feat: add golang patching

[robert-cronin]

Closes #1386

[codecov]

Codecov Report

❌ Patch coverage is 30.07986% with 788 lines in your changes missing coverage. Please review.
✅ Project coverage is 36.61%. Comparing base (cf9e44c) to head (f92e9a3).

Files with missing lines	Patch %	Lines
pkg/langmgr/golang.go	11.30%	414 Missing and 2 partials ⚠️
pkg/provenance/rebuilder.go	39.30%	234 Missing and 10 partials ⚠️
pkg/provenance/detector.go	48.95%	95 Missing and 3 partials ⚠️
pkg/patch/core.go	0.00%	15 Missing ⚠️
pkg/patch/single.go	16.66%	10 Missing ⚠️
pkg/cmd/cmd.go	83.33%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1388      +/-   ##
==========================================
- Coverage   37.70%   36.61%   -1.10%     
==========================================
  Files          52       55       +3     
  Lines        7505     8587    +1082     
==========================================
+ Hits         2830     3144     +314     
- Misses       4447     5200     +753     
- Partials      228      243      +15     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[robert-cronin]

Demo with fluxcd/source-controller

❯ COPA_EXPERIMENTAL=1 ./dist/linux_amd64/release/copa patch \
  -i ghcr.io/fluxcd/source-controller:v1.2.0 \
  -r /tmp/flux-scan.json \
  -t flux-patched-final \
  --enable-go-binary-rebuild \
  --pkg-types library \
  --ignore-errors
INFO[0000] Patched image name: ghcr.io/fluxcd/source-controller:flux-patched-final 
[+] Building 0.8s (1/1)                                                                                                                                                                             
 => resolve image config for docker-image://ghcr.io/fluxcd/source-controller:v1.2.0                                                                                                            0.8s
WARN[0001] No update packages were specified to apply   
INFO[0001] Found 22 Go package updates to process       
ERRO[0001] Invalid package name stdlib: stdlib vulnerabilities require Go version upgrade, not supported: stdlib 
INFO[0001] Go binary rebuilding is enabled (experimental) 
[+] Building 3.9s (1/1)                                                                                                                                                                             
 => resolve image config for docker-image://ghcr.io/fluxcd/source-controller:v1.2.0                                                                                                            0.8s
INFO[0005] Successfully fetched SLSA provenance for ghcr.io/fluxcd/source-controller:v1.2.0 (level: 2, type: https://slsa.dev/provenance/v0.2) 
INFO[0005] SLSA provenance incomplete (missing: [Dockerfile build command base image Go version]), will try binary detection 
[+] Building 4.5s (1/3)                                                                                                                                                                             
 => resolve image config for docker-image://ghcr.io/fluxcd/source-controller:v1.2.0                                                                                                            1.0s
 => docker-image://ghcr.io/fluxcd/source-controller:v1.2.0                                                                                                                                     0.3s
[+] Building 6.7s (5/5)                                                                                                                                                                             
[+] Building 6.9s (5/5) FINISHED                                                                                                                                                                    
 => resolve image config for docker-image://ghcr.io/fluxcd/source-controller:v1.2.0                                                                                                            1.0s
 => CACHED docker-image://ghcr.io/fluxcd/source-controller:v1.2.0                                                                                                                              0.3s
 => => resolve ghcr.io/fluxcd/source-controller:v1.2.0                                                                                                                                         0.3s
 => CACHED sh -c if command -v go >/dev/null 2>&1; then echo ok > /copa-go-check; fi                                                                                                           0.0s
 => CACHED sh -c paths=""; for dir in /app /go/src /usr/src/app /workspace /src /opt/app; do if [ -f "$dir/go.mod" ]; then paths="$paths $dir"; fi; done; if [ -z "$paths" ]; then paths=$(fi  0.0s
 => exporting to docker image format                                                                                                                                                           2.0s
 => => exporting layers                                                                                                                                                                        0.0s
 => => exporting manifest sha256:fc10504cafc225e365efc7107d50003e33ee162f705fd1273774b1357e2f1fcd                                                                                              0.0s
 => => exporting config sha256:6a4dfed58d6c390c4311fe6e222c2e80127d6824adc1d456d792b856196e9e87                                                                                                0.0s
 => => sending tarball                                                                                                                                                                         1.9s
INFO[0007] found local image descriptor for ghcr.io/fluxcd/source-controller:flux-patched-final via docker 
INFO[0008] Patched image (linux/amd64): ghcr.io/fluxcd/source-controller:flux-patched-final 

[ashnamehrotra]

@robert-cronin I tested this with the following but I am still seeing 86 vulns in the patched image, is there anything I'm missing?

trivy image --vuln-type library --ignore-unfixed ghcr.io/fluxcd/source-controller:v1.2.0 -f json -o amd64.json --platform linux/amd64
trivy image --vuln-type library --ignore-unfixed ghcr.io/fluxcd/source-controller:v1.2.0 -f json -o arm64.json --platform linux/arm64
COPA_EXPERIMENTAL=1 ./copa patch -i ghcr.io/fluxcd/source-controller:v1.2.0 -r /Users/ashnamehrotra/copacetic/test-reports --go-stdlib-upgrade --pkg-types library --ignore-errors --debug

[robert-cronin]

@robert-cronin I tested this with the following but I am still seeing 86 vulns in the patched image, is there anything I'm missing?

trivy image --vuln-type library --ignore-unfixed ghcr.io/fluxcd/source-controller:v1.2.0 -f json -o amd64.json --platform linux/amd64 trivy image --vuln-type library --ignore-unfixed ghcr.io/fluxcd/source-controller:v1.2.0 -f json -o arm64.json --platform linux/arm64 COPA_EXPERIMENTAL=1 ./copa patch -i ghcr.io/fluxcd/source-controller:v1.2.0 -r /Users/ashnamehrotra/copacetic/test-reports --go-stdlib-upgrade --pkg-types library --ignore-errors --debug

i think fluxcd/source-controller is one of the images that doesn't have VCS commit info embedded in the binary (likely built with .git excluded from the docker build context). without the commit hash, we can't clone the source repo to rebuild. i added some documentation on this limitation here: https://github.com/project-copacetic/copacetic/blob/feat/golang-patching/website/docs/app-level-patching.md#key-requirement-vcs-commit-hash

this is also something we should probably surface more clearly in the copa output itself, maybe as part of #1451.

if you want to test with an image that works, try docker.io/prom/pushgateway:v1.11.2 i just tested and it goes from 8 vulns to 0 with --library-patch-level minor:

trivy image --vuln-type library --ignore-unfixed docker.io/prom/pushgateway:v1.11.2 -f json -o scan.json --platform linux/amd64
COPA_EXPERIMENTAL=1 copa patch -i docker.io/prom/pushgateway:v1.11.2 -r scan.json --go-stdlib-upgrade --pkg-types library --library-patch-level minor --ignore-errors -t pushgateway-patched

[sozercan]

don't use alpine

match to binary's go version

[sozercan]

lets make this more generic with toolchain-patch-level or similar