mod failed due to calculating has of non go file

[rucciva]

Command:

cyclonedx-gomod mod -verbose

Error:

....
1:33AM DBG skipping license detection module=golang.org/x/sync@v0.0.0-20210220032951-036812b2e83c reason="no detector provided"
1:33AM DBG calculating module hash module=golang.org/x/sync@v0.0.0-20210220032951-036812b2e83c
1:33AM DBG converting module to component module=golang.org/x/sys@v0.0.0-20220209214540-3681064d5158
1:33AM DBG skipping license detection module=golang.org/x/sys@v0.0.0-20220209214540-3681064d5158 reason="no detector provided"
1:33AM DBG calculating module hash module=golang.org/x/sys@v0.0.0-20220209214540-3681064d5158
1:33AM DBG converting module to component module=golang.org/x/text@v0.3.7
1:33AM DBG skipping license detection module=golang.org/x/text@v0.3.7 reason="no detector provided"
1:33AM DBG calculating module hash module=golang.org/x/text@v0.3.7
1:33AM DBG converting module to component module=golang.org/x/time@v0.0.0-20210723032227-1f47c861a9ac
1:33AM DBG skipping license detection module=golang.org/x/time@v0.0.0-20210723032227-1f47c861a9ac reason="no detector provided"
1:33AM DBG calculating module hash module=golang.org/x/time@v0.0.0-20210723032227-1f47c861a9ac
1:33AM DBG converting module to component module=golang.org/x/xerrors@v0.0.0-20200804184101-5ec99f83aff1
1:33AM DBG skipping license detection module=golang.org/x/xerrors@v0.0.0-20200804184101-5ec99f83aff1 reason="no detector provided"
1:33AM DBG calculating module hash module=golang.org/x/xerrors@v0.0.0-20200804184101-5ec99f83aff1
1:33AM DBG converting module to component module=google.golang.org/api@v0.70.0
1:33AM DBG skipping license detection module=google.golang.org/api@v0.70.0 reason="no detector provided"
1:33AM DBG calculating module hash module=google.golang.org/api@v0.70.0
1:33AM DBG converting module to component module=google.golang.org/appengine@v1.6.7
1:33AM DBG skipping license detection module=google.golang.org/appengine@v1.6.7 reason="no detector provided"
1:33AM DBG calculating module hash module=google.golang.org/appengine@v1.6.7
{"level":"error","error":"failed to convert modules: failed to calculate module hash: open /.env.development: no such file or directory","time":"2022-10-12T01:33:05Z"}

[nscuro]

Hey @rucciva, thanks for reporting!

And sorry for the long wait. This error is very odd, and I can't reproduce it with any setup so far. Would it be possible to provide a minimal example project that triggers this error?

[rucciva]

hi @nscuro , no problem.

Unfortunately the repo is private so i can't share it.

But, i tried running go mod tidy first before running cyclonedx-gomod mod -verbose and its working fine. Attached are the changes on go.mod and go.sum. Maybe it can give some clue?

[Aaronzinhoo]

I am experiencing a similar issue on a private repo as well. I will try your fix @rucciva and see if it works. I can provide the packages I am using if that helps as well @nscuro

[nscuro]

@Aaronzinhoo Thanks, if you could provide a minimal Go project that triggers this behavior, that would make reproducing it a lot easier.

[nluzgin]

Got the same output with -verbose
can i help somehow?

I have a go mod graph out, go.mod and go.sum

[nscuro]

@nluzgin The biggest help would be providing a simple reproducer project, or instructions to reproduce it reliably.

[nluzgin]

@nscuro sorry, i'm lost in time

My repo is private too, but i think i found the way to reproduce.

in "wat.zip" impersonal sample of code with .git folder, which seems a problem one:
ERR error="failed to convert modules: failed to calculate module hash: open /.git/FETCH_HEAD: no such file or directory"

wat.zip
gitlab_out.txt

[nluzgin]

Anyway it seems like a some missed check before starting calculate hashes.
As idea:

1. add .git folder to default "exclude list" (not sure about this)
2. add an option to exclude some files or folders (or i miss this?)
3. check file existence before any action