How does Kevlar-CheckDeps differ from govulncheck?

govulncheck requires installing the Go toolchain and compiling binaries. Kevlar-CheckDeps is a zero-dependency CLI that parses go.mod and go.sum natively using Python stdlib and batch querying Google OSV DB.

Do I need the Go compiler installed to scan go.mod and go.sum?

No. Kevlar-CheckDeps parses static go.mod and go.sum text files directly without needing `go` installed.

Can Kevlar-CheckDeps break CI/CD builds for vulnerable Go modules?

Yes. Kevlar-CheckDeps supports --fail-on-vulns to break GitHub Actions or GitLab CI pipelines upon detecting critical or high vulnerabilities.

⚡ Go Ecosystem SCA CLI

Go Dependency Audit CLI: Fast, Zero-Dependency SCA for Go Modules

Audit direct and transitive Go dependencies, detect vulnerabilities in the Google OSV database, and validate go.sum checksum integrity—without Go compiler binaries or API keys.

$ python kevlar.py --tech golang --path ./my-go-app --all --vuls

Go Modules (`go.mod`) Checksum Database (`go.sum`)

bash - kevlar-checkdeps (golang)

user@devsecops ~/my-go-app

$ python kevlar.py --tech golang --path . --all --vuls

[INFO] Detected Ecosystem: Go (Go Modules)

[INFO] Reading go.mod & go.sum...

[INFO] Checking 52 Go modules against Google OSV DB...

[INFO] Validating h1: SHA-256 tree hashes...

[OK] Checked: 52 modules in 0.64s. 0 Vulns Found.

Status: ✅ PASS

The Problem with Traditional SCA Tools in Go

Why do tools like govulncheck introduce setup overhead into containerized CI pipelines?

Traditional Tools

(govulncheck / nancy)

Limitations

Requires Go Compiler Toolchain

Requires installing full Go compiler binary toolchain inside CI runners just to analyze manifest files.

Kevlar-CheckDeps

(Go Audit)

Solution

Zero Go Toolchain Needed

Executes standalone via Python stdlib, parsing go.mod and go.sum text files directly.

Quick Usage Guide & Practical Example

How to run local scans, export executable reports, and integrate Kevlar into your CI/CD pipeline.

Full Local Scan

Audit direct and transitive Go dependencies querying Google OSV DB:

Scan Command:


                                        $ python kevlar.py --tech golang --path ./ --all --vuls

Export HTML / SARIF

Generate interactive HTML dashboards or standard SARIF v2.1.0 reports:

Report HTML:


                                            $ python kevlar.py --tech golang --path ./ --all --vuls --output report.html

Report SARIF:


                                            $ python kevlar.py --tech golang --path ./ --all --vuls --output report.sarif

CI/CD Build Breaking

Fail CI/CD pipelines automatically if severe vulnerabilities are detected:

Pipeline Command:


                                        $ python kevlar.py --tech golang --path ./ --all --vuls --fail-on-vulns "critical:1,high:2"

Frequently Asked Questions (FAQ)

Quick answers to common questions about Go dependency auditing.