🔍 SBOM Verifier for Go

🛡️ A tool to verify Go vulnerabilities from SBOM reports using symbol analysis

📖 Overview

SBOM Verifier for Go is an vulnerability verification tool PoC that goes beyond traditional SBOM scanning. It analyzes Go binaries at the symbol level to confirm whether reported vulnerabilities are actually present in the compiled binary, reducing false positives and providing more accurate security assessments.

✨ Key Features

• 🔬 Symbol-Level Analysis - Examines binary symbols to verify actual vulnerability presence
• 📊 SBOM Generation - Automatically generates Software Bill of Materials using Syft
• 🔒 Vulnerability Scanning - Scans for vulnerabilities using Grype
• ✅ Smart Verification - Cross-references vulnerable functions with binary symbols
• 📈 Clear Reporting - Provides detailed tables showing confirmed vs. potential vulnerabilities
• 🎯 Reduced False Positives - Identifies which vulnerabilities are truly exploitable in your binary

🚀 Quick Start

Prerequisites

Before using SBOM Verifier, ensure you have the following tools installed:

• 🐍 Python 3.13 or higher
• 🔧 Syft - SBOM generation tool
• 🔍 Grype - Vulnerability scanner
• 🛠️ Go toolchain (go tool command)

📦 Installation

1. Clone the repository:

git clone https://github.com/damaoooo/SBOMVerifierGoPoC.git
cd SBOMVerifierGo

2. Install Python dependencies:

pip install -r requirements.txt

3. Verify external tools are installed:

syft version
grype version
go version

💻 Usage

Basic Command

python -m src.main verify <binary-path> <go-mod-path>

Command Options

python -m src.main verify [OPTIONS] BINARY_PATH GO_MOD_PATH

Arguments:

• BINARY_PATH - Path to the Go binary to analyze (required)
• GO_MOD_PATH - Path to the Go module's go.mod file (required)

Options:

• -s, --sbom-output PATH - Path to save the generated SBOM file (default: ./report/syft_report.json)
• -r, --report-output PATH - Path to save the vulnerability report (default: ./report/grype_report.json)
• -v, --verbose - Enable verbose output for debugging
• --help - Show help message

📝 Examples

Example 1: Basic Verification

python -m src.main verify ./sample_go_program/sample_app ./sample_go_program/go.mod

Example 2: Verbose Mode

python -m src.main verify \
  ./sample_go_program/sample_app \
  ./sample_go_program/go.mod \
  --verbose

📊 Sample Output

+------------------+----------------------------+-----------------+---------------------+
|      CVE ID      |       Package Name         | Package Version | Confirmed in Binary |
+------------------+----------------------------+-----------------+---------------------+
| CVE-2023-xxxxx   | github.com/package/name    | v1.2.3          |         Yes         |
| CVE-2023-yyyyy   | github.com/another/package | v2.0.1          |         No          |
+------------------+----------------------------+-----------------+---------------------+
Total 2 unique vulnerabilities found in the SBOM report.
[+] Verification complete. 1 vulnerable functions found in the binary.

🔄 How It Works

The verification process consists of four main steps:

1. 🔨 SBOM Generation

   • Uses Syft to generate a comprehensive Software Bill of Materials from your Go module

2. 🔍 Vulnerability Scanning

   • Runs Grype against the SBOM to identify potential vulnerabilities

3. 🧬 Symbol Extraction

   • Extracts all symbols from the compiled Go binary using go tool nm

4. ✅ Cross-Reference Verification

   • Compares vulnerable functions from the CVE database with actual binary symbols
   • Confirms which vulnerabilities are truly present in the executable

📁 Project Structure

SBOMVerifierGo/
├── src/
│   ├── __init__.py          # Package initialization
│   ├── main.py              # CLI entry point
│   ├── binary_parser.py     # Binary symbol extraction
│   ├── go_database.py       # Go vulnerability database
│   ├── sbom_manager.py      # SBOM generation and scanning
│   └── verifier.py          # Vulnerability verification logic
├── sample_go_program/       # Sample Go application for testing
├── report/                  # Generated reports directory
├── requirements.txt         # Python dependencies
├── go_vuln.db              # Local vulnerability database
└── README.md               # This file

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Acknowledgments

• Syft - SBOM generation
• Grype - Vulnerability scanning
• Go Vulnerability Database - CVE data source

📞 Contact

If you have any questions or suggestions, please open an issue on GitHub.