src.agwa.name/deepscan is a Go library that recursively descends into archives and repositories, executing a given function for every file that it finds. It's extensible, allowing you to add support for your own URL schemes and archive formats.

By default, the library does not support any archives or repository formats. To include support for a particular format, you must import the appropriate package, typically with a blank package name. For example, to include support for common archive formats:

import _ "src.agwa.name/deepscan/archives"

govulncheck-deep is a command line program that runs govulncheck on every Go binary it can find at a specified URL, descending into archives as needed. There are other programs that do deep vulnerability scanning, but they don't use govulncheck so they return many false positives.

For example, if you have an S3 bucket of tarballs containing Go binaries, you can run the following command to check them for vulnerabilities:

govulncheck-deep s3://mybucket

The argument must be a URL with one of the supported schemes listed below.

If govulncheck finds a vulnerability, the path to the binary is written to stdout followed by the output of govulncheck. If no vulnerabilities are found, nothing is written to stdout.

To install govulncheck-deep, run:

go install src.agwa.name/deepscan/cmd/govulncheck-deep@latest

By default, govulncheck-deep includes support for all archive formats and URL schemes. To omit support for a particular format, use one of the following build tags:

• omit_aws -- exclude AWS support (S3 and Lambda)
• omit_debian -- exclude Debian support (.deb files and APT repos)
• omit_all -- exclude all of the above

If you use omit_all, you can add back support with one of the following build tags:

• include_aws
• include_debian

For example:

go install -tags omit_aws src.agwa.name/deepscan/cmd/govulncheck-deep@latest
go install -tags omit_all,include_debian src.agwa.name/deepscan/cmd/govulncheck-deep@latest

Using these build tags, you can minimize the binary size and third-party dependencies.

• .deb
• .tar
• .tar.bz2
• .tar.gz
• .tgz
• .zip

• apt+http://, apt+https:// -- followed by a hostname and path to an APT repository; see the documentation for more information
• file:// -- followed by a path to a file or directory
• lambda:// -- to deep scan all AWS Lambda functions
• s3:// -- followed by the name of an S3 bucket