CycloneDX / CycloneDX/cyclonedx-gomod

Panic when running `cyclonedx-gomod mod` on a project with no source files.

Open
#734 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
187
Forks
40
Avg merge
1d 7h
Merged PRs (30d)
14

Description

Panic when running `cyclonedx-gomod mod` on a project with no source files.

```bash
panic: runtime error: index out of range [0] with length 0

goroutine 1 [running]:
github.com/CycloneDX/cyclonedx-gomod/pkg/generate/mod.generator.Generate({{{0xe59820, 0xc002d7b9b0}, 0x1, {0x0, 0x0}, {0xc0000d0800, 0x1, 0x1f4}, {0xc002d7b9c0, 0x1, ...}, ...}, ...})
/home/xxx/go/pkg/mod/github.com/!cyclone!d!x/cyclonedx-gomod@v1.10.0/pkg/generate/mod/generator.go:102 +0xb0c
github.com/CycloneDX/cyclonedx-gomod/internal/cli/cmd/mod.Exec({{0x0}, {{0xd48d62, 0x1}, {0xd58f46, 0x3}, 0x0, 0x0}, {0x0, 0x0, 0x0, ...}, ...})
/home/xxx/go/pkg/mod/github.com/!cyclone!d!x/cyclonedx-gomod@v1.10.0/internal/cli/cmd/mod/mod.go:98 +0x317
github.com/CycloneDX/cyclonedx-gomod/internal/cli/cmd/mod.New.func1({0x1?, 0x1?}, {0xc000124140?, 0x0?, 0xc98260?})
/home/xxx/go/pkg/mod/github.com/!cyclone!d!x/cyclonedx-gomod@v1.10.0/internal/cli/cmd/mod/mod.go:69 +0xb8
github.com/peterbourgon/ff/v3/ffcli.(*Command).Run(0xc000124140?, {0xe5d100?, 0x168d5e0?})
/home/xxx/go/pkg/mod/github.com/peterbourgon/ff/v3@v3.4.0/ffcli/command.go:153 +0x159
github.com/peterbourgon/ff/v3/ffcli.(*Command).Run(0xc0000544d0?, {0xe5d100?, 0x168d5e0?})
/home/xxx/go/pkg/mod/github.com/peterbourgon/ff/v3@v3.4.0/ffcli/command.go:157 +0x105
github.com/peterbourgon/ff/v3/ffcli.(*Command).ParseAndRun(0xc0000544d0, {0xe5d100, 0x168d5e0}, {0xc000124130?, 0xc0002b7ce0?, 0x41e654?})
/home/xxx/go/pkg/mod/github.com/peterbourgon/ff/v3@v3.4.0/ffcli/command.go:169 +0x49
main.main()
/home/xxx/go/pkg/mod/github.com/!cyclone!d!x/cyclonedx-gomod@v1.10.0/cmd/cyclonedx-gomod/main.go:33 +0x6f
```

### Expected behaviour

A panic is not returned. Ideally, a BOM is returned that includes the module as a component.

### Steps to reproduce
1. Run the script below to create an empty project

```bash
#!/bin/bash
mkdir -p cyclonedx-gomod-fail

echo "module github.com/test/cyclonedx-gomod-fail

go 1.24.3
" >cyclonedx-gomod-fail/go.mod
```

2. Run cyclonedx-gomod:
```bash
cd cyclonedx-gomod-fail
cyclonedx-gomod mod
```

Contributor guide

Open the contributing guide

Research direction

Start in pkg/generate/mod/generator.go at the panic location shown in the stack trace, then inspect internal/cli/cmd/mod/mod.go to understand the command path. Reproduce with an empty go.mod project using cyclonedx-gomod mod. Done means the command does not panic and ideally returns a BOM containing the module as a component.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.