Go binary scanning is not working if libraries are vendored

[ebati]

Description

trivy's go dependency analysis is not working with binaries built with vendoring enabled.

I noticed that Parse logic depends only on field count but since with vendoring there is no hash value in the output line, there are only 3 fields (instead of expected 4 fields). I think instead of trusting field count first field should be inspected.

For my use-case, i test my own binaries so hashes are not important (i check libraries authenticity separately) but if it is required to check the used libraries authenticity from the given binary, hash should also be validated using checksum db.

What did you expect to happen?

trivy to scan binary built with source code that uses vendor folder for dependencies.

What happened instead?

trivy does not detect gobinary

(I didn't provide the -debug info etc. as i tested with closed source project)

[knqyf263]

Thank you for reporting! I'll have a look.

[ebati]

I sent a PR which have more details.

Also after asking on go slack channel an issue is opened about this topic (to be able to embed vendored modules hash, it must be in module cache as well).