cmd/govulncheck/integration: make expectation check more robust

When checking test expectations (packages of called vulnerabilities), we
would use equality. Given that a requirement of integration checking is
to query the Go vulnerability database, the expectations need to change
from time to time. With the new support for UNREVIEWED, this is
happening more and more.

To address this, the CL here checks that the expected packages are a
subset of what is detected with govulncheck. This will make the test
more robust. The list of expected packages is anyhow long, so the
coverage is good and we are still testing against the same live db.

Change-Id: I49f73dc2094686253ae222bbe92144f87b2637a5
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/593155
Reviewed-by: Maceo Thompson <maceothompson@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

cmd/govulncheck/integration/internal/integration/test.go

diff --git a/cmd/govulncheck/integration/internal/integration/test.go b/cmd/govulncheck/integration/internal/integration/test.go
index f061cf5..685754a 100644
--- a/cmd/govulncheck/integration/internal/integration/test.go
+++ b/cmd/govulncheck/integration/internal/integration/test.go
@@ -7,19 +7,17 @@
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
 	"os"
-	"strings"
 
-	"github.com/google/go-cmp/cmp"
 	"golang.org/x/vuln/internal/govulncheck"
 )
 
-// CompareNonStdVulns compares vulnerable packages in out and want.
-// For out, it only considers vulnerabilities outside of the standard
-// library. Assumes the same for want.
-func CompareNonStdVulns(out string, want map[string]bool) error {
+// CompareVulns checks if packages of called vulnerable symbols
+// out are a superset of want.
+func CompareVulns(out string, want map[string]bool) error {
 	outJson, err := os.ReadFile(out)
 	if err != nil {
 		return fmt.Errorf("failed to read: %v", out)
@@ -40,18 +38,16 @@
 			}
 			// collect only called non-std packages
 			pkgPath := msg.Finding.Trace[0].Package
-			if !isStd(pkgPath) {
-				calledVulnPkgs[pkgPath] = true
-			}
+			calledVulnPkgs[pkgPath] = true
 		}
 	}
-	if diff := cmp.Diff(want, calledVulnPkgs); diff != "" {
-		return fmt.Errorf("reachable vulnerable packages mismatch (-want, +got):\n%s", diff)
-	}
-	return nil
-}
 
-// isStd returns true iff pkg is a standard library package.
-func isStd(pkg string) bool {
-	return !strings.Contains(pkg, ".")
+	for pkg := range want {
+		if _, ok := calledVulnPkgs[pkg]; !ok {
+			e := fmt.Errorf("vulnerable symbols of expected package %s not detected", pkg)
+			err = errors.Join(err, e)
+		}
+
+	}
+	return err
 }

cmd/govulncheck/integration/k8s/k8s.go

diff --git a/cmd/govulncheck/integration/k8s/k8s.go b/cmd/govulncheck/integration/k8s/k8s.go
index 7b2207e..f4cd3be 100644
--- a/cmd/govulncheck/integration/k8s/k8s.go
+++ b/cmd/govulncheck/integration/k8s/k8s.go
@@ -48,7 +48,7 @@
 		"golang.org/x/text/encoding/unicode":                          true,
 		"google.golang.org/grpc":                                      true,
 	}
-	if err := integration.CompareNonStdVulns(out, want); err != nil {
+	if err := integration.CompareVulns(out, want); err != nil {
 		log.Fatal(err)
 	}
 }

cmd/govulncheck/integration/stackrox-scanner/scanner.go

diff --git a/cmd/govulncheck/integration/stackrox-scanner/scanner.go b/cmd/govulncheck/integration/stackrox-scanner/scanner.go
index ff2079d..a42dacc 100644
--- a/cmd/govulncheck/integration/stackrox-scanner/scanner.go
+++ b/cmd/govulncheck/integration/stackrox-scanner/scanner.go
@@ -36,7 +36,7 @@
 		"google.golang.org/grpc/internal/transport":             true,
 	}
 
-	if err := integration.CompareNonStdVulns(out, want); err != nil {
+	if err := integration.CompareVulns(out, want); err != nil {
 		log.Fatal(err)
 	}
 }