Research alternatives to `go mod graph` for Go provider

[Strum355]

What happened?

There is a difference in the output of go mod graph introduced somewhere between versions 1.20.4 and 1.24.2 of Go, which causes the tests to fail due to a difference in final SBOM generated. We should investigate alternatives that are more stable to go mod graph. Further reading: CycloneDX/cyclonedx-gomod#64

Please provide runtime information.

go version go1.20.4 linux/amd64 and go version go1.24.2 linux/amd64 (supplied via Nix) on main branch of exhort-javascript-api

Relevant log output

$ go version && go mod graph | grep go@
go version go1.24.2 linux/amd64
golang.org/x/example go@1.18
$ go version && go mod graph | grep go@
go version go1.20.4 linux/amd64
<blank>

How can this issue be reproduced?

No response

[ruromero]

AFAIK it only affects the inclusion or not of the go standard library, right? If so, as a workaround we can just ignore it or add it.

[Strum355]

AFAIK it only affects the inclusion or not of the go standard library, right? If so, as a workaround we can just ignore it or add it.

I shouldve included more comprehensive output. It appears to be a bit more than that, in the first failed test you can see here the output is missing github.com/magiconair/properties too

npx mocha --grep 'testing the go' output

  testing the golang-go-modules data provider
    ✔ verify isSupported returns true for go.mod
    ✔ verify isSupported returns false for some_other.file
    1) verify go.mod sbom provided for stack analysis with scenario light no ignore
    2) verify go.mod sbom provided for component analysis with scenario light no ignore
    3) verify go.mod sbom provided for stack analysis with scenario no ignore
    4) verify go.mod sbom provided for component analysis with scenario no ignore
    5) verify go.mod sbom provided for stack analysis with scenario with ignore
    6) verify go.mod sbom provided for component analysis with scenario with ignore
    7) verify go.mod sbom provided for stack analysis with scenario test ignore
    8) verify go.mod sbom provided for component analysis with scenario test ignore
    9) verify go.mod sbom provided for stack analysis with scenario with all ignore
    10) verify go.mod sbom provided for component analysis with scenario with all ignore
    11) verify go.mod sbom provided for stack analysis with scenario mvs versions


  2 passing (448ms)
  11 failing

  1) testing the golang-go-modules data provider
       verify go.mod sbom provided for stack analysis with scenario light no ignore:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual

                   "type": "library",
                   "bom-ref": "pkg:golang/github.com/spf13/cobra@v0.0.5"
               },
               {
      -            "name": "go",
      -            "version": "1.18",
      -            "purl": "pkg:golang/go@1.18",
      -            "type": "library",
      -            "bom-ref": "pkg:golang/go@1.18"
      -        },
      -        {
                   "group": "golang.org/x",
                   "name": "tools",
                   "version": "v0.0.0-20210112183307-1e6ecd4bf1b0",
                   "purl": "pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0",
--
                   "type": "library",
                   "bom-ref": "pkg:golang/github.com/hashicorp/hcl@v1.0.0"
               },
               {
      -          
      +            "group": "github.com/magiconair",
      +            "name": "properties",
      +            "version": "v1.8.0",
      +            "purl": "pkg:golang/github.com/magiconair/properties@v1.8.0",
      +            "type"
      
      [mocha] output truncated to 8192 characters, see "maxDiffSize" reporter-option

      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:39:92)
      at process.processImmediate (node:internal/timers:491:21)

  2) testing the golang-go-modules data provider
       verify go.mod sbom provided for component analysis with scenario light no ignore:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual

                   "type": "library",
                   "bom-ref": "pkg:golang/github.com/spf13/cobra@v0.0.5"
               },
               {
      -            "name": "go",
      -            "version": "1.18",
      -            "purl": "pkg:golang/go@1.18",
      -            "type": "library",
      -            "bom-ref": "pkg:golang/go@1.18"
      -        },
      -        {
                   "group": "golang.org/x",
                   "name": "tools",
                   "version": "v0.0.0-20210112183307-1e6ecd4bf1b0",
                   "purl": "pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0",
--
               {
                   "ref": "pkg:golang/golang.org/x/example@v0.0.0",
                   "dependsOn": [
                       "pkg:golang/github.com/spf13/cobra@v0.0.5",
      -                "pkg:golang/go@1.18",
                       "pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0",
                       "pkg:golang/gopkg.in/yaml.v3@v3.0.1"
                   ]
               },
--
                   "ref": "pkg:golang/github.com/spf13/cobra@v0.0.5",
                   "dependsOn": []
               },
               {
      -            "ref": "pkg:golang/go@1.18",
      -            "dependsOn": []
      -        },
      -        {
                   "ref": "pkg:golang/golang.org/x/tools@v0.0.0-20210112183307-1e6ecd4bf1b0",
                   "dependsOn": []
               },
               {
      
      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:52:98)
      at process.processImmediate (node:internal/timers:491:21)

  3) testing the golang-go-modules data provider
       verify go.mod sbom provided for stack analysis with scenario no ignore:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual


      [mocha] output truncated to 8192 characters, see "maxDiffSize" reporter-option

      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:39:92)
      at process.processImmediate (node:internal/timers:491:21)

  4) testing the golang-go-modules data provider
       verify go.mod sbom provided for component analysis with scenario no ignore:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual


      [mocha] output truncated to 8192 characters, see "maxDiffSize" reporter-option

      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:52:98)
      at process.processImmediate (node:internal/timers:491:21)

  5) testing the golang-go-modules data provider
       verify go.mod sbom provided for stack analysis with scenario with ignore:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual

                   "type": "library",
                   "bom-ref": "pkg:golang/github.com/spf13/pflag@v1.0.5"
               },
               {
      -            "name": "go",
      -            "version": "1.19",
      -            "purl": "pkg:golang/go@1.19",
      -            "type": "library",
      -            "bom-ref": "pkg:golang/go@1.19"
      -        },
      -        {
                   "group": "golang.org/x",
                   "name": "net",
                   "version": "v0.10.0",
                   "purl": "pkg:golang/golang.org/x/net@v0.10.0",
--
               },
               {
                   "group": "golang.org/x",
                   "name": "oauth2",
      -            "version": 
      +            "version": "v0.0.0-20220223155221-ee480838109b",
      +            "purl": "pkg:golang/golang.org/x/oauth2@v0.0.0-20220223155221-ee480838109b",
      +            "type": "library",
      +            "bom-ref": "pkg:golang/go
      
      [mocha] output truncated to 8192 characters, see "maxDiffSize" reporter-option

      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:39:92)
      at process.processImmediate (node:internal/timers:491:21)

  6) testing the golang-go-modules data provider
       verify go.mod sbom provided for component analysis with scenario with ignore:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual

                   "type": "library",
                   "bom-ref": "pkg:golang/github.com/spf13/pflag@v1.0.5"
               },
               {
      -            "name": "go",
      -            "version": "1.19",
      -            "purl": "pkg:golang/go@1.19",
      -            "type": "library",
      -            "bom-ref": "pkg:golang/go@1.19"
      -        },
      -        {
                   "group": "golang.org/x",
                   "name": "net",
                   "version": "v0.10.0",
                   "purl": "pkg:golang/golang.org/x/net@v0.10.0",
--
               },
               {
                   "group": "golang.org/x",
                   "name": "oauth2",
      -            "version": 
      +            "version": "v0.0.0-20220223155221-ee480838109b",
      +            "purl": "pkg:golang/golang.org/x/oauth2@v0.0.0-20220223155221-ee480838109b",
      +            "type": "library",
      +            "bom-ref": "pkg:golang/go
      
