go.sum / go.mod with Bomdesk
This opens a small go.sum. Press Scan to see the licence and the known advisories for each module version, then download the result as CycloneDX or SPDX for your records.
- Paste go.sum for the full list, or go.mod to see direct and indirect modules.
- Press Scan to look up licences and advisories.
- Download CycloneDX or SPDX.
- Run govulncheck for reachability, which this page cannot judge.
What to know
go.sum lists a checksum for every module version the build considered. Each version appears on two lines, one for the module's code and one for its go.mod file; Bomdesk uses the first and skips the /go.mod lines. go.sum can also keep versions that were downloaded once and are no longer used, so the list can be longer than the final build. It cannot say which modules are direct.
go.mod can: a require line ending in // indirect is a transitive module. It lists only the versions the build needs at minimum, not the full graph, so paste both files when you can, or use go list -m all.
Advisories are matched on module and version. They do not tell you whether your code calls the vulnerable function. govulncheck answers that question from your source, and the two complement each other.
Updated · Cosmovex
Questions
Should I paste go.sum or go.mod?
go.sum for the widest list, go.mod to separate direct from indirect modules. Both work.
Why does the same module appear on two lines?
go.sum stores a hash of the module's code and one of its go.mod. Bomdesk counts the module once.
Does a listed advisory mean I am affected?
Not necessarily. The vulnerable function may never be called. Use govulncheck on your source to check.
Are replace directives applied?
No. Bomdesk reads the module versions listed in the file you paste. A replace directive in go.mod changes what is built and is not applied here.
The free plan covers everything on this page. Bomdesk Pro ($19, paid once) is described on the Bomdesk page.
