Golang: Resultant version and purls drop v from component in cyclonedx sbom.

[b-ramsey]

Description

When performing a trivy scan on a golang file such as go.mod or go.sum the resultant cyclonedx file no longer has the v as a part of the components version and purl. This behaviour has changed since 0.43 trivy.

Example go.mod snippet:
`
go 1.20

require (
go.uber.org/mock v0.4.0
google.golang.org/protobuf v1.31.0
)
`

The purl specification does not specify any requirement around the formatting of version numbers, having the v at the beginning of the version number is acceptable.

This has caused issues where a tool has their data related to the full version number from the go.mod tool, and the request feed in from the sbom file.

Desired Behavior

Components related to the above go.mod

{ "bom-ref": "pkg:golang/go.uber.org/[email protected]", "type": "library", "name": "go.uber.org/mock", "version": "v0.4.0", "purl": "pkg:golang/go.uber.org/[email protected]", "properties": [ { "name": "aquasecurity:trivy:PkgID", "value": "go.uber.org/[email protected]" }, { "name": "aquasecurity:trivy:PkgType", "value": "gomod" } ] }, { "bom-ref": "pkg:golang/google.golang.org/[email protected]", "type": "library", "name": "google.golang.org/protobuf", "version": "v1.31.0", "purl": "pkg:golang/google.golang.org/[email protected]", "properties": [ { "name": "aquasecurity:trivy:PkgID", "value": "google.golang.org/[email protected]" }, { "name": "aquasecurity:trivy:PkgType", "value": "gomod" } ] }

Actual Behavior

Components related to the above go.mod

{
"bom-ref": "pkg:golang/go.uber.org/[email protected]",
"type": "library",
"name": "go.uber.org/mock",
"version": "0.4.0",
"purl": "pkg:golang/go.uber.org/[email protected]",
"properties": [
{
"name": "aquasecurity:trivy:PkgID",
"value": "go.uber.org/[email protected]"
},
{
"name": "aquasecurity:trivy:PkgType",
"value": "gomod"
}
]
},
{
"bom-ref": "pkg:golang/google.golang.org/[email protected]",
"type": "library",
"name": "google.golang.org/protobuf",
"version": "1.31.0",
"purl": "pkg:golang/google.golang.org/[email protected]",
"properties": [
{
"name": "aquasecurity:trivy:PkgID",
"value": "google.golang.org/[email protected]"
},
{
"name": "aquasecurity:trivy:PkgType",
"value": "gomod"
}
]
}

Reproduction Steps

1. Scan the above go.mod using trivy
2. Look at the components
...

Target

Filesystem

Scanner

Vulnerability

Output Format

CycloneDX

Mode

Standalone

Debug Output

2024-07-28T23:14:08Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-07-28T23:14:08Z    DEBUG   Ignore statuses statuses=[]
2024-07-28T23:14:08Z    DEBUG   Cache dir       dir="/root/.cache/trivy"
2024-07-28T23:14:08Z    DEBUG   Skipping DB update...
2024-07-28T23:14:08Z    DEBUG   DB info schema=2 updated_at=2024-07-28T12:11:40.755550542Z next_update=2024-07-28T18:11:40.755550402Z downloaded_at=0001-01-01T00:00:00Z
2024-07-28T23:14:08Z    INFO    Vulnerability scanning is enabled
2024-07-28T23:14:08Z    DEBUG   Vulnerability type      type=[os library]
2024-07-28T23:14:08Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-07-28T23:14:08Z    DEBUG   [nuget] The nuget packages directory couldn't be found. License search disabled
2024-07-28T23:14:08Z    DEBUG   [golang] GOPATH not found. Need 'go mod download' to fill licenses and dependency relationships GOPATH="/root/go/pkg/mod"
2024-07-28T23:14:08Z    DEBUG   OS is not detected.
2024-07-28T23:14:08Z    DEBUG   Detected OS: unknown
2024-07-28T23:14:08Z    INFO    Number of language-specific files       num=1
2024-07-28T23:14:08Z    INFO    [gomod] Detecting vulnerabilities...
2024-07-28T23:14:08Z    DEBUG   [gomod] Scanning packages for vulnerabilities   file_path="go.mod"

Operating System

docker image

Version

Version: 0.52.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-07-28 12:11:40.755550542 +0000 UTC
  NextUpdate: 2024-07-28 18:11:40.755550402 +0000 UTC
  DownloadedAt: 0001-01-01 00:00:00 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-07-28 01:05:44.85841789 +0000 UTC
  NextUpdate: 2024-07-31 01:05:44.85841772 +0000 UTC
  DownloadedAt: 0001-01-01 00:00:00 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @b-ramsey
Thanks for your report!

hm.. Golang always uses v prefix for versions - https://go.dev/doc/modules/version-numbers

@knqyf263 you added support for go.mod files
Is there a reason to trim v prefix (other than proper version comparison for vulnerability detection)?

[knqyf263]

As Trivy supports many ecosystems, it would be easier to deal with v for everything or remove all v prefixes. The ambiguity of the specification in this respect is considered problematic, so it is probably better to ask the CycloneDX team to define it strictly.

[benjsc]

Hit this as well, whilst I agree in regards to the spec clarification should be provided in the component version description. The examples of versiontype of which the component version is based off, clearly show the 'v' should exist.

https://github.com/CycloneDX/specification/blob/e12ac5181bf3e0416660252e6da5ae80df673ce1/schema/bom-1.6.xsd#L64

[knqyf263]

The examples of versiontype of which the component version is based off, clearly show the 'v' should exist.

The example just shows the v prefix is also allowed. We're still not sure when we must have it.
And again, when a single repository contains multiple languages/ecosystems, there will be a mix of versions with and without v in SBOM, and we have been pointed out before about the inconsistencies.

If the CycloneDX team clearly answers that Go should have a v-prefix, we will comply.

[benjsc]

Fair enough, upstream clarification sought: CycloneDX/specification#500

[knqyf263]

Thanks. Let's see what they think.