go binary sbom

[prabhu]

Refer to the changes in bintests but pretty much all go binaries are supported.

[timmyteo]

Hi @prabhu running this branch on Windows against the Windows syft binary .exe produces the following BOM. I am not seeing any of the expected dependencies.
bom.json

[prabhu]

@timmyteo, thanks for reporting this bug. Please use the latest to test for all OS and compare against the official sbom published here

[timmyteo]

Syft Testing: Windows .exe is looking good now. I tried against the .deb file and the binary for darwin, and the outcome is not what I would have expected, see attached. Am I correct in directly testing these binary files?
linux_deb_bom.json
darwin_bom.json

[saketjajoo]

/path/to/go-binaries ?

[prabhu]

Syft Testing: Windows .exe is looking good now. I tried against the .deb file and the binary for darwin, and the outcome is not what I would have expected, see attached. Am I correct in directly testing these binary files? linux_deb_bom.json darwin_bom.json

deb file is not supported so use the .tar.gz versions. For darwin, the sbom generated looks good. Any ideas which components are missing when compared with the official sbom? Compare only the components and dependencies attributes in the sbom.

[timmyteo]

Nice work Prabhu! I didn't perform a complete 1:1 comparison as there are many dependencies in Syft, but I checked about 30 and all were in both SBOM as expected. I am thinking this is looking good.

[prabhu]

@timmyteo, Thank you so much. Could you also recheck dotnet for any regressions since I changed the hash detection logic.

[timmyteo]

dotnet looks good still!