Documentation
¶
Overview ¶
Package source analyzes a Go project straight from its source repository rather than a shipped image. It clones the repo and runs govulncheck in source mode, whose call-graph reachability analysis is authoritative (and strictly better than the pclntab heuristic used for stripped binaries): for every advisory in the dependency graph it reports whether the vulnerable code is unused (vulnerable_code_not_present), imported-but-unreachable (vulnerable_code_not_in_execute_path) or actually called (affected).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Checkout ¶
func Checkout(ctx context.Context, repoArg, ref, subPath string, logf func(string, ...any)) (*target.Source, func(), error)
Checkout makes repoArg available on disk and describes it as a target.Source. If repoArg points at an existing local directory (or a file:// URL) it is used in place; otherwise it is shallow-cloned at ref. The returned cleanup removes whatever Checkout created and is a no-op for a local checkout, so it is always safe to defer.
Types ¶
type Statement ¶
type Statement struct {
GoID string // canonical GO- id (openvex "name")
Aliases []string // CVE-/GHSA- ids
Module string // affected module import path (decoded from the purl)
Version string // affected module version
Status string // "affected" | "not_affected"
Justification string // openvex justification for not_affected
}
Statement is one parsed govulncheck OpenVEX statement.
func CloneAndScan ¶
func CloneAndScan(ctx context.Context, repoArg, ref, subPath, goVersion string, logf func(string, ...any)) ([]Statement, error)
CloneAndScan checks out repoArg and scans it, discarding the checkout.
func Scan ¶
func Scan(ctx context.Context, src *target.Source, goVersion string, logf func(string, ...any)) ([]Statement, error)
Scan runs govulncheck source mode over an already-checked-out tree. goVersion, when non-empty, pins the Go toolchain used for analysis (GOTOOLCHAIN=go<goVersion>), which matters for standard-library findings since those depend on the toolchain version.
Source Files