gosec

README

gosec

This component implements a scanner that parses sarif reports output by gosec into ocsf format.

Environment variables

The component uses environment variables for configuration.

It requires the component environment variables defined here as well as the following:

Environment Variable	Type	Required	Default	Description
GOSEC_RAW_OUT_FILE_PATH	string	yes	-	The path where to find the gosec report
GOSEC_TARGET_TYPE	string	false	repository	The type of target that was used to generate the report

How to run

Execute:

docker-compose up --build --force-recreate --remove-orphans

Then shutdown with:

docker-compose down --rmi all

Test data

The gosec.sarif file used in tests was generated with the following steps:

• Cloning:

git clone https://github.com/TheHackerDev/damn-vulnerable-golang

• Running gosec

docker run \
  --platform linux/amd64 \
  -v ./damn-vulnerable-golang:/go/damn-vulnerable-golang \
  -it securego/gosec:2.15.0 \
    -fmt=sarif \
    -no-fail \
    -out=./damn-vulnerable-golang/gosec.sarif \
      damn-vulnerable-golang