Documentation
¶
Overview ¶
Package modulecache materialises the module cache an isolated call-graph analysis reads, from the bytes kanonarion's own store holds.
It is the callgraph context's side of a rule the vuln scan has applied since its own offline posture landed: an analysis pinned to GOPROXY=off resolves from a cache or from nowhere, so the cache is something the run BUILDS rather than something it hopes to find. Reading the host's cache instead made the answer depend on what unrelated go commands had left on the machine.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Cache ¶
type Cache struct {
// contains filtered or unexported fields
}
Cache is a cgports.ModuleCache backed by the fetch ledger and the blob store.
func New ¶
func New(facts fetchports.FactStore, blobs fetchports.BlobStore, logger *slog.Logger) *Cache
New constructs a Cache that populates from the store alone.
func (*Cache) Materialise ¶
func (c *Cache) Materialise(ctx context.Context, dir string, main cgports.MainModule) cgports.ModuleCacheReport
Materialise writes the module cache an analysis of this main module reads. See cgports.ModuleCache.
Two populations, and the second is conditional on what the toolchain will actually read:
- the SOURCE of every requirement, always, because the type checker compiles it. A main module on go1.17 or later reads a pruned module graph, so its own require block names every module providing a package the build imports — the build's source, established without resolving anything.
- the go.mod of everything reachable from the UNPRUNED part of the graph, to a fixpoint. Minimal version selection reads the requirements of versions it goes on to supersede, and those appear on no edge of any walk; but it only reads them where pruning does not apply, which is under a pre-pruning main module or beneath a pre-pruning requirement.
The second population is rooted rather than unconditional, and the rooting is the whole of its cost. Expanded from every requirement of a pruned main module it has no stopping condition tied to what any toolchain opens: measured on cloud.google.com/go/iam@v1.11.0, whose go.mod declares go1.25 and whose graph the toolchain prunes to 38 modules, it reached 3361 versions and fetched 1653 go.mod files that nothing would ever read. Rooted, that module needs none.
The go.mod pass re-reaches its roots as seeds and rewrites none of them — their go.mod arrived with their source — following what they require, which is the whole point of seeding it there.
func (*Cache) WithFetcher ¶
func (c *Cache) WithFetcher(f ModuleFetcher) *Cache
WithFetcher lets the cache acquire coordinates the store is missing.
Without it a module whose own dependency closure no walk ever resolved is reported as a set of holes and analysed against a partial cache, which is exactly the case this whole path exists for: the walk fetches what the CONSUMER's build selected, and a module's own requirements are a different set.
type ModuleFetcher ¶
type ModuleFetcher interface {
// FetchModule acquires the full artefact — zip and go.mod — which is the
// source a load type-checks.
FetchModule(ctx context.Context, coord coordinate.ModuleCoordinate) error
// FetchModuleGoMod acquires the go.mod alone, for a version that is read for
// module-graph arithmetic and never compiled.
FetchModuleGoMod(ctx context.Context, coord coordinate.ModuleCoordinate) error
}
ModuleFetcher acquires a coordinate the fact store does not hold.
It is declared here rather than imported because this package is the consumer: the closure discovers versions no walk ever selected, and a materialiser with no fetcher can only report them as holes. The composition root supplies the fetch context's adapter, which already satisfies it.
Source Files