Phase 1 enhancement

Author: ChronosMasterOfAllTime

internal/sbom/enhancer.go

@@ -5,6 +5,8 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"go/parser"
+	"go/token"
 	"os"
 	"path/filepath"
 	"sort"
@@ -335,17 +337,152 @@ func (e *Enhancer) injectMetadata(sbom map[string]interface{}, metadata *GoenvMe
 func (e *Enhancer) enhanceComponents(sbom map[string]interface{}, opts EnhanceOptions) error {
 	components, ok := sbom["components"].([]interface{})
 	if !ok {
-		return nil // No components to enhance
+		components = []interface{}{}
+	}
+
+	// Add stdlib component if Go source files are present
+	if stdlibComponent, err := e.createStdlibComponent(opts.ProjectDir); err == nil && stdlibComponent != nil {
+		components = append(components, stdlibComponent)
 	}
 
-	// TODO: Add stdlib component
 	// TODO: Mark replaced components
 	// TODO: Add retracted version warnings
 
 	sbom["components"] = components
 	return nil
 }
 
+// createStdlibComponent analyzes Go source files and creates a stdlib component
+func (e *Enhancer) createStdlibComponent(projectDir string) (map[string]interface{}, error) {
+	if projectDir == "" {
+		projectDir = "."
+	}
+
+	// Discover stdlib imports from Go source files
+	stdlibImports, err := e.discoverStdlibImports(projectDir)
+	if err != nil || len(stdlibImports) == 0 {
+		return nil, err
+	}
+
+	// Get Go version for the component
+	goVersion, _, err := e.manager.GetCurrentVersion()
+	if err != nil {
+		goVersion = "unknown"
+	}
+
+	// Create stdlib component in CycloneDX format
+	component := map[string]interface{}{
+		"type":        "library",
+		"name":        "golang-stdlib",
+		"version":     goVersion,
+		"purl":        fmt.Sprintf("pkg:golang/stdlib@%s", goVersion),
+		"bom-ref":     fmt.Sprintf("pkg:golang/stdlib@%s", goVersion),
+		"description": fmt.Sprintf("Go standard library packages used by this project (%d packages)", len(stdlibImports)),
+		"properties": []map[string]interface{}{
+			{
+				"name":  "goenv:stdlib_packages",
+				"value": strings.Join(stdlibImports, ","),
+			},
+			{
+				"name":  "goenv:stdlib_count",
+				"value": fmt.Sprintf("%d", len(stdlibImports)),
+			},
+		},
+	}
+
+	return component, nil
+}
+
+// discoverStdlibImports scans Go source files for stdlib imports
+func (e *Enhancer) discoverStdlibImports(projectDir string) ([]string, error) {
+	stdlibSet := make(map[string]bool)
+
+	// Walk through all .go files
+	err := filepath.Walk(projectDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return nil // Skip errors, continue walking
+		}
+
+		// Skip vendor and hidden directories
+		if info.IsDir() {
+			name := info.Name()
+			if name == "vendor" || name == "testdata" || strings.HasPrefix(name, ".") {
+				return filepath.SkipDir
+			}
+			return nil
+		}
+
+		// Only process .go files
+		if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+			return nil
+		}
+
+		// Parse the Go file
+		fset := token.NewFileSet()
+		node, err := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
+		if err != nil {
+			return nil // Skip files with parse errors
+		}
+
+		// Extract imports
+		for _, imp := range node.Imports {
+			importPath := strings.Trim(imp.Path.Value, `"`)
+
+			// Check if it's a stdlib package
+			if e.isStdlibPackage(importPath) {
+				stdlibSet[importPath] = true
+			}
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	// Convert set to sorted slice
+	stdlibImports := make([]string, 0, len(stdlibSet))
+	for pkg := range stdlibSet {
+		stdlibImports = append(stdlibImports, pkg)
+	}
+	sort.Strings(stdlibImports)
+
+	return stdlibImports, nil
+}
+
+// isStdlibPackage determines if an import path is from the Go standard library
+func (e *Enhancer) isStdlibPackage(importPath string) bool {
+	// Stdlib packages don't have dots in the first path element
+	// (except for some special cases like golang.org/x/...)
+
+	// Explicitly exclude known non-stdlib patterns
+	if strings.HasPrefix(importPath, "github.com/") ||
+		strings.HasPrefix(importPath, "golang.org/x/") ||
+		strings.HasPrefix(importPath, "gopkg.in/") ||
+		strings.HasPrefix(importPath, "go.uber.org/") ||
+		strings.Contains(importPath, ".com/") ||
+		strings.Contains(importPath, ".io/") ||
+		strings.Contains(importPath, ".org/") ||
+		strings.Contains(importPath, ".net/") {
+		return false
+	}
+
+	// Internal packages are not stdlib for third-party projects
+	if strings.HasPrefix(importPath, e.config.Root) {
+		return false
+	}
+
+	// Common stdlib packages (non-exhaustive, covers major ones)
+	firstSegment := importPath
+	if idx := strings.Index(importPath, "/"); idx > 0 {
+		firstSegment = importPath[:idx]
+	}
+
+	// Stdlib packages typically don't have dots
+	return !strings.Contains(firstSegment, ".")
+}
+
 // makeDeterministic ensures reproducible output
 func (e *Enhancer) makeDeterministic(sbom map[string]interface{}) {
 	// Sort components by name

internal/sbom/enhancer_test.go

@@ -4,7 +4,11 @@ import (
 	"encoding/json"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+
+	"github.com/go-nv/goenv/internal/config"
+	"github.com/go-nv/goenv/internal/manager"
 )
 
 func TestComputeSBOMDigest(t *testing.T) {
@@ -157,3 +161,74 @@ func TestGenerateDeterministicUUID(t *testing.T) {
 		t.Errorf("UUID too short: %s", uuid1)
 	}
 }
+
+func TestStdlibDetection(t *testing.T) {
+	tempDir := t.TempDir()
+
+	// Create a simple Go file with stdlib imports
+	goFile := `package main
+
+import (
+	"fmt"
+	"os"
+	"encoding/json"
+	"github.com/external/package"
+)
+
+func main() {
+	fmt.Println("test")
+}
+`
+	if err := os.WriteFile(filepath.Join(tempDir, "main.go"), []byte(goFile), 0644); err != nil {
+		t.Fatalf("Failed to write test file: %v", err)
+	}
+
+	// Create test SBOM
+	sbomPath := filepath.Join(tempDir, "sbom.json")
+	sbom := map[string]interface{}{
+		"bomFormat":   "CycloneDX",
+		"specVersion": "1.5",
+		"version":     1,
+		"components":  []interface{}{},
+	}
+	data, _ := json.MarshalIndent(sbom, "", "  ")
+	os.WriteFile(sbomPath, data, 0644)
+
+	// Test stdlib import discovery directly
+	enhancer := &Enhancer{
+		config:  &config.Config{Root: tempDir},
+		manager: &manager.Manager{},
+	}
+
+	stdlibImports, err := enhancer.discoverStdlibImports(tempDir)
+	if err != nil {
+		t.Fatalf("discoverStdlibImports failed: %v", err)
+	}
+
+	if len(stdlibImports) == 0 {
+		t.Fatal("Expected stdlib imports but got none")
+	}
+
+	// Check expected stdlib packages
+	expected := []string{"fmt", "os", "encoding/json"}
+	for _, exp := range expected {
+		found := false
+		for _, imp := range stdlibImports {
+			if imp == exp {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("Expected stdlib package %s not found", exp)
+		}
+	}
+
+	// Ensure external package is NOT detected as stdlib
+	for _, imp := range stdlibImports {
+		if strings.Contains(imp, "github.com") {
+			t.Errorf("External package %s incorrectly identified as stdlib", imp)
+		}
+	}
+
+}

scripts/test-stdlib/main.go

@@ -0,0 +1,62 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+
+	"github.com/go-nv/goenv/internal/config"
+	"github.com/go-nv/goenv/internal/manager"
+	"github.com/go-nv/goenv/internal/sbom"
+)
+
+func main() {
+	cfg := config.Load()
+	mgr := manager.NewManager(cfg)
+	enhancer := sbom.NewEnhancer(cfg, mgr)
+
+	// Test stdlib detection on current directory (goenv root)
+	projectDirBytes, err := exec.Command("git", "rev-parse", "--show-toplevel").Output()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error getting project directory: %v\n", err)
+		os.Exit(1)
+	}
+
+	if len(projectDirBytes) == 0 {
+		fmt.Fprintf(os.Stderr, "Could not determine project directory\n")
+		os.Exit(1)
+	}
+
+	projectDir := string(projectDirBytes)
+	opts := sbom.EnhanceOptions{
+		ProjectDir:    projectDir,
+		Deterministic: true,
+		EmbedDigests:  false,
+	}
+
+	// Enhance the test SBOM
+	sbomPath := fmt.Sprintf("%s/test-base-sbom.json", projectDir)
+	err = enhancer.EnhanceCycloneDX(sbomPath, opts)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error enhancing SBOM: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Read and display the enhanced SBOM
+	data, err := os.ReadFile(sbomPath)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error reading SBOM: %v\n", err)
+		os.Exit(1)
+	}
+
+	var sbomData map[string]interface{}
+	if err := json.Unmarshal(data, &sbomData); err != nil {
+		fmt.Fprintf(os.Stderr, "Error parsing SBOM: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Pretty print
+	pretty, _ := json.MarshalIndent(sbomData, "", "  ")
+	fmt.Println(string(pretty))
+}