CycloneDX / CycloneDX/cyclonedx-gomod

SBOM- ERR error="failed to load package: no Go files in /builds/platform/<project_repo>"

Open
#702 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
187
Forks
40
Avg merge
1d 7h
Merged PRs (30d)
14

Description

$ cyclonedx-gomod "${go_mode:0:3}" -json -output reports/go-sbom.cyclonedx.json $GO_SBOM_OPTS

The command can be refered in to-be-continiuos [sbom-generation](https://gitlab.cicd.pcc.zone/to-be-continuous/golang/-/blob/master/templates/gitlab-ci-golang.yml?ref_type=heads#L653)

This command expects the go mod files and go files on the same directory and is not working for standard go folder structures like below

ERR error="failed to load modules: not a go module"

.
├── go.mod
├── cmd/myapp/main.go
├── internal/foo/foo.go

I would have expected the cylonedx-gomad command detect the go mod files from anywhere in the GO_PROJECT_DIR and execute the command for all go files recursively.
configuring this variable GO_SBOM_OPTS still fails if this variable is configure with single directory path or with multiple directory path, then it throws command expects

ERR error="too many arguments (expected 1, got 2)"

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the shown cyclonedx-gomod invocation against the listed standard Go directory tree, then compare its behavior with the linked sbom-generation GitLab template and the GO_SBOM_OPTS forms described. Done means a project with go.mod at the root and Go files under cmd/ or internal/ can generate the requested SBOM without the reported module or argument errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.