Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using the gh-gomod-generate-sbom action, fails when execution the "Cheap trick" gocmd.ModWhy call #230

Open
jeroendee opened this issue Dec 19, 2022 · 8 comments
Labels
bug Something isn't working triage:needs-reproducer

Comments

@jeroendee
Copy link

jeroendee commented Dec 19, 2022

Problem

Currently I'm trying to integratie the generation of a SBOM for one of our Go repos. The gh-gomod-generate-sbom action is used. This actually fails with the error:

{"level":"error","error":"failed to download modules: command `/usr/bin/go mod why -m -vendor github.com/CycloneDX/cyclonedx-go` failed: exit status 1","time":"2022-12-16T16:28:08Z"}

Looking at this line and the subsequent call to gocmd.ModWhy the error "failed to download modules: ..." doesn't actually indicate a failure of downloading modules, but more generally a failure when running the command (in this case `go mod why -m -vendor github.com/CycloneDX/cyclonedx-go).

This will call private repo's. So in that sense, it looks like this issue #206. But that one was closed without giving a hint what goes wrong.

On a local dev machine it works.

Question

Can somebody explain the above error when running cyclonedx-gomod through a GitHub Action?

Below the contents of the action:

jobs:
  generate-sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
       
      - name: Install cyclonedx-gomod
        uses: CycloneDX/gh-gomod-generate-sbom@v1
        with:
          version: v1
      - name: Generate SBOM
        run: cyclonedx-gomod mod -verbose -json -output sbom.json ${{ github.workspace }}
@jeroendee
Copy link
Author

Prob. related with not being able to download the private repo... or something related.

@bcordobaq
Copy link

Hello team, any updates about this issue? I tried using the docker image, tag v1.4 and I have the same error as @jeroendee reported. If I use the client locally in the laptop works well...

@nscuro
Copy link
Member

nscuro commented Aug 3, 2023

Is it possible to provide some kind of minimal reproducer for this? I have not been able to replicate this so far.

Generally, if a project depends on private modules, then the usual setup of GOPRIVATE etc. required for private modules is necessary to generate an SBOM for the project. If it works on your local machine, but doesn't in CI, then there's some sort of setup, config, or environment variable missing in CI, that exists on your local machine.

@nscuro nscuro added the bug Something isn't working label Aug 3, 2023
@nscuro nscuro changed the title Question: using the gh-gomod-generate-sbom action, fails when execution the "Cheap trick" gocmd.ModWhy call Using the gh-gomod-generate-sbom action, fails when execution the "Cheap trick" gocmd.ModWhy call Aug 3, 2023
@bcordobaq
Copy link

bcordobaq commented Aug 3, 2023

From my side, I couldn't try it with Github actions, but I did it using docker.
If I execute the client app locally:

go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest

# in the dir of my project:
cyclonedx-gomod mod -json -output bom.json .

The BOM file is generated correctly.


But then, running the docker container, using as volume the root of my project:

docker run -it \
    -v "$(pwd):/usr/src/test" \
    -v "$(pwd)/reports:/out" \
    cyclonedx/cyclonedx-gomod:v1.4 mod -json -output bom.json  /usr/src/test

I have this output:

{"level":"error","error":"failed to download modules: command `/usr/local/go/bin/go mod why -m -vendor github.com/CycloneDX/cyclonedx-go` failed: exit status 1","time":"2023-08-03T11:38:44Z"}

I don't know the root cause, but with this, I'm not sure that's related to private repos, it seems an error executing the go mod why command.

@nscuro
Copy link
Member

nscuro commented Aug 3, 2023

Thanks for the input @bcordobaq. I ran the go mod why command from within the container, and I got this error:

failed to initialize build cache at /.cache/go-build: mkdir /.cache: permission denied

Which lead me to this issue: golang/go#26280 (comment)

We use a non-root user in our Dockerfile:

FROM golang:1.20.4-alpine3.16@sha256:6469405d7297f82d56195c90a3270b0806ef4bd897aa0628477d9959ab97a577
COPY cyclonedx-gomod /usr/local/bin/
USER 1000
ENTRYPOINT ["cyclonedx-gomod"]
CMD ["-h"]

Adding this to the docker command works for me:

-e "GOCACHE=/tmp/gocache"

Can you verify that this resolves the issue? If so, I'll get this added to our Dockerfile and push a bugfix release out later today.

@nscuro
Copy link
Member

nscuro commented Aug 3, 2023

I'll also see if I can improve the logging. Seems like currently we're swallowing the actual error message, which is not helpful.

@nscuro
Copy link
Member

nscuro commented Aug 3, 2023

Actually it is logged in debug mode (with -verbose flag):

$ docker run -it --rm -v "$(pwd):/work" cyclonedx/cyclonedx-gomod:v1.4.0 mod -verbose /work
4:00PM DBG executing command cmd="/usr/local/go/bin/go mod why -m -vendor github.com/CycloneDX/cyclonedx-go" dir=/work
4:00PM DBG failed to initialize build cache at /.cache/go-build: mkdir /.cache: permission denied
{"level":"error","error":"failed to download modules: command `/usr/local/go/bin/go mod why -m -vendor github.com/CycloneDX/cyclonedx-go` failed: exit status 1","time":"2023-08-03T16:00:03Z"}

@bcordobaq
Copy link

Hi @nscuro , first, thank you for your quick response! Effectively, I added the env variable in the docker command, and it works well 🎉 , this was my probe:

docker run -it \
    -v "$(pwd):/usr/src/test" \    
    -v "$(pwd)/reports:/out" \
    -e "GOCACHE=/tmp/gocache" \
   cyclonedx/cyclonedx-gomod:v1.4 mod -json -output bom.json  /usr/src/test

Thank you!!! Anyways, I saw your MR, which is merged, and I've tried also the docker latest image, works well 😄

docker run -it \
    -v "$(pwd):/usr/src/test" \
    -v "$(pwd)/reports:/out" \
    cyclonedx/cyclonedx-gomod mod -json -output /out/bom.json  /usr/src/test

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working triage:needs-reproducer
Projects
None yet
Development

No branches or pull requests

3 participants