fix(go): Do not trim v prefix from versions in Go Mod Analyzer

[Rutam21]

Description

This PR modifies the Go Mod Analyzer file so that the prefix "v" is not trimmed from the versions to maintain consistency with the Go Binary Analyzer.

Related issues

• Close fix(golang): do not trim v prefix from versions #7711

Checklist

• I've read the guidelines for contributing to this repository.

[CLAassistant]

All committers have signed the CLA.

[DmitriyLewen]

Hello @Rutam21
Thanks for your work!

can you update tests too?

Regards, Dmitriy

[Rutam21]

Hello @DmitriyLewen, I have added the v prefix to the version numbers in the test and test-cases file for the Go Mod Analyzer so that it matches the required versioning format. Please review and suggest changes, if any. Thanks.

[DmitriyLewen]

You also need to update integration and k8s tests.
mage test:updateGolden command should help

[Rutam21]

@DmitriyLewen I tried running that command but it always errors out. Any suggestions on this?

go: downloading github.com/vmihailenco/msgpack/v5 v5.3.5
go: downloading github.com/dsnet/compress v0.0.1
go: downloading sigs.k8s.io/yaml v1.4.0
go: creating work dir: mkdir /tmp/go-build220524866: no space left on device
Error: running "go test -tags=integration ./integration/... ./pkg/fanal/test/integration/... -update" failed with exit code 1

[knqyf263]

@Rutam21 You don't have enough disk space.

go: creating work dir: mkdir /tmp/go-build220524866: no space left on device

If you have more space in another directory, you can specify it like TMPDIR=/path/to/another-dir.

[knqyf263]

@Rutam21 Do you have time to wrap it up? We want to include this fix in v0.57.0. If you're busy, we can take care of it.

[DmitriyLewen]

@Rutam21 don't worry i updated golden files

@knqyf263 when I updated the gold files - I thought - do we need to update the docs/other tests?
e.g. :

• https://aquasecurity.github.io/trivy/v0.56/docs/supply-chain/vex/file/#applying-vex-to-dependency-trees

• trivy/pkg/sbom/io/encode_test.go

  Lines 561 to 586 in 4a2f492

  	uuid.MustParse("3ff14136-e09f-4df9-80ea-000000000004"): {
  	Type: core.TypeLibrary,
  	Name: "github.com/org/direct",
  	Version: "1.0.0",
  	SrcFile: "test",
  	Properties: []core.Property{
  	{
  	Name: core.PropertyPkgID,
  	Value: "github.com/org/[email protected]",
  	},
  	{
  	Name: core.PropertyPkgType,
  	Value: "gobinary",
  	},
  	},
  	PkgIdentifier: ftypes.PkgIdentifier{
  	UID: "A74CADAD4D9805FF",
  	PURL: &packageurl.PackageURL{
  	Type: packageurl.TypeGolang,
  	Namespace: "github.com/org",
  	Name: "direct",
  	Version: "1.0.0",
  	},
  	BOMRef: "pkg:golang/github.com/org/[email protected]",
  	},
  	},

Also i thought about stdlib - do we need to add v prefix?

• go.mod go line uses x.y.z format (e.g. go 1.22.0)
• go.mod toolchain and go version -m use gox.y.z format (e.g. toolchain go1.22.4 and trivy: go1.22.5)

[Rutam21]

Thank you @DmitriyLewen. Due to storage constraints, the suggested command was failing for me always.

[knqyf263]

@knqyf263 when I updated the gold files - I thought - do we need to update the docs/other tests?

Yes, it would be great if the version formats are consistent in Trivy so that we will not get confused in the future.

Also, I thought about stdlib - do we need to add a v prefix?

goV seems like a canonical format, but our versioning library doesn't support it and needs special handling for that. So, I think we want to add the v prefix for consistency.

[DmitriyLewen]

@knqyf263 I updated testcases and docs.
I didn't update rekor tests (it requires regenerating the digest, so I think we can skip the changes since it's not worth the time)

Also we need to update k8s scanner package to add v prefix, but i think that should be done in a separate PR.

So, I think we want to add the v prefix for consistency.

Done in d5a787b

[knqyf263]

Thanks. GitHub Actions is down now. We'll merge this PR after it's back.

[DmitriyLewen]

@knqyf263 We don't add v prefix for stdlib of gobinaries.
I added it in - 5b5b7f8

Take a look, please.

I also created #7822 for k8s scanner

[knqyf263]

Failing?
https://github.com/aquasecurity/trivy/actions/runs/11589193853/job/32264219598?pr=7733

[DmitriyLewen]

Rebased this PR.
Tests now pass.

[knqyf263]

@DmitriyLewen You requested changes before. Your review is blocking this PR.

[DmitriyLewen]

Approved