Go Application Analysis
Evaluation: Source code and manifest analysis
The Go coordinate-based matching feature provides the ability to scan and evaluate Go module dependencies referenced in projects that use dep or go mod. Support includes Security, License, Identity data for Go modules found on golang.org public repository.
Go modules is the dependency management added to Go using go.mod file for managing modules in the project. The go.sum file generated and updated automatically can be used for analysis by Lifecycle scanners however, this is not recommended as it may include module versions not currently used or included in the application. If the go.sum file is to be used, we recommend running the go mod tidy command to remove unused dependencies before the analysis.
The more preferred option is to generate a go.list file using the go list command from the project. This file should be the target for the Lifecycle scan.
go list -m all > go.list
The output of the command will result in the first two segments corresponding to the name and version of the dependency being evaluated.
The dep dependency manager generates the Gopkg.lock file. See the documentation for details.
Only [[project]] stanzas containing both name and version fields will be evaluated.
Steps to analyze using the Sonatype Lifecycle CLI
Run a scan
Invoke a CLI scan of a directory or subdirectories containing go.sum or go.list files. Instructions on how to do this can be found here: Sonatype IQ CLI.
Example go.sum File
Steps to analyze using the Jenkins plugin
By default, the Jenkins plugin will not evaluate the Gopkg.lock, go.sum, and go.list files. A custom Scan Target is needed.
nexusPolicyEvaluation iqApplication: 'SampApp', iqScanPatterns: [[scanPattern: '**/Gopkg.lock'], [scanPattern: '**/go.sum'], [scanPattern: '**/go.list']], iqStage: 'build'
To find more information on configuring Jenkins, please go to the Sonatype Platform Plugin for Jenkins.
Steps to analyze using the Bamboo plugin
Bamboo Scan Targets control what files are examined. To evaluate Go, add Gopkg.lock, go.sum, and go.list to the scan targets via a comma-separated list e.g.
To find more information on configuring Bamboo, please go to the Lifecycle for Bamboo.