Golang: Search remote licenses not working in a CI pipeline when scanning Docker image

[Joerki]

What happened:
In our CI pipeline we run syft to scan a Docker image. No Go environment is present. search-remote-licenses (in env or .syft.yaml) is configured as "true".

But Syft does not write license information into Syft-JSON file.

It is working on my local machine where I have a Go installation.

It looks that search remote licenses function has a path dependency that it should not have when working in an environment without Go.

What you expected to happen:
If search-remote-licenses is set by config file or environment file it should work always if set.

Steps to reproduce the issue:
On a machine with Go installation ($HOME/go exists):

(base) joerg@delly:~/project$ cat ~/.syft.yaml 

quiet: false

check-for-app-update: false

parallelism: 3

# scope: "all-layers"

default-catalogers: [ "go-module-file-cataloger", "go-module-binary-cataloger"]

format:
  json:
    pretty: true

golang:
  search-local-mod-cache-licenses: false
  search-remote-licenses: true

Invocation:
syft scan mongo:5.0.26-focal -o syft-json=/home/joerg/projects/mongo_inspect/mongo-syft-single.json -vv

Result 1:

Go Licenses are present in Syft-JSON

$HOME/go renamed to $HOME/go_
Same invocation.

Result 2:

Go licenses are not present in Syft-JSON

Anything else we need to know?:
N/A

Environment:

• Output of syft version:
  Application: syft
  Version: 1.2.0
  BuildDate: 2024-04-12T18:31:58Z
  GitCommit: dde5d34
  GitDescription: v1.2.0
  Platform: linux/amd64
  GoVersion: go1.21.9
  Compiler: gc

• OS (e.g: cat /etc/os-release or similar):
  uname -a
  Linux delly 6.1.0-18-amd64 Add package definition(s) & Catalog #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 GNU/Linux

(Native Linux, no WSL)

[kzantow]

Hi @Joerki -- I'm a bit confused what the problem is. I see search-remote-licenses is set to false, which is the default and I don't see this being set by an environment variable, so it's expected to be false. The default local-mod-cache-dir is based on your home directory, which is also expected. Could you elaborate on your configuration and the problem a bit to help me understand?

[Joerki]

Hi @kzantow ,

I changed the inspection and updated the description.
I hope you can reproduce the problem.
BR,
Jörg

[Joerki]

Hi @kzantow ,

now I can describe the exact problem after I debug it properly.
Syft assumes that Go is installed on the machine when Go binaries are inspected. But this is a wrong assumption.

I modified HOME in the environment (to simulate that I do not have go on my machine).

{
    "version": "0.2.0",
    "configurations": [
        {
            "name": "Launch Package",
            "type": "go",
            "request": "launch",
            "mode": "auto",
            "program": "cmd/syft/main.go",
            "args": ["scan", "mongo:5.0.26-focal", "-o", "syft-json=/home/joerg/projects/mongo_inspect/mongo-syft-single.json", "-vv"],
            "env": { "HOME": "/home/joerg/projects/mongo_inspect/temp", "GOPATH": "", "SYFT_GOLANG_SEARCH_REMOTE_LICENSES": "true" }
        }
    ]
}

Please look here:

syft/pkg/cataloger/golang/licenses.go

func modCacheResolver

Syft appended "go/pkg/mod" to my HOME path. This is the content of my modCacheDir parameter.
My $HOME exists, but not $HOME/go/pkg/mod.
The result is that the path is not found (a trace method is written, not a trace for me, the problem should be much more obvious), and an empty fileresolver is created. So downloaded licenses go to nowhere.

My temporary workaround in the pipeline will be hopefully the creation of $HOME/go/pkg/mod directory.
But Syft has to use a directory where packages can be written to and analysed.

BR,
Jörg

[Joerki]

I can confirm that my temporary solution - the creation of $HOME/go/pkg/mod before Syft invocation - is working.