Golang: Search remote licenses not working in a CI pipeline when scanning Docker image about syft

[kzantow]

Hi @Joerki -- I'm a bit confused what the problem is. I see search-remote-licenses is set to false, which is the default and I don't see this being set by an environment variable, so it's expected to be false. The default local-mod-cache-dir is based on your home directory, which is also expected. Could you elaborate on your configuration and the problem a bit to help me understand?

[Joerki]

Hi @kzantow ,

I changed the inspection and updated the description.
I hope you can reproduce the problem.
BR,
Jörg

[Joerki]

Hi @kzantow ,

now I can describe the exact problem after I debug it properly.
Syft assumes that Go is installed on the machine when Go binaries are inspected. But this is a wrong assumption.

I modified HOME in the environment (to simulate that I do not have go on my machine).

{
    "version": "0.2.0",
    "configurations": [
        {
            "name": "Launch Package",
            "type": "go",
            "request": "launch",
            "mode": "auto",
            "program": "cmd/syft/main.go",
            "args": ["scan", "mongo:5.0.26-focal", "-o", "syft-json=/home/joerg/projects/mongo_inspect/mongo-syft-single.json", "-vv"],
            "env": { "HOME": "/home/joerg/projects/mongo_inspect/temp", "GOPATH": "", "SYFT_GOLANG_SEARCH_REMOTE_LICENSES": "true" }
        }
    ]
}

Please look here:

syft/pkg/cataloger/golang/licenses.go

func modCacheResolver

Syft appended "go/pkg/mod" to my HOME path. This is the content of my modCacheDir parameter.
My $HOME exists, but not $HOME/go/pkg/mod.
The result is that the path is not found (a trace method is written, not a trace for me, the problem should be much more obvious), and an empty fileresolver is created. So downloaded licenses go to nowhere.

My temporary workaround in the pipeline will be hopefully the creation of $HOME/go/pkg/mod directory.
But Syft has to use a directory where packages can be written to and analysed.

BR,
Jörg

[Joerki]

I can confirm that my temporary solution - the creation of $HOME/go/pkg/mod before Syft invocation - is working.