securego
Use multiple output formats
Summary
I want multiple output formats to be generated + stdout format while running the gosec.
Steps to reproduce the behavior
GO111MODULE=on ./bin/gosec -fmt=text -out=text.txt -fmt=json -out=result.json ./...
gosec version
latest
Go version (output of 'go version')
v1.16
Operating system / Environment
Expected behavior
All provided formats need to be generated with stdout
Actual behavior
Only last -out is been generated
What's wrong with looping on the tool call, like in the following pseudo-code ?
runs = [{"fmt" :"text", "out" :"file.txt" }, {"fmt" :"json", "out" :"file.json" } ]
for run in runs
GO111MODULE=on ./bin/gosec -fmt=run.fmt -out=run.out
cat run.out
endfor
Allowing what you are asking seems to be against the SRP.
I agree, but in my opinion, running the analysis twice just to generate multiple file format isn’t the best approach! Where we can always save the output in different format!
And also running it multiple times creates multiple [gosec] logs
[gosec] 2021/05/08 20:44:07 Checking package: yaml < 1st time
[gosec] 2021/05/08 20:44:07 Checking file: /Users/shreyas.subhedar/Documents/GitHub/gosec/report/yaml/writer.go
[gosec] 2021/05/08 20:44:07 Import directory: /Users/shreyas.subhedar/Documents/GitHub/gosec
[gosec] 2021/05/08 20:44:07 Checking package: gosec
[gosec] 2021/05/08 20:44:07 Checking package: yaml < 2nd time
[gosec] 2021/05/08 20:44:07 Checking file: /Users/shreyas.subhedar/Documents/GitHub/gosec/report/yaml/writer.go
[gosec] 2021/05/08 20:44:07 Import directory: /Users/shreyas.subhedar/Documents/GitHub/gosec
[gosec] 2021/05/08 20:44:07 Checking package: gosec
If you allow multiple kind of output then you may have to change the command parameters to look like -json=file.json -sarif=report.sarif...
Having multiple logs for the same analysis seems too much indeed. But another idea would be to implement a command to convert from json to any other format. So there would be only one analysis which would output a json file and then a call to the convert command for every other format you might need.
It would make sense to converted to cobra, but I would create another issue for this work.
Closing this since it can be handled with a script, and is not cleared what is the value of supporting this feature in gosec. Thanks