aboutcode-org / scancode-toolkit

:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!
https://github.com/aboutcode-org/scancode-toolkit/releases/
2.11k stars 546 forks source link

Support directives in go.mod #3492

Open pombredanne opened 1 year ago

pombredanne commented 1 year ago

Short Description

We do not support all go.mod features such as replace directives in go.mod files and we should. See:

And an example see https://github.com/golang/tools/blob/9425c2e70961cb8c2a3b5764658fb70e03d194e4/gopls/go.mod and https://github.com/golang/tools/blob/9425c2e70961cb8c2a3b5764658fb70e03d194e4/go.mod

shravankshenoy commented 7 months ago

Hey @pombredanne and @AyanSinhaMahapatra, I have raised a PR for the replace directive, but had doubts regardings the best way to approach some of the the things, listed below. Would it be possible to share some suggestions on how to best approach these?

  1. What should be the scope for the original and replaced modules? Would replace be fine for both of them or should one be require and other be replace?

  2. If a package is in both require and replace directives, we will have 2 instances of the same package listed? Is that ok or is there a way to deal with that?
    For example in the go.mod of milvus (added in the PR), packages like github.com/expr-lang/expr and github.com/streamnative/pulsarctl are there both in the require as well in replace directives. This might be a very common scenario, as many a times a go developer might want to test an application with a local version or forked version of a dependency package, rather than using the original package

  3. How do we deal with the replacement package if the replacement points to a local path like replace github.com/milvus-io/milvus/pkg => ./pkg ? `