Skip to content

Commit d151586

Browse files
ruromeroruromero
committed
fix(go): remove directDepPaths filtering that drops direct dependencies
Commit de12f6a introduced filtering in getSBOM() that uses go mod edit -json's Indirect flag to exclude root-level edges from go mod graph. This caused go_mod_no_ignore direct dependency count to drop from 45 to 7 (84% reduction). The Java client treats all root-level edges from go mod graph as direct dependencies. The go mod graph output is the authoritative dependency tree after MVS resolution — filtering based on go.mod's indirect markers removes real edges from the graph. Remove the directDepPaths set construction and its filtering guards from both the stack analysis and component analysis paths. Add a reproducer test asserting 45 direct deps for go_mod_no_ignore. Regenerate all affected expected SBOM fixtures. Implements TC-4275 Assisted-by: Claude Code
1 parent d9c1ae4 commit d151586

11 files changed

Lines changed: 3950 additions & 2517 deletions

‎src/providers/golang_gomodules.js‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -249,15 +249,6 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
249249
let rows = goGraphOutput.split(getLineSeparatorGolang()).filter(line => !line.includes(' go@'));
250250
let root = goModEditOutput['Module']['Path']
251251

252-
// Build set of direct dependency paths from go mod edit -json
253-
let directDepPaths = new Set()
254-
if (goModEditOutput['Require']) {
255-
goModEditOutput['Require'].forEach(req => {
256-
if (!req['Indirect']) {
257-
directDepPaths.add(req['Path'])
258-
}
259-
})
260-
}
261252
let matchManifestVersions = getCustom("MATCH_MANIFEST_VERSIONS", "false", opts);
262253
if(matchManifestVersions === "true") {
263254
performManifestVersionsCheck(root, rows, manifestContent, parser, requireQuery)
@@ -281,9 +272,6 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
281272
}
282273
let child = getChildVertexFromEdge(row)
283274
let target = toPurl(child, "@");
284-
if (getParentVertexFromEdge(row) === root && !directDepPaths.has(getPackageName(child))) {
285-
return;
286-
}
287275
sbom.addDependency(source, target)
288276

289277
})
@@ -296,9 +284,7 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
296284
let child = getChildVertexFromEdge(pair)
297285
let target = toPurl(child, "@");
298286
if(dependencyNotIgnored(ignoredDeps, target)) {
299-
if (directDepPaths.has(getPackageName(child))) {
300-
sbom.addDependency(mainModule, target)
301-
}
287+
sbom.addDependency(mainModule, target)
302288
}
303289
})
304290
enforceRemovingIgnoredDepsInCaseOfAutomaticVersionUpdate(ignoredDeps, sbom)

‎test/providers/golang_gomodules.test.js‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,15 @@ suite('testing the golang-go-modules data provider', () => {
5858

5959
});
6060

61+
test('verify go_mod_no_ignore component analysis includes all root-level deps from go mod graph', async () => {
62+
let providedData = await golangGoModules.provideComponent('test/providers/tst_manifests/golang/go_mod_no_ignore/go.mod')
63+
let sbom = JSON.parse(providedData.content)
64+
let rootDeps = sbom.dependencies.find(d => d.dependsOn && d.dependsOn.length > 0)
65+
expect(rootDeps.dependsOn).to.have.lengthOf(45,
66+
'Component analysis should include all root-level edges from go mod graph as direct deps. ' +
67+
'A lower count indicates the directDepPaths filtering is incorrectly excluding indirect require entries.')
68+
}).timeout(process.env.GITHUB_ACTIONS ? 15000 : 10000);
69+
6170
[
6271
"go_mod_mvs_versions"
6372

‎test/providers/tst_manifests/golang/go_mod_light_no_ignore/expected_sbom_component_analysis.json‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,23 @@
2929
"purl": "pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0",
3030
"type": "library",
3131
"bom-ref": "pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0"
32+
},
33+
{
34+
"group": "gopkg.in",
35+
"name": "yaml.v3",
36+
"version": "v3.0.1",
37+
"purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
38+
"type": "library",
39+
"bom-ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.1"
3240
}
3341
],
3442
"dependencies": [
3543
{
3644
"ref": "pkg:golang/golang.org/x/example@v0.0.0",
3745
"dependsOn": [
3846
"pkg:golang/github.com/spf13/cobra@v0.0.5",
39-
"pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0"
47+
"pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0",
48+
"pkg:golang/gopkg.in/yaml.v3@v3.0.1"
4049
]
4150
},
4251
{
@@ -46,6 +55,10 @@
4655
{
4756
"ref": "pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0",
4857
"dependsOn": []
58+
},
59+
{
60+
"ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
61+
"dependsOn": []
4962
}
5063
]
5164
}

‎test/providers/tst_manifests/golang/go_mod_light_no_ignore/expected_sbom_stack_analysis.json‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,14 @@
3030
"type": "library",
3131
"bom-ref": "pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0"
3232
},
33+
{
34+
"group": "gopkg.in",
35+
"name": "yaml.v3",
36+
"version": "v3.0.1",
37+
"purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
38+
"type": "library",
39+
"bom-ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.1"
40+
},
3341
{
3442
"group": "github.com/BurntSushi",
3543
"name": "toml",
@@ -126,14 +134,6 @@
126134
"type": "library",
127135
"bom-ref": "pkg:golang/golang.org/x/xerrors@v0.0.0-20200804184101-5ec99f83aff1"
128136
},
129-
{
130-
"group": "gopkg.in",
131-
"name": "yaml.v3",
132-
"version": "v3.0.1",
133-
"purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
134-
"type": "library",
135-
"bom-ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.1"
136-
},
137137
{
138138
"group": "gopkg.in",
139139
"name": "check.v1",
@@ -316,7 +316,8 @@
316316
"ref": "pkg:golang/golang.org/x/example@v0.0.0",
317317
"dependsOn": [
318318
"pkg:golang/github.com/spf13/cobra@v0.0.5",
319-
"pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0"
319+
"pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0",
320+
"pkg:golang/gopkg.in/yaml.v3@v3.0.1"
320321
]
321322
},
322323
{
@@ -341,6 +342,12 @@
341342
"pkg:golang/golang.org/x/xerrors@v0.0.0-20200804184101-5ec99f83aff1"
342343
]
343344
},
345+
{
346+
"ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
347+
"dependsOn": [
348+
"pkg:golang/gopkg.in/check.v1@v0.0.0-20161208181325-20d25e280405"
349+
]
350+
},
344351
{
345352
"ref": "pkg:golang/github.com/BurntSushi/toml@v0.3.1",
346353
"dependsOn": []
@@ -422,12 +429,6 @@
422429
"ref": "pkg:golang/golang.org/x/xerrors@v0.0.0-20200804184101-5ec99f83aff1",
423430
"dependsOn": []
424431
},
425-
{
426-
"ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.1",
427-
"dependsOn": [
428-
"pkg:golang/gopkg.in/check.v1@v0.0.0-20161208181325-20d25e280405"
429-
]
430-
},
431432
{
432433
"ref": "pkg:golang/gopkg.in/check.v1@v0.0.0-20161208181325-20d25e280405",
433434
"dependsOn": []

0 commit comments

Comments
 (0)