# Go licenses are not generating with the version 1.11.0 **URL:** \ **Category:** Syft\ **Created:** [August 20, 2024, 10:47am UTC](https://anchorecommunity.discourse.group/t/go-licenses-are-not-generating-with-the-version-1-11-0/81 "2024-08-20T10:47:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![anvitha\_haviligi](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/anvitha_haviligi/32/75_2.png) [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\ **Post date:** [August 20, 2024, 10:47am UTC](https://anchorecommunity.discourse.group/t/go-licenses-are-not-generating-with-the-version-1-11-0/81/1 "2024-08-20T10:47:31Z")
Go licenses are not generating with the version 1.11.0 even though cache directory is created and it hangs Used below command to generate SBOM for GO binaries, Our network is behind proxy, so exported proxy and tried below command but nothing is downloaded in syft-cache directory and licenses are not generated for go binaries. ```shell SYFT_GOLANG_LOCAL_MOD_CACHE_DIR=~/syft-cache SYFT_GOLANG_SEARCH_LOCAL_MOD_CACHE_LICENSES=true SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true SYFT_JAVASCRIPT_SEARCH_REMOTE_LICENSES=true syft scan -o cyclonedx-json ``` Image size : 3.2 GB Please do the needful. Thanks, Anvitha ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [August 20, 2024, 2:38pm UTC](https://anchorecommunity.discourse.group/t/go-licenses-are-not-generating-with-the-version-1-11-0/81/2 "2024-08-20T14:38:02Z")
Hi @anvitha_haviligi, if you run with `-vvv` are you able to see any activity or get further insight where things seem to get stuck? I suspect the proxy is the issue here – Syft should be using the standard Go proxy environment variable: `HTTP_PROXY`. How did you configure this? Just making sure you did not use `SYFT_GOLANG_PROXY`, which is for specifying any GOPROXY settings, not HTTP proxy configuration. ---
**Author:** ![anvitha\_haviligi](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/anvitha_haviligi/32/75_2.png) [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\ **Post date:** [August 20, 2024, 4:07pm UTC](https://anchorecommunity.discourse.group/t/go-licenses-are-not-generating-with-the-version-1-11-0/81/3 "2024-08-20T16:07:59Z")
Hi, Thanks for the reply. Im doing export `HTTP_PROXY="http://[ipv6]:portnumber"`. Im getting below errors in debug mode. ```auto [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/beorn7/perks@v1.0.1/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/bgentry/speakeasy@v0.1.0/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/cespare/xxhash/v2@v2.2.0/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/coreos/go-semver@v0.3.0/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/coreos/go-systemd/v22@v22.3.2/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/cpuguy83/go-md2man/v2@v2.0.0/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/dustin/go-humanize@v1.0.0/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/gogo/protobuf@v1.3.2/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/golang-jwt/jwt/v4@v4.4.2/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/golang/protobuf@v1.5.3/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/google/btree@v1.0.1/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/jonboulle/clockwork@v0.2.2/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/json-iterator/go@v1.1.11/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/mattn/go-runewidth@v0.0.9/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/matttproud/golang_protobuf_extensions@v1.0.1/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/modern-go/reflect2@v1.0.1/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/olekukonko/tablewriter@v0.0.5/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/prometheus/client_golang@v1.11.1/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/prometheus/client_model@v0.2.0/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/prometheus/common@v0.26.0/#.: open .: no such file or directory [0007] DEBUG error reading file://$GOPATH/pkg/mod/github.com/prometheus/procfs@v0.6.0/#.: open .: no such file or directory ``` ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [August 20, 2024, 4:42pm UTC](https://anchorecommunity.discourse.group/t/go-licenses-are-not-generating-with-the-version-1-11-0/81/4 "2024-08-20T16:42:29Z")
