Documentation
¶
Overview ¶
Package toolexec runs the external tools Draugr orchestrates, and reports what it ran.
It exists so that every external invocation — scanners today, SBOM generation and whatever comes next — narrates itself the same way. Without that, a run is a black box: you can see that something failed but not the command, the directory, how long it took, or what the tool itself said about it.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Run ¶
Run executes argv and returns its stdout. dir sets the working directory; empty inherits the current one. Some tools resolve their target relative to the working directory rather than from an argument (gosec loads Go packages via `./...`), so for those the checkout has to be the cwd, not just a path passed in.
No shell is involved — exec.CommandContext, not "sh -c" — and argv is built from typed config by the caller, never from user shell input.
func RunCombined ¶ added in v0.52.0
RunCombined is Run capturing stderr alongside stdout.
For a tool asked a question rather than told to scan. Several write their answer to stderr — `nuclei -templates-version` prints its whole reply there and nothing at all to stdout — so a caller reading only stdout gets an empty string and concludes the wrong thing. Keeping this separate from Run is deliberate: a scanner's stdout is a report to be parsed, and folding stderr into it would corrupt the parse for every tool that logs while it works.
func RunWithEnv ¶ added in v0.45.0
RunWithEnv is Run with extra environment variables layered over the parent's, each "K=V".
A tool that shells out to another tool cannot be told which context to work in through argv — kube-bench invokes kubectl itself, and kubectl takes its cluster from the environment. This is how a scanner points such a tool at the right target rather than whatever the machine happens to be configured for.
Types ¶
This section is empty.
Source Files