feat(license): scan vendor directory for license for go.mod files #8689

oneum20 · 2025-04-05T04:12:28Z

Description

This PR adds support for scanning the vendor directory when detecting licenses for Go modules. Currently, Trivy only checks for licenses in $GOPATH/pkg/mod, but when users use go mod vendor command, the dependencies are stored in the vendor directory without their own go.mod files.

Related issues

ISSUES - 8527

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

DmitriyLewen

Hello @oneum20
Thanks for your work!

Left a few comments. Take a look, when you have time, please
Also we need to update docs (see https://trivy.dev/latest/docs/coverage/language/golang/#license)

DmitriyLewen · 2025-04-07T06:46:47Z

pkg/fanal/analyzer/language/golang/mod/mod.go

@@ -143,6 +149,14 @@ func (a *gomodAnalyzer) fillAdditionalData(apps []types.Application) error {
 		usedPkgs := lo.SliceToMap(app.Packages, func(pkg types.Package) (string, types.Package) {
 			return pkg.Name, pkg
 		})
+
+		// Check if the vendor directory exists
+		vendorPath := filepath.Join(absPath, filepath.Dir(app.FilePath), "vendor")


if $GOPATH/pkg/mod doesn't exist - you will not check vendor dir.

trivy/pkg/fanal/analyzer/language/golang/mod/mod.go

Lines 140 to 144 in 118cd99

if !fsutils.DirExists(modPath) {

a.logger.Debug("GOPATH not found. Need 'go mod download' to fill licenses and dependency relationships",

log.String("GOPATH", modPath))

return nil

}

DmitriyLewen · 2025-04-07T07:04:56Z

pkg/fanal/analyzer/language/golang/mod/mod.go

@@ -123,7 +124,12 @@ func (a *gomodAnalyzer) Version() int {
 }

 // fillAdditionalData collects licenses and dependency relationships, then update applications.
-func (a *gomodAnalyzer) fillAdditionalData(apps []types.Application) error {
+func (a *gomodAnalyzer) fillAdditionalData(apps []types.Application, fsys fs.FS) error {
+	absPath, err := filepath.Abs(fsys.(*mapfs.FS).GetUnderlyingRoot())


If repository contains required files - we try to add them into CompositeFS.
e.g. node_modules dir for npm and yarn.
So i suggest to add vendor dir into CompositeFS (use Required function)

DmitriyLewen · 2025-04-07T07:11:45Z

pkg/fanal/analyzer/language/golang/mod/mod.go

+			modDirSuffix := fmt.Sprintf("@%s", lib.Version)
+			if modPath == vendorPath {
+				modDirSuffix = ""
+			}
+			modDir := filepath.Join(modPath, fmt.Sprintf("%s%s", normalizeModName(lib.Name), modDirSuffix))


I think it will be easier to understand this way.

Suggested change

modDirSuffix := fmt.Sprintf("@%s", lib.Version)

if modPath == vendorPath {

modDirSuffix = ""

}

modDir := filepath.Join(modPath, fmt.Sprintf("%s%s", normalizeModName(lib.Name), modDirSuffix))

// Package dir from `vendor` dir doesn't have version suffix.

modDirName := normalizeModName(lib.Name)

if modPath != vendorPath {

// Add version suffix for packages from $$GOPATH

// e.g. $GOPATH/pkg/mod/github.com/aquasecurity/go-dep-parser@v1.0.0

modDirName = fmt.Sprintf("%s@%s", modDirName, lib.Version)

}

modDir := filepath.Join(modPath, modDirName)

DmitriyLewen · 2025-04-07T07:12:25Z

pkg/fanal/analyzer/language/golang/mod/mod.go

@@ -151,7 +165,11 @@ func (a *gomodAnalyzer) fillAdditionalData(apps []types.Application) error {
 			}

 			// e.g. $GOPATH/pkg/mod/github.com/aquasecurity/go-dep-parser@v1.0.0
-			modDir := filepath.Join(modPath, fmt.Sprintf("%s@%s", normalizeModName(lib.Name), lib.Version))
+			modDirSuffix := fmt.Sprintf("@%s", lib.Version)
+			if modPath == vendorPath {


I think we can add verndorDirFound bool variable for that.

