Xa ukulawula iiprojekthi ze-Go, kufuneka uqhagamshelane neengxaki, ukhangele iingxaki kunye nokulawula ukuxhaswa kwe-license. Ngaphandle kokufumana izixhobo ze-external, sicela ukwakha i-analyzer yethu ye-dependence usebenzisa i-library ye-Go ye-standard. isakhiwo core Ukusebenza kunye neemoduli ze-Go, ngoko kufuneka izakhiwo zokubonisa: package main

import (
	"bufio"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"os"
	"regexp"
	"sort"
	"strings"
	"time"
)

type Module struct {
	Path     string
	Version  string
	Indirect bool
}

type GoMod struct {
	Module   Module
	Requires []Module
}
 Izixhobo yethu iya kuthatha iintlobo ezintathu: ukubonisa iingxaki, ukucacisa iingxaki, kunye ne-license checking. Ukucaciswa kwefayela go.mod Ukulungiselela isakhiwo yefayela ye-module ifayile go.mod isebenzisa ifomati elifanelekileyo esifunyenweyo ngokufanelekileyo. Iingcebiso ze-module ziqala ngeengcebiso ze-module kunye neengcebiso ze-module. Iingcebiso zihlanganisa kwiingcebiso ze-require, ezininzi zeengcebiso zeengcebiso zeengcebiso zeengcebiso zeengcebiso. I-parsing logic ithatha iintlobo ezimbini ngokucacisa ukuba siphinde kwi-block ye-multi-line require. Thina usebenzisa i-expressions eziqhelekileyo ukufumana i-module path kunye ne-version kumgca, kwaye ukucacisa iingxaki ze-indirect ngokucacisa i- // indirect comment. Le nkqubo inikeza ulwazi efanayo le-go list, kodwa ngaphandle kokufunda iinkqubo ze-external. Ngaphandle kokuhambisa Kwakhona, sinokufumana i ifayile ngqo: go list go.mod func parseGoMod() (*GoMod, error) {
	file, err := os.Open("go.mod")
	if err != nil {
		return nil, fmt.Errorf("go.mod not found: %v", err)
	}
	defer file.Close()

	goMod := &GoMod{
		Requires: []Module{},
	}

	scanner := bufio.NewScanner(file)
	inRequire := false
	requireRegex := regexp.MustCompile(`^\s*([^\s]+)\s+([^\s]+)(?:\s+//\s*indirect)?`)
	moduleRegex := regexp.MustCompile(`^module\s+(.+)`)

	for scanner.Scan() {
		line := strings.TrimSpace(scanner.Text())

		if strings.HasPrefix(line, "module ") {
			if matches := moduleRegex.FindStringSubmatch(line); len(matches) > 1 {
				goMod.Module = Module{Path: matches[1]}
			}
		}

		if strings.HasPrefix(line, "require (") {
			inRequire = true
			continue
		}

		if inRequire && line == ")" {
			inRequire = false
			continue
		}

		if inRequire || strings.HasPrefix(line, "require ") {
			cleanLine := strings.TrimPrefix(line, "require ")
			if matches := requireRegex.FindStringSubmatch(cleanLine); len(matches) >= 3 {
				module := Module{
					Path:     matches[1],
					Version:  matches[2],
					Indirect: strings.Contains(line, "indirect"),
				}
				goMod.Requires = append(goMod.Requires, module)
			}
		}
	}

	return goMod, scanner.Err()
}
 I-parser isebenza kunye ne-single-line requires kunye ne-multi-line requires blocks. I-parser ibonelela iindlela ze-module, i-versions, kwaye ibonelela iingxaki ze-indirect. Ukucaciswa kwabasetyhini Yintoni i-Vulnerability Checking ifumaneka Iinkcukacha ze-Vulnerability zihlanganisa iinkcukacha zeengxaki zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha zeenkcukacha. I-database ye-OSV ikuncedo kakhulu ngenxa yokuhlanganisa idatha yeengxaki ezininzi kunye nokunika i-API ye-unified. Xa sincoma, sisibini sincoma "ukuba le version esifunyenweyo yeepakethe inezinto zokhuseleko?" I-database isebenze i-version matching kwaye inikeza idatha ebandayo malunga neengxaki. Ukubuyekeza i-OSV (i-Open Source Vulnerabilities) database ukuba iimeko ezaziwayo: func checkOSVDatabase(modulePath, version string) []string {
	url := "https://api.osv.dev/v1/query"

	payload := map[string]interface{}{
		"package": map[string]string{
			"name":      modulePath,
			"ecosystem": "Go",
		},
		"version": version,
	}

	jsonData, err := json.Marshal(payload)
	if err != nil {
		return []string{}
	}

	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := client.Post(url, "application/json", strings.NewReader(string(jsonData)))
	if err != nil {
		return []string{}
	}
	defer resp.Body.Close()

	if resp.StatusCode != 200 {
		return []string{}
	}

	var result struct {
		Vulns []struct {
			ID      string `json:"id"`
			Summary string `json:"summary"`
		} `json:"vulns"`
	}

