From: "Mattias Walström" <lazzer@gmail.com>
To: buildroot@buildroot.org
Cc: "Christian Stewart" <christian@aperture.us>,
"Thomas Perale" <thomas.perale@mind.be>,
"Mattias Walström" <lazzer@gmail.com>
Subject: [Buildroot] [PATCH 0/3] Go: list vendored modules in show-info and the SBOM
Date: Wed, 28 Oct 2026 11:32:45 +0100 [thread overview]
Message-ID: <20261028103248.1317597-1-lazzer@gmail.com> (raw)
Go packages show up in the SBOM as one component, so CVE scanners never
see the modules vendored into them. This series records those modules
from the build info in the built binaries and adds them to the CycloneDX
output as nested components.
Patch 3 is a related fix: override and local sources skip the download
step that runs go mod vendor, so a tree without vendor/ failed to build.
Tested with amazon-ecr-credential-helper from an override tree without
vendor/: fails without patch 3, builds with it.
Mattias Walström (3):
package/pkg-golang: record vendored Go modules in show-info
utils/generate-cyclonedx: add vendored dependencies as nested
components
package/pkg-golang: vendor modules of local and overridden sources
package/pkg-golang.mk | 24 ++++++
package/pkg-utils.mk | 7 ++
support/scripts/go-modules-info | 67 ++++++++++++++++
.../tests/utils/test_generate_cyclonedx.py | 76 +++++++++++++++++++
utils/generate-cyclonedx | 53 ++++++++++++-
5 files changed, 225 insertions(+), 2 deletions(-)
create mode 100755 support/scripts/go-modules-info
--
2.43.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next reply other threads:[~2026-10-28 10:32 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-28 10:32 Mattias Walström [this message]
2026-10-28 10:32 ` [Buildroot] [PATCH 1/3] package/pkg-golang: record vendored Go modules in show-info Mattias Walström
2026-10-28 11:00 ` Thomas Perale via buildroot
2026-10-28 10:32 ` [Buildroot] [PATCH 2/3] utils/generate-cyclonedx: add vendored dependencies as nested components Mattias Walström
2026-10-28 10:32 ` [Buildroot] [PATCH 3/3] package/pkg-golang: vendor modules of local and overridden sources Mattias Walström
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261028103248.1317597-1-lazzer@gmail.com \
--to=lazzer@gmail.com \
--cc=buildroot@buildroot.org \
--cc=christian@aperture.us \
--cc=thomas.perale@mind.be \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox