fix: use main package instead of main file as entrypoint for app comm…

…and (#78) * use main package instead of main file as entrypoint for app command also add more debug logging and improve existing logging messages Signed-off-by: nscuro <[email protected]> * fix examples dockerfile and regenerate example sboms Signed-off-by: nscuro <[email protected]> * update readme Signed-off-by: nscuro <[email protected]> * minor logging adjustments Signed-off-by: nscuro <[email protected]> * update changelog Signed-off-by: nscuro <[email protected]> Closes #75
CycloneDX · Sep 29, 2021 · 307c17d · 307c17d
1 parent a31c1e4
commit 307c17d
Show file tree

Hide file tree

Showing 25 changed files with 246 additions and 138 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -21,6 +21,8 @@
 
 * Fix annotated tags not being recognized as versions ([#56](https://github.com/CycloneDX/cyclonedx-gomod/issues/56) via [#57](https://github.com/CycloneDX/cyclonedx-gomod/pull/57))
 * Fix normalized versions interfering with hash calculation ([#58](https://github.com/CycloneDX/cyclonedx-gomod/issues/58) via [#60](https://github.com/CycloneDX/cyclonedx-gomod/pull/60))
+* Fix `app` command missing dependencies when `main` package is spread across multiple files ([#75](https://github.com/CycloneDX/cyclonedx-gomod/issues/75) via [#78](https://github.com/CycloneDX/cyclonedx-gomod/pull/78))
+  * Also addresses [#76](https://github.com/CycloneDX/cyclonedx-gomod/issues/76) (thanks [TheDiveO](https://github.com/TheDiveO) for reporting!) 
 
 ### Breaking Changes
 

diff --git a/Dockerfile.examples b/Dockerfile.examples
@@ -26,7 +26,7 @@ RUN apt update && \
 
 # Create generation script
 RUN echo "#!/bin/bash\n\n\
-cyclonedx-gomod app -json -output /examples/app_minikube-v1.23.1.bom.json -licenses -main cmd/minikube/main.go /home/cdx/minikube \n\
+cyclonedx-gomod app -json -output /examples/app_minikube-v1.23.1.bom.json -licenses -main cmd/minikube /home/cdx/minikube \n\
 cyclonedx-gomod mod -json -output /examples/mod_minikube-v1.23.1.bom.json -licenses /home/cdx/minikube \n\
 cyclonedx-gomod bin -json -output /examples/bin_minikube-v1.23.1.bom.json -licenses -version v1.23.1 /home/cdx/minikube-linux-amd64 \n\
 cyclonedx validate --input-file /examples/app_minikube-v1.23.1.bom.json --input-format json_v1_3 --fail-on-errors \n\

diff --git a/README.md b/README.md
@@ -99,22 +99,22 @@ Applicable build constraints are included as properties of the main component.
 Because build constraints influence Go's module selection, an SBOM should be generated
 for each target in the build matrix.
 
-The -main flag should be used to specify the path to the application's main file.
-It must point to a go file within MODULE_PATH. The go file must have a "package main" declaration.
+The -main flag should be used to specify the path to the application's main package.
+It must point to a directory within MODULE_PATH. If not set, MODULE_PATH is assumed.
 
 By passing -files, all files that would be included in a binary will be attached
 as subcomponents of their respective module. File versions follow the v0.0.0-SHORTHASH pattern, 
 where SHORTHASH is the first 12 characters of the file's SHA1 hash.
 
 Examples:
   $ GOARCH=arm64 GOOS=linux GOFLAGS="-tags=foo,bar" cyclonedx-gomod app -output linux-arm64.bom.xml
-  $ cyclonedx-gomod app -json -output acme-app.bom.json -files -licenses -main cmd/acme-app/main.go /usr/src/acme-module
+  $ cyclonedx-gomod app -json -output acme-app.bom.json -files -licenses -main cmd/acme-app /usr/src/acme-module
 