	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
		return []string{}
	}

	var vulnerabilities []string
	for _, vuln := range result.Vulns {
		vulnStr := fmt.Sprintf("%s: %s", vuln.ID, vuln.Summary)
		vulnerabilities = append(vulnerabilities, vulnStr)
	}

	return vulnerabilities
}

func checkVulnerabilities() {
	goMod, err := parseGoMod()
	if err != nil {
		fmt.Printf("Error: %v\n", err)
		return
	}

	vulnerableModules := 0

	for i, mod := range goMod.Requires {
		fmt.Printf("\rScanning %d/%d: %s", i+1, len(goMod.Requires), mod.Path)
		vulns := checkOSVDatabase(mod.Path, mod.Version)
		if len(vulns) > 0 {
			vulnerableModules++
			fmt.Printf("\n🚨 %s@%s:\n", mod.Path, mod.Version)
			for _, vuln := range vulns {
				fmt.Printf("  - %s\n", vuln)
			}
		}
	}

	if vulnerableModules == 0 {
		fmt.Println("\n✅ No known vulnerabilities found")
	} else {
		fmt.Printf("\n⚠️ Found %d vulnerable modules\n", vulnerableModules)
	}
}
 I-Vulnerability Checker ivumela i-Payload ye-JSON kunye ne-module name kunye ne-version, emva koko i-Anscope ye-response yeengxaki ziye zithunyelwe. Ukuvunyelwa kwe-license Information Indlela yokusebenza License Detection Ukuhlola ukuxhaswa kwe-license kubandakanya ukucacisa iinkcukacha zomthetho ezinxulumene ngalinye iingxaki kwiprojekthi yakho. Iiprojekthi ezininzi ze-open source zihlanganisa iifayile ze-license kwi-repositories zabo, kwaye iiplatforms ezifana ne-GitHub zihlanganisa leifayile ukucacisa uhlobo le-license usebenzisa i-IDs ye-SPDX. Umgangatho yethu usebenzisa i-API ye-license detection ye-GitHub, eyenza iinkcukacha ze-repository kwaye ivumela i-ID ye-license eziqhelekileyo. Kwi-module e-GitHub, sinikezela i-owner kunye ne-repository-name kwi-module path, ngoku sinikezela kwi-API ye-endpoint ye-GitHub enikezela ngokugqithisileyo iinkcukacha ze-license. Oku inikeza idatha ze-license eyenziwa ngamanzi ngaphandle kokufaka kunye nokufaka iifayile ze-license. Izicelo ezahlukeneyo ziquka iimfuno ezahlukileyo, ezinye ezifana ne-MIT ziquka kakhulu, kwaye ezinye ezifana ne-GPL ziquka iimfuno ze-copyleft ezinokufanelekanga indlela yokuthintela i-software yakho. Ukuphathelela lezi zihlanganisi kubalulekile ukuxhaswa kwe-legal. Kwimoduli e-GitHub, sinokufumana idatha ye-license evela kwi-API yayo: func fetchGitHubLicense(owner, repo string) string {
	url := fmt.Sprintf("https://api.github.com/repos/%s/%s/license", owner, repo)

	client := &http.Client{Timeout: 10 * time.Second}
	resp, err := client.Get(url)
	if err != nil {
		return "Unknown"
	}
	defer resp.Body.Close()

	if resp.StatusCode != 200 {
		return "Unknown"
	}

	var result struct {
		License struct {
			SPDXID string `json:"spdx_id"`
		} `json:"license"`
	}

	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
		return "Unknown"
	}

	if result.License.SPDXID != "" && result.License.SPDXID != "NOASSERTION" {
		return result.License.SPDXID
	}

	return "Unknown"
}

func fetchLicenseFromRepo(modulePath string) string {
	if strings.HasPrefix(modulePath, "golang.org/x/") {
		return "BSD-3-Clause"
	}

	if !strings.HasPrefix(modulePath, "github.com/") {
		return "Unknown"
	}

	parts := strings.Split(modulePath, "/")
	if len(parts) < 3 {
		return "Unknown"
	}

	return fetchGitHubLicense(parts[1], parts[2])
}

func checkLicenses() {
	goMod, err := parseGoMod()
	if err != nil {
		fmt.Printf("Error: %v\n", err)
		return
	}

	licenseCount := make(map[string]int)

	for i, mod := range goMod.Requires {
		fmt.Printf("\rProcessing %d/%d...", i+1, len(goMod.Requires))
		license := fetchLicenseFromRepo(mod.Path)
		licenseCount[license]++
		fmt.Printf("\r  %s: %s\n", mod.Path, license)
	}