      [mocha] output truncated to 8192 characters, see "maxDiffSize" reporter-option

      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:52:98)
      at process.processImmediate (node:internal/timers:491:21)

  7) testing the golang-go-modules data provider
       verify go.mod sbom provided for stack analysis with scenario test ignore:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual


      [mocha] output truncated to 8192 characters, see "maxDiffSize" reporter-option

      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:39:92)
      at process.processImmediate (node:internal/timers:491:21)

  8) testing the golang-go-modules data provider
       verify go.mod sbom provided for component analysis with scenario test ignore:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual


      [mocha] output truncated to 8192 characters, see "maxDiffSize" reporter-option

      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:52:98)
      at process.processImmediate (node:internal/timers:491:21)

  9) testing the golang-go-modules data provider
       verify go.mod sbom provided for stack analysis with scenario with all ignore:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual

                   "type": "application",
                   "bom-ref": "pkg:golang/github.com/devfile-samples/devfile-sample-go-basic@v0.0.0"
               },
               {
      -            "name": "go",
      -            "version": "1.19",
      -            "purl": "pkg:golang/go@1.19",
      -            "type": "library",
      -            "bom-ref": "pkg:golang/go@1.19"
      -        },
      -        {
                   "group": "github.com/gin-contrib",
                   "name": "sse",
                   "version": "v0.1.0",
                   "purl": "pkg:golang/github.com/gin-contrib/sse@v0.1.0",
--
                   "name": "net",
                   "version": "v0.0.0-20200822124328-c89045814202",
                   "purl": "pkg:golang/golang.org/x/net@v0.0.0-20200822124328-c89045814202",
                   "type": "library",
      -            "bom-ref": "pkg:golang/golang.org/x/
      +            "bom-ref": "pkg:golang/golang.org/x/net@v0.0.0-20200822124328-c89045814202"
      +        },
      +        {
      +            "group": "golang.org/x",
      +            "name": "sys",
      +            "version": "v0.0.0-20200826173525-f9321e4c35a6",
      +         
      
      [mocha] output truncated to 8192 characters, see "maxDiffSize" reporter-option

      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:39:92)
      at process.processImmediate (node:internal/timers:491:21)

  10) testing the golang-go-modules data provider
       verify go.mod sbom provided for component analysis with scenario with all ignore:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual

                   "version": "v0.0.0",
                   "purl": "pkg:golang/github.com/devfile-samples/devfile-sample-go-basic@v0.0.0",
                   "type": "application",
                   "bom-ref": "pkg:golang/github.com/devfile-samples/devfile-sample-go-basic@v0.0.0"
      -        },
      -        {
      -            "name": "go",
      -            "version": "1.19",
      -            "purl": "pkg:golang/go@1.19",
      -            "type": "library",
      -            "bom-ref": "pkg:golang/go@1.19"
               }
           ],
      -    "dependencies": [
      -        {
      -            "ref": "pkg:golang/github.com/devfile-samples/devfile-sample-go-basic@v0.0.0",
      -            "dependsOn": [
      -                "pkg:golang/go@1.19"
      -            ]
      -        },
      -        {
      -            "ref": "pkg:golang/go@1.19",
      -            "dependsOn": []
      -        }
      -    ]
      +    "dependencies": []
       }
      
      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:52:98)
      at process.processImmediate (node:internal/timers:491:21)

  11) testing the golang-go-modules data provider
       verify go.mod sbom provided for stack analysis with scenario mvs versions:

      AssertionError: expected '{\n    "bomFormat": "CycloneDX",\n   …' to deeply equal '{\n    "bomFormat": "CycloneDX",\n   …'
      + expected - actual


      [mocha] output truncated to 8192 characters, see "maxDiffSize" reporter-option

      at Context.<anonymous> (file:///home/nsantsch/RedHat/exhort-javascript-api/test/providers/golang_gomodules.test.js:75:92)
      at process.processImmediate (node:internal/timers:491:21)