Failed to load stdlib module when executing cyclonedx-gomod

[emacampolo]

The issue I'm facing is that I have a CI with Go 1.21 that tries to generate the bom for an application that requires Go 1.22.
The error I get is the following:

~ cyclonedx-gomod app -verbose -json=true -main ./cmd/server
12:29AM DBG loading modules moduleDir=.
12:29AM DBG executing command cmd="/usr/local/go/bin/go list -deps -json ./cmd/cli/" dir=.
12:29AM DBG executing command cmd="/usr/local/go/bin/go env -json" dir=
12:29AM DBG loading module moduleDir=/Users/ecampolo/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.0.darwin-arm64/src
12:29AM DBG executing command cmd="/usr/local/go/bin/go list -mod readonly -json -m" dir=/Users/ecampolo/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.0.darwin-arm64/src
12:29AM ERR error="failed to load modules: failed to convert packages to modules: failed to load stdlib module: failed to load stdlib module: listing module failed: command `/usr/local/go/bin/go list -mod readonly -json -m` failed: exit status 1"

While I'm not sure if it's a bug, the following behavior presents frictions with respect to the new policy in which Go 1.21+ version try to compile newer versions.

My goal is not to have to update de go version every time a release occur since now Go 1.21 and later will not try to compile code that requires a newer version of Go but instead download the corresponding toolchain.

[nscuro]

There is nothing in cdx-gomod that relies on specific versions of Go, as it merely orchestrates calls to the go binary in the environment.

To my understanding, merely listing modules should not build anything, but download sources of all dependencies in involved. So it's definitely odd if you're now getting errors due to builds failing.

Can you try running the /usr/local/go/bin/go list -mod readonly -json -m command manually, in the /Users/ecampolo/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.0.darwin-arm64/src directory? Do you get any additional output?

[emacampolo]

~/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.22.0.darwin-arm64/src /usr/local/go/bin/go list -mod readonly -json -m                                                                    
go: downloading go1.22 (darwin/arm64)
go: download go1.22 for darwin/arm64: toolchain not available

Although not the same, it may be related to golang/go#62278 when executing a go command in the goroot.

[groboclown]

I found I needed to make several improvements to get it to run right in my environment.

1. My go.mod had a toolchain line that wasn't compatible with the different build systems it ran on. I had to bump this back to toolchain 1.21.0 from toolchain 1.22
2. Based on the related tidy issue (thanks, @emacampolo), it led me to running go mod tidy, which allowed the command to pass.