Google Git
Sign in
go / vuln / 0e22668d81b9fedfe116b091effceb14ef264319
commit0e22668d81b9fedfe116b091effceb14ef264319[log] [tgz]
authorJonathan Amsterdam <jba@google.com>Fri Apr 08 16:26:32 2022 -0400
committerJonathan Amsterdam <jba@google.com>Tue Apr 12 18:02:14 2022 +0000
tree0863aac0579c3e988a5a92872f022b3335bff43d
parent64c5db5fe4e52edda642d5e5ce4184de35bd1b9a [diff]
cmd/govulncheck: add hermetic tests for default mode

Add a test that runs the govulncheck binary on a module and vuln DB
that are completely controlled by this module.

- Create a tiny local vuln DB with a couple of vulns.

- In our tests, run govulncheck with the GOVULNDB env var set to
  that DB.

- Define two trivial modules that differ only in the version of
  a dependent module: one version matches a vulnerability in our DB,
  and one does not.

- Create a test that runs govulncheck on each module, and verify
  that the vulnerability is found and the output is what we expect.

Change-Id: Idc053ab3a451375f7a211b4bb24d0ec282d2aaa0
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/399234
Run-TryBot: Jonathan Amsterdam <jba@google.com>
Reviewed-by: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
10 files changed
tree: 0863aac0579c3e988a5a92872f022b3335bff43d
  1. client/
  2. cmd/
  3. devtools/
  4. doc/
  5. internal/
  6. osv/
  7. vulncheck/
  8. .gitignore
  9. all_test.go
  10. AUTHORS
  11. checks.bash
  12. CONTRIBUTING.md
  13. CONTRIBUTORS
  14. go.mod
  15. go.sum
  16. LICENSE
  17. PATENTS
  18. README.md
  19. tools_test.go
README.md

Go Vulnerability Management

Go Reference

This repository contains the following:

  • Package client: a client for interacting with the Go vulnerability database
  • Package vulncheck: an API for detecting vulnerabilities in Go packages
  • Command govulncheck: a CLI for detecting vulnerabilities in Go packages

The code in this repository is under active development and not to be considered stable.

License

Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.

Database entries available at https://vuln.go.dev are distributed under the terms of the CC-BY 4.0 license.