tree f149d62ca78bf7c48bba7411132dc608eace01d0
parent 9ee089fe0d9200c12182206d10d4486c6a413cd1
author He Gao <hegao@google.com> 1676658606 +0000
committer He Gao <hegao@google.com> 1677714675 +0000

hooks/install: Use go-licenses to get go dependencies for SBOM

In order to find licenses for each Go dependency,
https://github.com/google/go-licenses is used.

go-licenses is able to fetch collection of libraries
used by the package, directly or transitively. So
we only need to find which directory contains a
main function (not necessarily main.go) and then
run the rool on it to get dependencies and their
licenses of all executables.

This will give us more dependencies than needed
because we sometimes don't compile all the executables.
But more is better than less.

BUG=b/254334533
TEST=presubmite
RELEASE_NOTE=None

Change-Id: I84510ef2ff7b2511b33ca2140b953859f1ea89cc
Reviewed-on: https://cos-review.googlesource.com/c/third_party/platform/crosutils/+/42887
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>