From 102f630dc2176eb1560108ef5453c9b0aea61082 Mon Sep 17 00:00:00 2001 From: Ruben Romero Montes Date: Tue, 31 Mar 2026 01:15:39 +0200 Subject: [PATCH] fix: filter toolchain entries in GoModulesProvider isGoToolchainEntry() now matches both go@* and toolchain@* entries, aligning with the JS client's isSpecialGoModule() behavior. TC-3919 Co-Authored-By: Claude Opus 4.6 --- .../trustifyda/providers/GoModulesProvider.java | 8 ++++---- .../providers/Golang_Modules_Provider_Test.java | 13 +++++++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java b/src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java index 4c28cbca..f167441c 100644 --- a/src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java +++ b/src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java @@ -394,10 +394,10 @@ private static List collectAllDirectDependencies(List targetLine .collect(Collectors.toList()); } - private static boolean isGoToolchainEntry(String dependency) { - // Filter out Go toolchain entries like "go@1.18", "go@1.19", etc. - // These are not actual dependencies but the Go toolchain itself - return dependency.startsWith("go@"); + static boolean isGoToolchainEntry(String dependency) { + // Filter out Go toolchain entries like "go@1.18" and "toolchain@go1.21.0". + // These are not actual dependencies but the Go toolchain itself. + return dependency.startsWith("go@") || dependency.startsWith("toolchain@"); } private String buildGoModulesDependencies(Path manifestPath) { diff --git a/src/test/java/io/github/guacsec/trustifyda/providers/Golang_Modules_Provider_Test.java b/src/test/java/io/github/guacsec/trustifyda/providers/Golang_Modules_Provider_Test.java index a940f5f9..69444ed3 100644 --- a/src/test/java/io/github/guacsec/trustifyda/providers/Golang_Modules_Provider_Test.java +++ b/src/test/java/io/github/guacsec/trustifyda/providers/Golang_Modules_Provider_Test.java @@ -198,6 +198,19 @@ void Test_Golang_MvS_Logic_Disabled() throws IOException { == 1); } + @Test + void test_isGoToolchainEntry_filters_go_and_toolchain() { + // go@* entries should be filtered + assertThat(GoModulesProvider.isGoToolchainEntry("go@1.18")).isTrue(); + assertThat(GoModulesProvider.isGoToolchainEntry("go@1.21.0")).isTrue(); + // toolchain@* entries should be filtered + assertThat(GoModulesProvider.isGoToolchainEntry("toolchain@go1.21.0")).isTrue(); + assertThat(GoModulesProvider.isGoToolchainEntry("toolchain@go1.22.2")).isTrue(); + // normal module entries should NOT be filtered + assertThat(GoModulesProvider.isGoToolchainEntry("github.com/spf13/cobra@v0.0.5")).isFalse(); + assertThat(GoModulesProvider.isGoToolchainEntry("golang.org/x/tools@v0.1.0")).isFalse(); + } + private String dropIgnoredKeepFormat(String s) { return s.replaceAll("goarch=\\w+&goos=\\w+&", "") .replaceAll("\"timestamp\" : \"[a-zA-Z0-9\\-\\:]+\",\n ", "");