	fmt.Println("\nLicense Distribution:")
	for license, count := range licenseCount {
		percentage := float64(count) / float64(len(goMod.Requires)) * 100
		fmt.Printf("  %s: %d modules (%.1f%%)\n", license, count, percentage)
	}
}
 I-Checker ye-license ibonelela ukuba iipakethi usebenzisa i-BSD-3-Clause, emva koko i-interrogation ye-API ye-GitHub kwiiphakheji ezininzi. golang.org/x/ Ukuhlolwa kwe-Dependency kunye ne-Checksum Verification I-dependence analyzer ihlawula i-module kunye nokuthintela ukuxhaswa kwe-integrity : go.sum func parseGoSum() map[string]string {
	checksums := make(map[string]string)

	file, err := os.Open("go.sum")
	if err != nil {
		return checksums
	}
	defer file.Close()

	scanner := bufio.NewScanner(file)
	for scanner.Scan() {
		parts := strings.Fields(scanner.Text())
		if len(parts) >= 3 {
			module := parts[0] + "@" + parts[1]
			checksums[module] = parts[2]
		}
	}

	return checksums
}

func analyzeDependencies() {
	goMod, err := parseGoMod()
	if err != nil {
		fmt.Printf("Error: %v\n", err)
		return
	}

	checksums := parseGoSum()

	fmt.Printf("Module: %s\n", goMod.Module.Path)
	fmt.Printf("Found %d dependencies:\n\n", len(goMod.Requires))

	direct, indirect := 0, 0

	sort.Slice(goMod.Requires, func(i, j int) bool {
		return goMod.Requires[i].Path < goMod.Requires[j].Path
	})

	for _, mod := range goMod.Requires {
		status := "direct"
		if mod.Indirect {
			status = "indirect"
			indirect++
		} else {
			direct++
		}

		checksumKey := mod.Path + "@" + mod.Version
		hasChecksum := "❌"
		if _, exists := checksums[checksumKey]; exists {
			hasChecksum = "✅"
		}

		fmt.Printf("  %s %s@%s (%s)\n", hasChecksum, mod.Path, mod.Version, status)
	}

	fmt.Printf("\nSummary: %d direct, %d indirect dependencies\n", direct, indirect)
}
 Ulawulo Interface Izixhobo zokusebenza eziphambili zithunyelwe kwizilwanyana ezifanelekileyo: func main() {
	if len(os.Args) < 2 {
		fmt.Println("Usage: go run main.go <command>")
		fmt.Println("Commands:")
		fmt.Println("  deps      List all dependencies")
		fmt.Println("  vulns     Check for vulnerabilities")
		fmt.Println("  licenses  Check license compliance")
		os.Exit(1)
	}

	switch os.Args[1] {
	case "deps":
		analyzeDependencies()
	case "vulns":
		checkVulnerabilities()
	case "licenses":
		checkLicenses()
	default:
		fmt.Println("Unknown command")
		os.Exit(1)
	}
}
 Ukuqhuba I-Instrument Yenza ikhowudi like kwaye uqhagamshelane kwi-Go Project: main.go # List dependencies with checksum verification
go run main.go deps
 # Scan for vulnerabilities
go run main.go vulns
 # Analyze licenses
go run main.go licenses
 I-output ibonisa iinkcukacha ze-dependence, iinkcukacha ze- vulnerability kunye ne-distribution ye-license kwiinkcukacha ze-project yakho. I-tool ibonise indlela yokusebenza kwe-dependence analytics emzimbeni, ukucacisa iifayile ze-module, ukucacisa i-API ze-publish, kunye ne-cross-referencing emithombo yedatha. Ukusetyenziswa okuhlobisa iingcebiso ezisiseko kodwa kunokuba yindawo yokuqala. Ukuhlobisa iintlobo zangaphambili kufuneka iinkcukacha zebhanki, ukuxhaswa kwexesha le-version, ukuxhaswa kwe-fake-positive, kunye nokulawula iingcebiso ezinzima. Izixhobo zokusetyenziswa kwe-license kufuneka izixhobo zomthetho zomthetho, i-matrice ye-compatibility, kunye ne-custom license detection ngaphezu kwe-API ye-GitHub inikeza. Ukusetyenziswa kwimveliso, uya ufuna iintlobo ezininzi zebhanki, ukuxhaswa kwe-cache, ukuxhaswa kwe-rate, kunye ne-logic yokuqinisekisa ezininzi kakhulu. I-Coding yeNdlu yeNdlu ;) Ngaba ufumana i-source code apha https://github.com/rezmoss/go-dependency-scanner

This story contains new, firsthand information uncovered by the writer.

The code in this story is for educational purposes. The readers are solely responsible for whatever they build with it.

Read My Stories

Le audio iveliswe ngolwimi lokuqala lwebali!

Ukwakhiwa kwe-Go Dependency Scanner ukusuka kwakhona

About Author

IZIMVO

ZIJONGE IIMPAWU

ELI NQAKU LINIKEZELWE KU

Related Stories

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps