hitting error (invalid package name: "") on repo have multiple go.mod

[WLun001]

Summary

Hitting error invalid package name: "" on repo with multiple go.mod

Steps to reproduce the behavior

Repo strucutre

.root
  |- cli 
  |   | - cli-name 
  |       |- go.mod
  | - go.mod

Run gosec on root

gosec ./...

after awhile

Golang errors in file: [some-path/cmd/generate.go]:

  > [line 21 : column 2] - could not import github.com/spf13/cobra (invalid package name: "")

gosec version

Not sure what is the version, it prints nothing

gosec -version

Version:
Git tag:
Build date:

Go version (output of 'go version')

go version go1.14.3 darwin/amd64

Operating system / Environment

MacOS 10.15.4

Expected behavior

Should able to resolve packages

Actual behavior

Unable to resolve packages on repo with multiple go.mod

[ccojocar]

Hi @WLun001, This is not an idiomatic go project layout. You need to have one module per repository. See this docs for more details https://github.com/golang-standards/project-layout.

Also note that gosec relies on go standard library packages to load the modules. So if it fails, it means that your project doesn't follow the standards.

I am going to close this because gosec is not going to support this project structure. Thanks!

[WLun001]

@ccojocar thanks for the suggestion, I have refactored my project layout and it worked

[nitinvalake]

@ccojocar Facing issues with private repos.

In my project we have used private repositories and while running gosec command it is giving "unknown revision" error for those private repos.

and when use GO111MODULE=off then it is giving same error as mentioned by @WLun001

[lootek]

Hi @WLun001, This is not an idiomatic go project layout. You need to have one module per repository. See this docs for more details https://github.com/golang-standards/project-layout.

Also note that gosec relies on go standard library packages to load the modules. So if it fails, it means that your project doesn't follow the standards.

I am going to close this because gosec is not going to support this project structure. Thanks!

The repo you're referring to is NOT an official Go project structure - see golang-standards/project-layout#117

Also, it's perfectly valid to have one git repo with many Go modules - see the OFFICIAL docs https://golang.org/doc/modules/managing-source#tools

[Emptyless]

for anyone facing this issue, #1100 fixes the aforementioned issue, the PR is closed but I'll keep the branch open and will try to keep it in sync