 FLAGS
   -files=false     Include files
   -json=false      Output in JSON
   -licenses=false  Perform license detection
-  -main main.go    Path to the application's main file, relative to MODULE_PATH
+  -main ...        Path to the application's main package, relative to MODULE_PATH
   -noserial=false  Omit serial number
   -output -        Output file path (or - for STDOUT)
   -serial ...      Serial number
@@ -255,7 +255,7 @@ $ docker run -it --rm \
 ```
 
 > The image is based on `golang:1.17-alpine`.  
-> Please keep in mind that the Go version may influence module selection.  
+> When using the `app` command, please keep in mind that the Go version may influence module selection.  
 > We generally recommend using a [precompiled binary](https://github.com/CycloneDX/cyclonedx-gomod/releases) instead.
 
 ## Important Notes

diff --git a/e2e/cmd_app_test.go b/e2e/cmd_app_test.go
@@ -34,7 +34,7 @@ func TestAppCmdSimple(t *testing.T) {
 			SerialNumber:    zeroUUID.String(),
 		},
 		ModuleDir: fixturePath,
-		Main:      "main.go",
+		Main:      "",
 	}
 
 	runSnapshotIT(t, &appOptions.OutputOptions, func() error { return appcmd.Exec(appOptions) })
@@ -50,7 +50,7 @@ func TestAppCmdSimpleWithFiles(t *testing.T) {
 			SerialNumber:    zeroUUID.String(),
 		},
 		ModuleDir:    fixturePath,
-		Main:         "main.go",
+		Main:         "",
 		IncludeFiles: true,
 	}
 
@@ -67,7 +67,7 @@ func TestAppCmdSimpleMultiCommandUUID(t *testing.T) {
 			SerialNumber:    zeroUUID.String(),
 		},
 		ModuleDir: fixturePath,
-		Main:      "cmd/uuid/main.go",
+		Main:      "cmd/uuid",
 	}
 
 	runSnapshotIT(t, &appOptions.OutputOptions, func() error { return appcmd.Exec(appOptions) })
@@ -83,7 +83,7 @@ func TestAppCmdSimpleMultiCommandPURL(t *testing.T) {
 			SerialNumber:    zeroUUID.String(),
 		},
 		ModuleDir: fixturePath,
-		Main:      "cmd/purl/main.go",
+		Main:      "cmd/purl",
 	}
 
 	runSnapshotIT(t, &appOptions.OutputOptions, func() error { return appcmd.Exec(appOptions) })
@@ -99,7 +99,7 @@ func TestAppCmdVendored(t *testing.T) {
 			SerialNumber:    zeroUUID.String(),
 		},
 		ModuleDir: fixturePath,
-		Main:      "main.go",
+		Main:      "",
 	}
 
 	runSnapshotIT(t, &appOptions.OutputOptions, func() error { return appcmd.Exec(appOptions) })
@@ -115,7 +115,7 @@ func TestAppCmdVendoredWithFiles(t *testing.T) {
 			SerialNumber:    zeroUUID.String(),
 		},
 		ModuleDir:    fixturePath,
-		Main:         "main.go",
+		Main:         "",
 		IncludeFiles: true,
 	}
 

diff --git a/examples/app_minikube-v1.23.1.bom.json b/examples/app_minikube-v1.23.1.bom.json
@@ -1,35 +1,35 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.3",
-  "serialNumber": "urn:uuid:89b6f930-138f-47a2-bae1-effe046d6545",
+  "serialNumber": "urn:uuid:9a4f199c-bff6-4fa1-a34d-4b7586617568",
   "version": 1,
   "metadata": {
-    "timestamp": "2021-09-27T18:10:47Z",
+    "timestamp": "2021-09-29T18:02:11Z",
     "tools": [
       {
         "vendor": "CycloneDX",
         "name": "cyclonedx-gomod",
-        "version": "v0.0.0-20210927200930-566af677a239",
+        "version": "v0.0.0-20210929195822-2add6b416eb9",
         "hashes": [
           {
             "alg": "MD5",
-            "content": "a769725a7cf4d002c88e0b59a2a3c6a4"
+            "content": "b6ccbe5ff272355fed1803c4c17ff161"
           },
           {
             "alg": "SHA-1",
-            "content": "b49e5f1259ce630e3b7c678de45c600a313973fb"
+            "content": "2232bdbfd4ef618303a59c9d42f81ccfd2fa4e8a"
           },
           {
             "alg": "SHA-256",
-            "content": "c5493aaa2f9f288550f87243cf9953f475e967982d5f004b1ed4836843462f3a"
+            "content": "69f0bce5fd9cdae1e3bd65b6abddd5bc966d4842dd69e33e8433783ee069c23c"
           },
           {
             "alg": "SHA-384",
-            "content": "fee0fd5c99ecd1c6ec8028c8496778ea932f1601605d56601f29bee6c0e1470908bd7f737aaea640c88f06f8abfa00e1"