Thanks, those errors are all expected – I’m assuming you don’t have those packages locally in your `~/go/pkg/mod` directory (everything which indicates `$GOPATH` is looking there). Sadly, it looks like I may have omitted some important logging for the network side of things. I’m not sure it will necessarily help, but I fixed that and [the latest version of Syft](https://github.com/anchore/syft/releases/tag/v1.11.1) now includes some info logging (which needs at least `-v` to display). If it seems to hang on something like: ```auto [0010] INFO downloading go module from proxy url=https://proxy.golang.org/github.com/spf13/cast/@v/v1.6.0.zip ``` We can probably at least tell there is some network issue, which would confirm your original post. The next step might be to see if you can craft a cURL command to download the same URL with appropriate proxy settings and run this in the environment you are running Syft. ---
**Author:** ![anvitha\_haviligi](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/anvitha_haviligi/32/75_2.png) [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\ **Post date:** [August 21, 2024, 2:19am UTC](https://anchorecommunity.discourse.group/t/go-licenses-are-not-generating-with-the-version-1-11-0/81/5 "2024-08-21T02:19:35Z")
> [@kzantow](#): > > ```auto > https://proxy.golang.org/github.com/spf13/cast/@v/v1.6.0.zip > > ``` Yes im able to download manually with the proxy, below is the output. wget [https://proxy.golang.org/github.com/spf13/cast/@v/v1.6.0.zip](https://proxy.golang.org/github.com/spf13/cast/@v/v1.6.0.zip) –2024-08-20 20:45:16-- [https://proxy.golang.org/github.com/spf13/cast/@v/v1.6.0.zip](https://proxy.golang.org/github.com/spf13/cast/@v/v1.6.0.zip) Connecting to [proxyaddress]:3128… connected. Proxy request sent, awaiting response… 200 OK Length: 18029 (18K) [application/zip] Saving to: ‘v1.6.0.zip’ v1.6.0.zip 100%[==========================================\>] 17.61K --.-KB/s in 0.01s 2024-08-20 20:45:17 (1.31 MB/s) - ‘v1.6.0.zip’ saved [18029/18029] ---
**Author:** ![anvitha\_haviligi](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/anvitha_haviligi/32/75_2.png) [@anvitha\_haviligi](https://anchorecommunity.discourse.group/u/anvitha_haviligi)\ **Post date:** [August 21, 2024, 2:39am UTC](https://anchorecommunity.discourse.group/t/go-licenses-are-not-generating-with-the-version-1-11-0/81/6 "2024-08-21T02:39:21Z")
Hi @kzantow , Just for testing i have downgraded syft version to 0.105.1 and tested. it worked, All directories are downloaded, below is the output. > **[GitHub: Let’s build from here](https://github.com)** > > GitHub is where over 100 million developers shape the future of software, together. Contribute to the open source community, manage your Git repositories, review code like a pro, track bugs and fea... [go.etcd.io](http://go.etcd.io) [go.opentelemetry.io](http://go.opentelemetry.io) > **[The Go Programming Language](https://go.dev/)** > > Go is an open source programming language that makes it simple to build secure, scalable systems. gopkg.in [go.uber.org](http://go.uber.org) [go4.org](http://go4.org) > **[google.golang.org package listing  |  Google Cloud](https://cloud.google.com/go/google.golang.org)** inet.af ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [August 21, 2024, 4:11pm UTC](https://anchorecommunity.discourse.group/t/go-licenses-are-not-generating-with-the-version-1-11-0/81/7 "2024-08-21T16:11:32Z")
> [@anvitha\_haviligi](#): > > `SYFT_GOLANG_LOCAL_MOD_CACHE_DIR=~/syft-cache ` Sorry I missed this earlier, but you probably wanted to use use: `SYFT_CACHE_DIR=~/syft-cache`. _If you’ve run a go build, and go has downloaded the modules already_ is when you may want to use that mod cache, in which case you would use: `SYFT_GOLANG_SEARCH_LOCAL_MOD_CACHE_LICENSES=true`, by default this will look in `$GOPATH/pkg/mod`, where GOPATH defaults to `~/go`. You only need to specify `SYFT_GOLANG_LOCAL_MOD_CACHE_DIR` if you have some configuration where go has downloaded modules to some alternate location and you want to use those to resolve license information. If you are scanning things where there has not been a go build run, searching the local go mod cache won’t help much, so you could probably just use `SYFT_GOLANG_SEARCH_REMOTE_LICENSES=true` ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [August 21, 2024, 4:52pm UTC](https://anchorecommunity.discourse.group/t/go-licenses-are-not-generating-with-the-version-1-11-0/81/8 "2024-08-21T16:52:50Z")
While investigating this, one thing I scanned was `golang:latest`, which has a lot of go binaries with `(devel)` versions and go library packages like `cmd`, I see a lot of errors where Syft attempts to blindly resolve these to repositories, e.g.: ```auto {"err":"Get \"https://cmd/cgo/info/refs?service=git-upload-pack\": dial tcp: lookup cmd: no such host -- "} ``` This means there could be a number of DNS lookups for things like `cmd`, is this something that might be very slow with your network configuration? I created this issue to help prevent known erroneous package lookups: [golang remote license search attempts to resolve stdlib modules · Issue #3149 · anchore/syft · GitHub](https://github.com/anchore/syft/issues/3149)