Documentation
¶
Overview ¶
Package binscan inspects Go binaries on disk. It reuses the two stripping-tolerant techniques from the rke2-toolbox vex_candidates.py script:
- pclntab presence test (primary): a Go binary keeps its function-name table even when fully stripped (-ldflags=-s -w). If a vulnerable package's own symbols never appear, the linker dead-code-eliminated it.
- govulncheck binary mode (secondary, non-stripped binaries only): a linked-but-unreachable package is reported not_affected.
Module versions are read directly from each binary's embedded build info, so no external Trivy report is required.
Index ¶
Constants ¶
const StdlibModule = "stdlib"
StdlibModule is the module name the Go vulnerability database and govulncheck use for the standard library. Its "version" is the Go toolchain version.
Variables ¶
This section is empty.
Functions ¶
func GovulncheckAvailable ¶ added in v0.8.1
func GovulncheckAvailable() bool
GovulncheckAvailable reports whether the govulncheck binary is on PATH. When it is not, the binary-mode reachability test below is skipped and a linked, package-granularity, non-stripped finding stays linked when it might have been ruled not_in_execute_path. The caller surfaces that so a skipped test is never mistaken for a run that had nothing to rule out.
func GovulncheckNotAffected ¶
GovulncheckNotAffected runs govulncheck in binary mode and returns the set of vulnerability ids it marks not_affected. Best effort: returns an empty set if govulncheck is unavailable or errors.
func IsStripped ¶
IsStripped reports whether an ELF Go binary carries no symbol table. Non-ELF binaries are treated as stripped (conservative: skips govulncheck binary mode, which over-reports without symbols).
func NormalizeGoVersion ¶
NormalizeGoVersion turns a build-info Go version string ("go1.24.0", or "go1.24.0 X:boringcrypto") into the numeric version OSV expects ("1.24.0"). It returns "" for development builds whose version is not a released tag.
Types ¶
type Binary ¶
Binary is a discovered Go binary and its embedded build info. Path is a host path, because the two things done with it afterwards -- reading the whole file for pclntab tests, and handing it to govulncheck -- are not tree-relative operations.
func FindGoBinaries ¶
FindGoBinaries walks the tree and returns every Go binary in it. Non-Go and unreadable files are skipped.
It goes through RootFS rather than walking the host directory directly for two reasons that only show up outside image mode. A subtree this walk cannot enter is recorded rather than dropped -- a Go binary nobody looked at is a module the report never mentions, which reads exactly like a module with no advisories against it. And a tree captured from a running system has /proc in it, whose synthetic entries stat as regular files and would each be opened and sniffed.
func (Binary) ModuleVersion ¶
ModuleVersion returns the version of module as linked into the binary, or "" if the module is not a dependency. It checks the main module, direct/indirect deps and honours replace directives. For the standard library (StdlibModule) it returns the binary's Go toolchain version, since stdlib is not listed as a dependency.
type Symbols ¶
type Symbols struct {
// contains filtered or unexported fields
}
Symbols is a loaded copy of a binary's bytes used for pclntab presence tests.
func LoadSymbols ¶
LoadSymbols reads the binary once for later presence checks.
func (*Symbols) ModulePresent ¶
ModulePresent reports whether any part of module (root or a sub-package) appears in the binary. Used as a coarse fallback when OSV lists no package-level import paths.
func (*Symbols) PackagePresent ¶
PackagePresent reports whether pkg's own functions appear in the binary. It matches `pkg.<ident>` exactly so a parent package match does not leak from a child (e.g. .../ssh vs .../ssh/agent).
Source Files