github.com/vchain-us/vcn@v0.9.11-0.20210921212052-a2484d23c0b3/pkg/bom/golang/golang.go

/*
 * Copyright (c) 2021 CodeNotary, Inc. All Rights Reserved.
 * This software is released under GPL3.
 * The full license information can be found under:
 * https://www.gnu.org/licenses/gpl-3.0.en.html
 *
 */

package golang

import (
	"encoding/base64"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"io/ioutil"
	"net/http"
	"os"
	"path/filepath"
	"strings"

	"github.com/schollz/progressbar/v3"
	"github.com/spf13/viper"

	"github.com/vchain-us/vcn/pkg/bom/artifact"
)

const AssetType = "go"

// goArtifact implements Artifact interface
type goArtifact struct {
	artifact.GenericArtifact
	path string
}

// New returns new GoArtifact object, or nil if filename doesn't referer to ELF, built from Go source, or isn't
// a directory containing Go files
func New(path string) artifact.Artifact {
	fi, err := os.Stat(path)
	if err != nil {
		return nil
	}
	if fi.IsDir() {
		// a directory - look for go.sum, if it is not there, checks the presence of Go files
		_, err = os.Stat(filepath.Join(path, "go.sum"))
		if err == nil {
			return &goArtifactFromSum{goArtifact: goArtifact{path: path}}
		}
		files, err := filepath.Glob(filepath.Join(path, "*.go"))
		if err == nil && len(files) > 0 {
			return &goArtifactFromGoList{goArtifact: goArtifact{path: path}}
		}
	} else {
		// not a directory - check if file is executable and contains Go build info section
		file, err := openExe(path)
		if err != nil {
			return nil // not a ELF binary
		}
		if file.DataStart() == 0 {
			file.Close()
			return nil // cannot find build info
		}
		// exe file is closed by goArtifactFromExe.Dependencies()
		return &goArtifactFromExe{goArtifact: goArtifact{path: path}, file: file}
	}
	return nil
}

func (p goArtifact) Type() string {
	return AssetType
}

func (p goArtifact) Path() string {
	return p.path
}

func ModHash(encoded string) (string, artifact.HashType, error) {
	hashType := artifact.HashInvalid
	fields := strings.SplitN(encoded, ":", 2)
	if len(fields) != 2 {
		return "", artifact.HashInvalid, errors.New("malformed hash value")
	}
	// At the time of writing "h1" (SHA256) is the only hash type, supported by Go
	if fields[0] == "h1" {
		hashType = artifact.HashSHA256
	} else {
		return "", artifact.HashInvalid, errors.New("unsupported hash type")
	}
	hash, err := base64.StdEncoding.DecodeString(fields[1])
	if err != nil {
		return "", artifact.HashInvalid, fmt.Errorf("cannot decode base64 hash: %w", err)
	}

	return hex.EncodeToString(hash), hashType, nil
}

type result struct {
	pkg     string
	license string
	err     error
}

func AddGithubLicenses(deps []artifact.Dependency, output artifact.OutputOptions) error {
	githubMap := make(map[string]*artifact.Dependency, len(deps))
	for i := range deps {
		if strings.HasPrefix(deps[i].Name, "github.com") {
			githubMap[deps[i].Name] = &deps[i]
		}
	}

	token := viper.GetString("github-token")

	taskCount := len(githubMap)
	if taskCount == 0 {
		return nil // no github modules to process
	}

	var bar *progressbar.ProgressBar
	if output == artifact.Progress {
		bar = progressbar.Default(int64(len(githubMap)))
	}

	// init goroutine throttling - channels, start goroutines.
	// We can be sure that there will be no more in-flight messages in channels than known modules
	tasks := make(chan string, taskCount)
	results := make(chan result, taskCount)
	for i := 0; i < artifact.MaxGoroutines; i++ {
		go worker(tasks, results, output, token, bar)
	}
	defer close(results)
	defer close(tasks) // signal workers to stop

	// send all
	for k := range githubMap {
		tasks <- k
	}

	// process responses
	for taskCount > 0 {
		taskCount--
		res := <-results
		if res.err != nil {
			continue
		}
		pkg, ok := githubMap[res.pkg]
		if !ok {
			// should never happen
			return fmt.Errorf("internal error - got unknown package in response")
		}
		pkg.License = res.license
	}

	return nil
}

func worker(tasks <-chan string, results chan<- result, output artifact.OutputOptions, token string, bar *progressbar.ProgressBar) {
	for task := range tasks {
		// pkg path has a form "github.com/<user>/<repo>[/v<version>]", leave only "<user>/<repo>"
		fields := strings.Split(task, "/")
		lic, err := queryGithub(fields[1]+"/"+fields[2], token)

		results <- result{pkg: task, license: lic, err: err}
		if output == artifact.Progress {
			bar.Add(1)
		}
	}
}

type githubRsp struct {
	Lic githubLic `json:"license"`
}

type githubLic struct {
	Id string `json:"spdx_id"`
}

func queryGithub(pkg, token string) (string, error) {
	req, err := http.NewRequest(http.MethodGet, "https://api.github.com/repos/"+pkg, nil)
	if err != nil {
		return "", err
	}

	req.Header.Add("Accept", "application/vnd.github.v3+json")
	if token != "" {
		req.Header.Add("Authorization", "token "+token)
	}
	rsp, err := http.DefaultClient.Do(req)
	if err != nil {
		return "", err
	}
	defer rsp.Body.Close()
	if rsp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("got response %d from github", rsp.StatusCode)
	}

	body, err := ioutil.ReadAll(rsp.Body)
	if err != nil {
		return "", err
	}

	var pkgData githubRsp
	err = json.Unmarshal(body, &pkgData)
	if err != nil {
		return "", err
	}

	return pkgData.Lic.Id, nil
}