CycloneDX / CycloneDX/cyclonedx-gomod
SBOM- ERR error="failed to load package: no Go files in /builds/platform/<project_repo>"
- Dominant language
- Go
- Stars
- 187
- Forks
- 40
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 14
Description
$ cyclonedx-gomod "${go_mode:0:3}" -json -output reports/go-sbom.cyclonedx.json $GO_SBOM_OPTS
The command can be refered in to-be-continiuos [sbom-generation](https://gitlab.cicd.pcc.zone/to-be-continuous/golang/-/blob/master/templates/gitlab-ci-golang.yml?ref_type=heads#L653)
This command expects the go mod files and go files on the same directory and is not working for standard go folder structures like below
ERR error="failed to load modules: not a go module"
.
├── go.mod
├── cmd/myapp/main.go
├── internal/foo/foo.go
I would have expected the cylonedx-gomad command detect the go mod files from anywhere in the GO_PROJECT_DIR and execute the command for all go files recursively.
configuring this variable GO_SBOM_OPTS still fails if this variable is configure with single directory path or with multiple directory path, then it throws command expects
ERR error="too many arguments (expected 1, got 2)"
Contributor guide
Research direction
Start by reproducing the shown cyclonedx-gomod invocation against the listed standard Go directory tree, then compare its behavior with the linked sbom-generation GitLab template and the GO_SBOM_OPTS forms described. Done means a project with go.mod at the root and Go files under cmd/ or internal/ can generate the requested SBOM without the reported module or argument errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100