feat(go): construct dependencies of go.mod main module in the parser

[DmitriyLewen]

Description

Continuation of #7973

Related PRs

• feat(go): construct dependencies in the parser #7973
• feat: add workspaceRelationship #7889

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

Since we need to put empty elements in CycloneDX, shouldn't we include this relationship regardless of whether len(dependsOn) is empty?

Components or services that do not have their own dependencies must be declared as empty elements within the graph.

https://cyclonedx.org/docs/1.6/json/#dependencies

[DmitriyLewen]

There is no difference now .
pkg.DependsOn will be nil (with len(dependsOn) > 0 check) or empty slice (without this check):

trivy/pkg/fanal/analyzer/language/analyze.go

Line 103 in 1f5f348

pkgs[i].DependsOn = deps[pkg.ID]

When we add relationships in BOM core - we just check length of DependsOn field:

trivy/pkg/sbom/io/encode.go

Lines 249 to 261 in 5dd94eb

	for _, dep := range pkg.DependsOn {
	dependsOn, ok := dependencies[dep]
	if !ok {
	continue
	}
	e.bom.AddRelationship(c, dependsOn, core.RelationshipDependsOn)
	}
	// Components that do not have their own dependencies MUST be declared as empty elements within the graph.
	// TODO: Should check if the component has actually no dependencies or the dependency graph is not supported.
	if len(pkg.DependsOn) == 0 {
	e.bom.AddRelationship(c, nil, "")
	}

But it can help with TODO: Should check if the component has actually no dependencies or the dependency graph is not supported..
empty slice - pkg supports dependency graph, but doesn't have dependencies.
nil - pkg doesn't support dependency graph.

[DmitriyLewen]

updated in 29d73fb

[knqyf263]

In some cases, the dependency relationships cannot be correctly identified due to missing $GOPATH or $GOPATH/**/go.mod. We need to add a relationship between a main module and those indirect packages.

trivy/pkg/fanal/analyzer/language/golang/mod/mod.go

Lines 129 to 135 in 29d73fb

	// $GOPATH/pkg/mod
	modPath := filepath.Join(gopath, "pkg", "mod")
	if !fsutils.DirExists(modPath) {
	a.logger.Debug("GOPATH not found. Need 'go mod download' to fill licenses and dependency relationships",
	log.String("GOPATH", modPath))
	return nil
	}

trivy/pkg/fanal/analyzer/language/golang/mod/mod.go

Lines 167 to 169 in 29d73fb

	} else if dep.ID == "" {
	// go.mod not found
	continue