README
¶
govulncheck-apply
govulncheck-apply provides an implementation of https://github.com/golang/go/issues/79896 which runs govulncheck and applies the fixes.
To run it on your repo, run:
go install github.com/netflix-skunkworks/govulncheck-apply/cmd/modfix@latest
modfix
Also included is a program to bump Dockerfile FROM golang:<ver> declarations,
and a simple program to update Go versions in yml files.
go install github.com/netflix-skunkworks/govulncheck-apply/cmd/modfix@latest
go install github.com/netflix-skunkworks/govulncheck-apply/cmd/dockerfilefix@latest
go install github.com/netflix-skunkworks/govulncheck-apply/cmd/ymlfix@latest
modfix > report.md
dockerfilefix
ymlfix -path .tool-versions.goVersion config.yml
All edits to Go files (go.mod, vendor/, go.work, etc) are made with
standard Go tools, like go mod edit, go mod tidy, go work use, and so on.
Features and quirks
There are several interesting cases that this program has to handle. See
./cmd/modfix/testcases
for a listing. You can also "test out" any of those testcases locally by
running:
go run ./internal/cmd/repro --testcase <testcase>
# ex: go run ./internal/cmd/repro --testcase vuln_four
An exhaustive list of scenarios that this program fixes, to highlight that it
has to do quite a bit more than just govulncheck, go fix, go mod tidy:
- When an update bumps a dependency to a version that itself has a (different) vulnerability, iterate.
- When there are multiple modules, visit each and remediate.
- When files or dependencies are built only on some operating systems, scan under each of linux, windows and darwin, because GOOS is a build constraint and a scan only reaches what the files it admits import. An operating system a module does not target is passed over rather than failing it.
- When there are replace statements, bump their versions too.
- When go.work files are present, ignore them and treat go.mod files as if they were externally imported (go.work files can hide security issues, since govulncheck uses the go.work version instead of the actually declared go.mod version that a user importing the module would get).
- When one module requires a lower fix version than a preceding module required,
it's resolvable (using
require, which enforces sets of minimums, instead ofgo get, which could result in asking it to downgrade). - etc.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
dockerfilefix
command
Command dockerfilefix raises the golang image tag in every Dockerfile under the working directory to the go directive of the module that Dockerfile builds.
|
Command dockerfilefix raises the golang image tag in every Dockerfile under the working directory to the go directive of the module that Dockerfile builds. |
|
modfix
command
Command modfix runs govulncheck over the modules under the working directory and applies the fixes it reports.
|
Command modfix runs govulncheck over the modules under the working directory and applies the fixes it reports. |
|
ymlfix
command
Command ymlfix raises a version recorded in a YAML file to the one a repository of Go modules now needs.
|
Command ymlfix raises a version recorded in a YAML file to the one a repository of Go modules now needs. |
|
Package internal holds the testcases/*.txtar scenarios and the code that reads them, shared by the test harness and the repro command.
|
Package internal holds the testcases/*.txtar scenarios and the code that reads them, shared by the test harness and the repro command. |
|
cmd/repro
command
Command repro sets up one of modfix's testcases/*.txtar scenarios in a temp directory so you can run the commands against it by hand, outside the test harness.
|
Command repro sets up one of modfix's testcases/*.txtar scenarios in a temp directory so you can run the commands against it by hand, outside the test harness. |
|
gomod
Package gomod finds the Go modules in a repository and reads their go.mod files.
|
Package gomod finds the Go modules in a repository and reads their go.mod files. |
Click to show internal directories.
Click to hide internal directories.