feat(license): scan `vendor` directory for license for `go.mod` files

[DmitriyLewen]

Description

There are cases when users use only vendor dir (go mod vendor) command.

For these cases we can't detect licenses from $GOPATH/pkg/mod dir.

New logic

graph TD
    A[Detect licenses for go.mod files] --> B{vendor direxists?}
    B -- yes --> C[use vendor dir to find licenses]
    B -- no --> D[use $GOPATH/pkg/mod]

Loading

Discussed in #8517

[oneum20]

Hi @DmitriyLewen !

Trivy reads go.mod files from $GOPATH/pkg/mod to collect dependencies (e.g. in gomodAnalyzer.collectDeps), but vendor packages don’t have that.

Is there a way to handle this case?

[DmitriyLewen]

Hello @oneum20
What do you mean?
Can you explain in more detail what you mean?

[oneum20]

Packages under $GOPATH/pkg/mod have their own go.mod files.

$ ls $GOPATH/pkg/mod/connectrpc.com/grpchealth@v1.3.0
LICENSE                 README.md               buf.work.yaml           grpchealth.go
MAINTAINERS.md          SECURITY.md             go.mod                  grpchealth_test.go
Makefile                buf.gen.yaml            go.sum                  internal

Packages in the vendor directory do not have their own go.mod files.

$ ls  ./vendor/connectrpc.com/grpchealth 
LICENSE         Makefile        SECURITY.md     buf.work.yaml   internal
MAINTAINERS.md  README.md       buf.gen.yaml    grpchealth.go

In the following code, it looks like Trivy reads the package’s go.mod file to collect its dependencies.

trivy/pkg/fanal/analyzer/language/golang/mod/mod.go

Lines 188 to 191 in bfa99d2

	func (a *gomodAnalyzer) collectDeps(modDir, pkgID string) (types.Dependency, error) {
	// e.g. $GOPATH/pkg/mod/github.com/aquasecurity/go-dep-parser@v0.0.0-20220406074731-71021a481237/go.mod
	modPath := filepath.Join(modDir, "go.mod")
	f, err := os.Open(modPath)

[DmitriyLewen]

hmm... You are right.
Packages from vendor directory don't have go.mod files.
This doesn't matter for license detection (we check LICENSE files), but it will affect the removal of unused dependencies.

But to avoid these problems - perhaps make senso to check both paths (i mean $GOPATH/pkg/mod and vendor dir)

[DmitriyLewen]

Added in #8689