DmitriyLewen · 2025-04-07T07:13:53Z

pkg/fanal/analyzer/language/golang/mod/mod.go

@@ -165,7 +183,8 @@ func (a *gomodAnalyzer) fillAdditionalData(apps []types.Application) error {
 			}

 			// Collect dependencies of the direct dependency
-			if dep, err := a.collectDeps(modDir, lib.ID); err != nil {
+			gopathModDir := filepath.Join(gopath, "pkg", "mod", fmt.Sprintf("%s@%s", normalizeModName(lib.Name), lib.Version))


We need to add comment why we use another path here.

oneum20 · 2025-04-10T15:21:06Z

Hi @DmitriyLewen!

Thanks for your review!
I've addressed the feedback and updated the code accordingly.
Could you please take another look when you have a moment?

Thanks!

DmitriyLewen

LGTM, left small comments

DmitriyLewen · 2025-04-14T04:54:50Z

pkg/fanal/analyzer/language/golang/mod/mod.go

@@ -111,7 +112,16 @@ func (a *gomodAnalyzer) PostAnalyze(_ context.Context, input analyzer.PostAnalys

 func (a *gomodAnalyzer) Required(filePath string, _ os.FileInfo) bool {
 	fileName := filepath.Base(filePath)
-	return slices.Contains(requiredFiles, fileName)
+
+	if slices.Contains(requiredFiles, fileName) && !xpath.Contains(filePath, "vendor") {


I think we can remove vendor dir check here.
As we told in #8527 (comment) - vendor dir doesn't have go.mod/go.sum files.

But we can add comment about this case with link to your comment,

DmitriyLewen · 2025-04-14T05:51:23Z

pkg/fanal/analyzer/language/golang/mod/mod.go

+
+		// Check if the vendor directory exists
+		_, err := fs.Stat(fsys, vendorDir)
+		vendorDirFound := err == nil


use errors.Is(err, os.ErrNotExist) to check that dir exists

and we need to check that this is dir (not file)

DmitriyLewen · 2025-04-14T07:30:17Z

pkg/fanal/analyzer/language/golang/mod/mod.go

+			// Collect dependencies of the direct dependency from $GOPATH/pkg/mod because the vendor directory doesn't have go.mod files.
+			gopathModDir := filepath.Join(gopath, "pkg", "mod", fmt.Sprintf("%s@%s", normalizeModName(lib.Name), lib.Version))


We can add check here or in collectDeps func

Suggested change

// Collect dependencies of the direct dependency from $GOPATH/pkg/mod because the vendor directory doesn't have go.mod files.

gopathModDir := filepath.Join(gopath, "pkg", "mod", fmt.Sprintf("%s@%s", normalizeModName(lib.Name), lib.Version))

if !gopathModDirFound {

continue

}

// Collect dependencies of the direct dependency from $GOPATH/pkg/mod because the vendor directory doesn't have go.mod files.

gopathModDir := filepath.Join(gopath, "pkg", "mod", fmt.Sprintf("%s@%s", normalizeModName(lib.Name), lib.Version))

Thank you for the review. :)
I've addressed the other points and looked into this suggestion.

It seems the check is already implemented here:

trivy/pkg/fanal/analyzer/language/golang/mod/mod.go

Lines 188 to 198 in b7cbbdc

func (a *gomodAnalyzer) collectDeps(modDir, pkgID string) (types.Dependency, error) {

// e.g. $GOPATH/pkg/mod/github.com/aquasecurity/go-dep-parser@v0.0.0-20220406074731-71021a481237/go.mod

modPath := filepath.Join(modDir, "go.mod")

f, err := os.Open(modPath)

if errors.Is(err, fs.ErrNotExist) {

a.logger.Debug("Unable to identify dependencies as it doesn't support Go modules",

log.String("module", pkgID))

return types.Dependency{}, nil

} else if err != nil {

return types.Dependency{}, xerrors.Errorf("file open error: %w", err)

}

Was there perhaps a different intention I might have missed?

there are 2 point:

We try to use "early return" logic.

We will check go.mod file for each dependency (but you know that GOPATH dir doesn't exist), so this is extra resources.

