Follow/resolve directory symlinks during license file search
- Dominant language
- Go
- Stars
- 183
- Forks
- 18
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 7
Description
## Summary
When scanning a directory for license files(not syft sbom generation), `grant` skips symlinks that point to directories. This means license files inside symlinked directories are not discovered by the local license file search:
https://github.com/anchore/grant/blob/8358948e7569c6d31b2fb14bf431ebe88ab3a231/grant/case.go#L400-L440
This was discovered as a bug in #70. `filepath.WalkDir` uses `lstat` semantics and never descends into symlinked directories. They appear as non-directory entries. Without skipping them, they get passed to the license classifier, which causes errors.
## Current behavior
- Symlinks to regular files: **followed** (license is detected)
- Symlinks to directories: **skipped** (licenses inside are missed)
- Broken symlinks: **skipped**
## Desired behavior
Directory symlinks should be resolved and followed during the license file search, with cycle detection to prevent infinite loops (e.g., `a -> b -> a`).
Contributor guide
Research direction
Start in grant/case.go around lines 400-440 and inspect the local license file search built on filepath.WalkDir, including its handling of symlink entries. Done means directory symlinks are resolved and searched, broken symlinks remain skipped, and cycles such as a -> b -> a cannot cause infinite traversal.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100