+            "content": "a310e367777f74d68b822c78f3d6a72aa888daae18d967be614f666a7b5916c9d1c86dbda0adc91f3c92309ddb5489d4"
           },
           {
             "alg": "SHA-512",
-            "content": "52897bbd73eec9ce6a96fafd596a1e43568040d9208553786f0c7d60d5bd82b8d328648b66f9e556ed26f1666eabfef75ea191fab2ebeaa4636d249a73047910"
+            "content": "8924da342ab6da849631f2f5eb875b40eb62c54a6573e37e31e5ed5ac0f1f576d6eb266038695fec6514fe8973cc980ef7d8d7fb1ea5488fe7ec98a6ed848553"
           }
         ]
       }

diff --git a/examples/bin_minikube-v1.23.1.bom.json b/examples/bin_minikube-v1.23.1.bom.json
@@ -1,35 +1,35 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.3",
-  "serialNumber": "urn:uuid:a557bfa0-02dd-450a-b350-23a8639aeff8",
+  "serialNumber": "urn:uuid:2eadc368-815b-420c-8886-f9ad4730fdc7",
   "version": 1,
   "metadata": {
-    "timestamp": "2021-09-27T18:11:30Z",
+    "timestamp": "2021-09-29T18:02:39Z",
     "tools": [
       {
         "vendor": "CycloneDX",
         "name": "cyclonedx-gomod",
-        "version": "v0.0.0-20210927200930-566af677a239",
+        "version": "v0.0.0-20210929195822-2add6b416eb9",
         "hashes": [
           {
             "alg": "MD5",
-            "content": "a769725a7cf4d002c88e0b59a2a3c6a4"
+            "content": "b6ccbe5ff272355fed1803c4c17ff161"
           },
           {
             "alg": "SHA-1",
-            "content": "b49e5f1259ce630e3b7c678de45c600a313973fb"
+            "content": "2232bdbfd4ef618303a59c9d42f81ccfd2fa4e8a"
           },
           {
             "alg": "SHA-256",
-            "content": "c5493aaa2f9f288550f87243cf9953f475e967982d5f004b1ed4836843462f3a"
+            "content": "69f0bce5fd9cdae1e3bd65b6abddd5bc966d4842dd69e33e8433783ee069c23c"
           },
           {
             "alg": "SHA-384",
-            "content": "fee0fd5c99ecd1c6ec8028c8496778ea932f1601605d56601f29bee6c0e1470908bd7f737aaea640c88f06f8abfa00e1"
+            "content": "a310e367777f74d68b822c78f3d6a72aa888daae18d967be614f666a7b5916c9d1c86dbda0adc91f3c92309ddb5489d4"
           },
           {
             "alg": "SHA-512",
-            "content": "52897bbd73eec9ce6a96fafd596a1e43568040d9208553786f0c7d60d5bd82b8d328648b66f9e556ed26f1666eabfef75ea191fab2ebeaa4636d249a73047910"
+            "content": "8924da342ab6da849631f2f5eb875b40eb62c54a6573e37e31e5ed5ac0f1f576d6eb266038695fec6514fe8973cc980ef7d8d7fb1ea5488fe7ec98a6ed848553"
           }
         ]
       }

diff --git a/examples/mod_minikube-v1.23.1.bom.json b/examples/mod_minikube-v1.23.1.bom.json
@@ -1,35 +1,35 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.3",
-  "serialNumber": "urn:uuid:f100c46e-2edb-4177-a4d9-2185af3313d2",
+  "serialNumber": "urn:uuid:984105ea-edc3-439b-bc11-3659aa99950c",
   "version": 1,
   "metadata": {
-    "timestamp": "2021-09-27T18:11:08Z",
+    "timestamp": "2021-09-29T18:02:27Z",
     "tools": [
       {
         "vendor": "CycloneDX",
         "name": "cyclonedx-gomod",
-        "version": "v0.0.0-20210927200930-566af677a239",
+        "version": "v0.0.0-20210929195822-2add6b416eb9",
         "hashes": [
           {
             "alg": "MD5",
-            "content": "a769725a7cf4d002c88e0b59a2a3c6a4"
+            "content": "b6ccbe5ff272355fed1803c4c17ff161"
           },
           {
             "alg": "SHA-1",
-            "content": "b49e5f1259ce630e3b7c678de45c600a313973fb"
+            "content": "2232bdbfd4ef618303a59c9d42f81ccfd2fa4e8a"
           },
           {
             "alg": "SHA-256",
-            "content": "c5493aaa2f9f288550f87243cf9953f475e967982d5f004b1ed4836843462f3a"
+            "content": "69f0bce5fd9cdae1e3bd65b6abddd5bc966d4842dd69e33e8433783ee069c23c"
           },
           {
             "alg": "SHA-384",
-            "content": "fee0fd5c99ecd1c6ec8028c8496778ea932f1601605d56601f29bee6c0e1470908bd7f737aaea640c88f06f8abfa00e1"
+            "content": "a310e367777f74d68b822c78f3d6a72aa888daae18d967be614f666a7b5916c9d1c86dbda0adc91f3c92309ddb5489d4"
