standard library **stdlib** to allow proper merging of SBOMs. Trivy uses the same identifier as the Go team does for vulnerabilities, e,g [check](https://github.com/golang/vulndb/blob/953c816d6fd6982a83defdb9d886092aafa37e57/data/osv/GO-2023-1621.json#L14).
### Actual Behavior
The golang standard library is named as follows:
trivy: stdlib
``` json
{
"bom-ref": "pkg:golang/stdlib@1.23.4",
"type": "library",
"name": "stdlib",
"version": "1.23.4",
"purl": "pkg:golang/stdlib@1.23.4",
"properties": [
{
"name": "aquasecurity:trivy:LayerDiffID",
"value": "sha256:f75706aada560f9fc3c035a44e9c8f8da8bf7317a39df18ae86c56fdd8344d66"
},
{
"name": "aquasecurity:trivy:LayerDigest",
"value": "sha256:9f888a47f0b0f4ecd36abfd90d4a77bc93fcedb6135f4d24fd36b6d6b232533c"
},
{
"name": "aquasecurity:trivy:PkgType",
"value": "gobinary"
}
]
},
```
cyclonedx-gomod: std
``` json
{
"bom-ref": "pkg:golang/std@go1.23.4?type=module",
"type": "library",
"name": "std",
"version": "go1.23.4",
"scope": "required",
"purl": "pkg:golang/std@go1.23.4?type=module\u0026goos=linux\u0026goarch=amd64"
},
```
### Reproduction Steps
Create SBOM from trivy source code (v0.59.0)
1. cyclonedx-gomod app -json -output cdx.sbom.json -std -main cmd/trivy
2. trivy image --format cyclonedx --output trivy.sbom.json aquasec/trivy:0.59.0
Contributor guide
Research direction
Start by running the two reproduction commands against trivy 0.59.0 and compare the generated CycloneDX components for the Go standard library. Trace where cyclonedx-gomod assigns the standard-library module name and version, then verify the generated component uses stdlib consistently with Trivy and the Go vulnerability database identifier.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100