Add support for Go workspaces

[brunoapimentel]

This commit changes the resolve_gomod function so that it can handle a json stream coming from go list -m, which happens when workspaces are used in a Go project.

It also removes the previous restrictions on using workspaces.

Maintainers will complete the following section

• Commit messages are descriptive enough
• Code coverage from testing does not decrease and new code is covered
• New code has type annotations
• [n/a] OpenAPI schema is updated (if applicable)
• [n/a] DB schema change has corresponding DB migration (if applicable)
• README updated (if worker configuration changed, or if applicable)
• Draft release notes are updated before merging

[brunoapimentel]

As far as I could tell, Cachito is ignoring version tags applied to submodules. So we can just use the main module version for all workspaces, since we're pretty much keeping the current behavior.

We should probably fix this in a follow up PR, though.

[brunoapimentel]

I tested it with:

{
  "repo": "https://github.com/cachito-testing/gomod-pandemonium",
  "ref": "0c6890c3280a00271891f4bd04705a56151428f0",
  "pkg_managers": ["gomod"]
}

And I got:

{
    "name": "github.com/cachito-testing/gomod-pandemonium/terminaltor",
    "purl": "pkg:golang/github.com%2Fcachito-testing%2Fgomod-pandemonium%[email protected]",
    "type": "library",
    "version": "v0.1.0"
}

Although the version for terminaltor should've been v1.0.0.

[brunoapimentel]

(The SBOM also had an entry in which the version for terminaltor was ./terminaltor, so the behavior is a little odd)

[chmeliik]

I think Cachito does support submodule versioning. But only if you tell it to process the submodule 🥲

i.e.

{
  "repo": "https://github.com/cachito-testing/gomod-pandemonium",
  "ref": "0c6890c3280a00271891f4bd04705a56151428f0",
  "pkg_managers": ["gomod"],
  "packages": {
    "gomod": [{"path": "."}, {"path": "terminaltor"}, {"path": "weird"}]
  }
}

[brunoapimentel]

So, I tried specifying all modules using the input you provided, and it still is correctly picking up for terminaltor:

  {
    "name": "github.com/cachito-testing/gomod-pandemonium/terminaltor",
    "purl": "pkg:golang/github.com%2Fcachito-testing%2Fgomod-pandemonium%[email protected]",
    "type": "library",
    "version": "v1.0.0"
  }

Which means we're still preserving the same behavior: submodule versions will only be picked up if the submodule is specified as a Cachito input package.

[brunoapimentel]

I didn't see any duplication in the resulting SBOM that happens as a side effect of specifying all the submodules/workspaces present in the repo. The terminaltor module has a duplication regardless of what input packages you specify, though:

 {
    "name": "github.com/cachito-testing/gomod-pandemonium/terminaltor",
    "purl": "pkg:golang/github.com%2Fcachito-testing%2Fgomod-pandemonium%[email protected]",
    "type": "library",
    "version": "./terminaltor"
  },
  {
    "name": "github.com/cachito-testing/gomod-pandemonium/terminaltor",
    "purl": "pkg:golang/github.com%2Fcachito-testing%2Fgomod-pandemonium%[email protected]",
    "type": "library",
    "version": "v1.0.0"
  }

This does not happen with weird... I'm not sure what is causing it yet. 🤔

[chmeliik]

On the one hand, with workspaces it doesn't make any sense to require that the user specify all submodules

On the other hand, ¯\_(ツ)_/¯

[brunoapimentel]

Well, so I found out that the previous solution was indeed creating duplicate results in the SBOM. I rewrote it so:

• it picks the right version for each workspace
• the user does not need to specify multiple input packages anymore

[brunoapimentel]

New push: rewrites the logic that parses the workspace data so that the versions applied to submodules are properly picked up.

[brunoapimentel]

I don't like the idea of updating the object attributes in place, but I also didn't want to do a deep dive into refactoring get_golang_version. This function takes a lot of attributes, and anything I wrote in the LocalModules class would bring all this crap together 😕

[chmeliik]

LGTM

Just to make sure I understand the limitations

• all the workspaces will be reported with correct versions, doesn't matter if the user tells cachito to process just one workspace or all of them
• packages from a workspace will only be reported if the user tells cachito to process that workspace

More or less?

[brunoapimentel]

* all the workspaces will be reported with correct versions, doesn't matter if the user tells cachito to process just one workspace or all of them

Yes, because go list -m will always list all workspaces, and we're running _get_golang_version individually for each one of them.

• packages from a workspace will only be reported if the user tells cachito to process that workspace

Yes, because of the limitation of go list ./....