DmitriyLewen · 2025-04-16T04:46:50Z

@oneum20 I refactored a bit, can you take a look and confirm that i didn't break your logic? 😄

oneum20 · 2025-04-16T10:00:56Z

@DmitriyLewen
Thanks for the refactor!
Everything looks fine on my end. 😃

DmitriyLewen

@knqyf263 can you also take a look, please?

feat(license): scan vendor directory for license for go.mod files

118cd99

oneum20 requested review from knqyf263 and DmitriyLewen as code owners April 5, 2025 04:12

DmitriyLewen reviewed Apr 7, 2025

View reviewed changes

oneum20 added 4 commits April 8, 2025 21:09

fix(license) scan vendor directory for license for go.mod files

1f12f2b

docs(license): scan vendor directory for license for go.mod files

5c1655c

Update golang license scanning docs & Required func logic for vendor dir

f9540bc

update Required & findLicense logic

e14669c

oneum20 added 2 commits April 12, 2025 09:57

refactor: simplify findLicense and add comment Required function

e7c8c3f

refactor: rename variables and update comments

467e9ed

oneum20 force-pushed the FEAT-8527-scan-vendor-license branch from 07e4bfe to 467e9ed Compare April 12, 2025 01:35

DmitriyLewen reviewed Apr 14, 2025

View reviewed changes

oneum20 and others added 2 commits April 15, 2025 20:43

fix: address review feedback

7138cc2

refactor

6bde7cd

DmitriyLewen approved these changes Apr 16, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(license): scan vendor directory for license for go.mod files #8689

feat(license): scan vendor directory for license for go.mod files #8689

oneum20 commented Apr 5, 2025

DmitriyLewen left a comment •

edited

Loading

DmitriyLewen Apr 7, 2025

DmitriyLewen Apr 7, 2025

DmitriyLewen Apr 7, 2025

DmitriyLewen Apr 7, 2025

DmitriyLewen Apr 7, 2025

oneum20 commented Apr 10, 2025

DmitriyLewen left a comment

DmitriyLewen Apr 14, 2025

DmitriyLewen Apr 14, 2025

DmitriyLewen Apr 14, 2025

DmitriyLewen Apr 14, 2025 •

edited

Loading

oneum20 Apr 15, 2025

DmitriyLewen Apr 16, 2025

DmitriyLewen commented Apr 16, 2025

oneum20 commented Apr 16, 2025

DmitriyLewen left a comment

	if !fsutils.DirExists(modPath) {
	a.logger.Debug("GOPATH not found. Need 'go mod download' to fill licenses and dependency relationships",
	log.String("GOPATH", modPath))
	return nil
	}

-			modDirSuffix := fmt.Sprintf("@%s", lib.Version)
-			if modPath == vendorPath {
-				modDirSuffix = ""
-			}
-			modDir := filepath.Join(modPath, fmt.Sprintf("%s%s", normalizeModName(lib.Name), modDirSuffix))
+			// Package dir from `vendor` dir doesn't have version suffix.
+			modDirName := normalizeModName(lib.Name)
+			if modPath != vendorPath {
+				// Add version suffix for packages from $$GOPATH
+				// e.g. $GOPATH/pkg/mod/github.com/aquasecurity/go-dep-parser@v1.0.0
+				modDirName = fmt.Sprintf("%s@%s", modDirName, lib.Version)
+			}
+			modDir := filepath.Join(modPath, modDirName)

		// Collect dependencies of the direct dependency from $GOPATH/pkg/mod because the vendor directory doesn't have go.mod files.
		gopathModDir := filepath.Join(gopath, "pkg", "mod", fmt.Sprintf("%s@%s", normalizeModName(lib.Name), lib.Version))

	func (a *gomodAnalyzer) collectDeps(modDir, pkgID string) (types.Dependency, error) {
	// e.g. $GOPATH/pkg/mod/github.com/aquasecurity/go-dep-parser@v0.0.0-20220406074731-71021a481237/go.mod
	modPath := filepath.Join(modDir, "go.mod")
	f, err := os.Open(modPath)
	if errors.Is(err, fs.ErrNotExist) {
	a.logger.Debug("Unable to identify dependencies as it doesn't support Go modules",
	log.String("module", pkgID))
	return types.Dependency{}, nil
	} else if err != nil {
	return types.Dependency{}, xerrors.Errorf("file open error: %w", err)
	}

feat(license): scan vendor directory for license for go.mod files #8689

Are you sure you want to change the base?

feat(license): scan vendor directory for license for go.mod files #8689

Conversation

oneum20 commented Apr 5, 2025

Description

Related issues

Checklist

DmitriyLewen left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oneum20 commented Apr 10, 2025

DmitriyLewen left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DmitriyLewen Apr 14, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DmitriyLewen commented Apr 16, 2025

oneum20 commented Apr 16, 2025

DmitriyLewen left a comment

Choose a reason for hiding this comment

DmitriyLewen left a comment •

edited

Loading

DmitriyLewen Apr 14, 2025 •

edited

Loading