           },
           {
             "alg": "SHA-512",
-            "content": "52897bbd73eec9ce6a96fafd596a1e43568040d9208553786f0c7d60d5bd82b8d328648b66f9e556ed26f1666eabfef75ea191fab2ebeaa4636d249a73047910"
+            "content": "8924da342ab6da849631f2f5eb875b40eb62c54a6573e37e31e5ed5ac0f1f576d6eb266038695fec6514fe8973cc980ef7d8d7fb1ea5488fe7ec98a6ed848553"
           }
         ]
       }

diff --git a/internal/cli/cmd/app/app.go b/internal/cli/cmd/app/app.go
@@ -21,6 +21,7 @@ import (
 	"context"
 	"flag"
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
 
@@ -64,16 +65,16 @@ Applicable build constraints are included as properties of the main component.
 Because build constraints influence Go's module selection, an SBOM should be generated
 for each target in the build matrix.
 
-The -main flag should be used to specify the path to the application's main file.
-It must point to a go file within MODULE_PATH. The go file must have a "package main" declaration.
+The -main flag should be used to specify the path to the application's main package.
+It must point to a directory within MODULE_PATH. If not set, MODULE_PATH is assumed.
 
 By passing -files, all files that would be included in a binary will be attached
 as subcomponents of their respective module. File versions follow the v0.0.0-SHORTHASH pattern, 
 where SHORTHASH is the first 12 characters of the file's SHA1 hash.
 
 Examples:
   $ GOARCH=arm64 GOOS=linux GOFLAGS="-tags=foo,bar" cyclonedx-gomod app -output linux-arm64.bom.xml
-  $ cyclonedx-gomod app -json -output acme-app.bom.json -files -licenses -main cmd/acme-app/main.go /usr/src/acme-module`,
+  $ cyclonedx-gomod app -json -output acme-app.bom.json -files -licenses -main cmd/acme-app /usr/src/acme-module`,
 		FlagSet: fs,
 		Exec: func(_ context.Context, args []string) error {
 			if len(args) > 1 {
@@ -98,9 +99,9 @@ func Exec(options Options) error {
 		return err
 	}
 
-	modules, err := gomod.GetModulesFromPackages(options.ModuleDir, options.Main)
+	modules, err := gomod.LoadModulesFromPackages(options.ModuleDir, options.Main)
 	if err != nil {
-		return fmt.Errorf("failed to collect modules: %w", err)
+		return fmt.Errorf("failed to load modules: %w", err)
 	}
 
 	// Dependencies need to be applied prior to determining the main
@@ -253,23 +254,23 @@ func parseTagsFromGoFlags(goflags string) (tags []string) {
 //
 // If the package URL is updated, the BOM reference is as well.
 // All places within the BOM that reference the main component will be updated accordingly.
-func enrichWithApplicationDetails(bom *cdx.BOM, moduleDir, mainFile string) {
-	// Resolve absolute paths to moduleDir and mainFile.
+func enrichWithApplicationDetails(bom *cdx.BOM, moduleDir, mainPkgDir string) {
+	// Resolve absolute paths to moduleDir and mainPkgDir.
 	// Both may contain traversals or similar elements we don't care about.
 	// This procedure is done during options validation already,
 	// which is why we don't check for errors here.
 	moduleDirAbs, _ := filepath.Abs(moduleDir)
-	mainFileAbs, _ := filepath.Abs(filepath.Join(moduleDirAbs, mainFile))
+	mainPkgDirAbs, _ := filepath.Abs(filepath.Join(moduleDirAbs, mainPkgDir))
 
-	// Construct path to mainFile relative to moduleDir
-	mainFileRel := strings.TrimPrefix(mainFileAbs, moduleDirAbs)
-	mainFileRel = strings.TrimPrefix(mainFileRel, "/")
+	// Construct path to mainPkgDir relative to moduleDir
+	mainPkgDirRel := strings.TrimPrefix(mainPkgDirAbs, moduleDirAbs)
+	mainPkgDirRel = strings.TrimPrefix(mainPkgDirRel, string(os.PathSeparator))
 
-	if mainDir, _ := filepath.Split(mainFileRel); mainDir != "" {
-		mainDir = strings.TrimSuffix(mainDir, "/")
+	if mainPkgDirRel != "" {
+		mainPkgDirRel = strings.TrimSuffix(mainPkgDirRel, string(os.PathSeparator))
 
 		oldPURL := bom.Metadata.Component.PackageURL
-		newPURL := oldPURL + "#" + mainDir
+		newPURL := oldPURL + "#" + mainPkgDirRel
 
 		log.Debug().
 			Str("old", oldPURL).