>>> gosec: Building community/gosec 2.28.0-r1 (using abuild 3.18.0_rc7-r1) started Fri, 23 Oct 2026 14:53:38 +0000 >>> gosec: Validating /home/buildozer/aports/community/gosec/APKBUILD... >>> gosec: Analyzing dependencies... >>> gosec: Installing for build: build-base go (1/2) Installing go (1.27.3-r0) (2/2) Installing .makedepends-gosec (20261023.145338) Executing busybox-1.38.0-r7.trigger OK: 462.2 MiB in 107 packages >>> gosec: Cleaning up srcdir >>> gosec: Cleaning up pkgdir >>> gosec: Cleaning up tmpdir >>> gosec: Fetching https://distfiles.alpinelinux.org/distfiles/edge/gosec-2.28.0.tar.gz Connecting to distfiles.alpinelinux.org (172.105.82.32:443) saving to '/var/cache/distfiles/edge/gosec-2.28.0.tar.gz.part' gosec-2.28.0.tar.gz. 100% |********************************| 380k 0:00:00 ETA '/var/cache/distfiles/edge/gosec-2.28.0.tar.gz.part' saved /var/cache/distfiles/edge/gosec-2.28.0.tar.gz: OK >>> gosec: Fetching https://distfiles.alpinelinux.org/distfiles/edge/gosec-2.28.0.tar.gz /var/cache/distfiles/edge/gosec-2.28.0.tar.gz: OK >>> gosec: Unpacking /var/cache/distfiles/edge/gosec-2.28.0.tar.gz... fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git make build fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git make[1]: Entering directory '/home/buildozer/aports/community/gosec/src/gosec-2.28.0' fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git go build -ldflags " -X 'main.Version=' -X 'main.GitTag=' -X 'main.BuildDate=2026-10-23T14:53:39Z'" -o gosec ./cmd/gosec/ fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git go: downloading go.yaml.in/yaml/v3 v3.0.4 go: downloading github.com/google/uuid v1.6.0 go: downloading google.golang.org/genai v1.63.0 go: downloading github.com/anthropics/anthropic-sdk-go v1.57.0 go: downloading github.com/openai/openai-go/v3 v3.42.0 go: downloading github.com/gookit/color v1.6.1 go: downloading golang.org/x/sync v0.22.0 go: downloading golang.org/x/tools v0.48.0 go: downloading github.com/ccojocar/zxcvbn-go v1.0.4 go: downloading github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e go: downloading cloud.google.com/go/auth v0.21.0 go: downloading github.com/google/go-cmp v0.7.0 go: downloading github.com/gorilla/websocket v1.5.3 go: downloading cloud.google.com/go v0.123.0 go: downloading github.com/tidwall/sjson v1.2.5 go: downloading github.com/invopop/jsonschema v0.14.0 go: downloading github.com/standard-webhooks/standard-webhooks/libraries v0.0.1 go: downloading github.com/tidwall/gjson v1.19.0 go: downloading github.com/pb33f/ordered-map/v2 v2.3.1 go: downloading go.yaml.in/yaml/v4 v4.0.0-rc.6 go: downloading github.com/bahlo/generic-list-go v0.2.0 go: downloading github.com/buger/jsonparser v1.2.0 go: downloading github.com/tidwall/pretty v1.2.1 go: downloading github.com/tidwall/match v1.2.0 go: downloading github.com/googleapis/gax-go/v2 v2.23.0 go: downloading cloud.google.com/go/compute/metadata v0.9.0 go: downloading google.golang.org/api v0.288.0 go: downloading google.golang.org/grpc v1.82.0 go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 go: downloading go.opentelemetry.io/otel/trace v1.44.0 go: downloading golang.org/x/net v0.57.0 go: downloading go.opentelemetry.io/otel v1.44.0 go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.18 go: downloading github.com/google/s2a-go v0.1.9 go: downloading go.opentelemetry.io/otel/metric v1.44.0 go: downloading github.com/felixge/httpsnoop v1.1.0 go: downloading google.golang.org/protobuf v1.36.11 go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 go: downloading golang.org/x/crypto v0.54.0 go: downloading golang.org/x/mod v0.38.0 go: downloading golang.org/x/text v0.40.0 go: downloading github.com/go-logr/logr v1.4.3 go: downloading github.com/go-logr/stdr v1.2.2 go: downloading go.opentelemetry.io/auto/sdk v1.2.1 go: downloading github.com/cespare/xxhash/v2 v2.3.0 go: downloading golang.org/x/sys v0.47.0 make[1]: Leaving directory '/home/buildozer/aports/community/gosec/src/gosec-2.28.0' go: downloading github.com/onsi/ginkgo/v2 v2.32.0 go: downloading github.com/Masterminds/semver/v3 v3.5.0 go: downloading github.com/go-task/slim-sprig/v3 v3.0.0 go: downloading github.com/google/pprof v0.0.0-20260709232956-b9395ee17fa0 go: downloading github.com/onsi/gomega v1.42.1 go: downloading github.com/stretchr/testify v1.11.1 go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 go: downloading gopkg.in/yaml.v3 v3.0.1 go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc Running Suite: gosec Suite - /home/buildozer/aports/community/gosec/src/gosec-2.28.0 ==================================================================================== Random Seed: 1792767276 Will run 289 of 289 specs ------------------------------ Configuration when loading from disk should be possible to load configuration from a file github.com/securego/gosec/v2/config_test.go:20 • [0.000 seconds] ------------------------------ Configuration when loading from disk should return an error if configuration file is invalid github.com/securego/gosec/v2/config_test.go:28 • [0.000 seconds] ------------------------------ Configuration when saving to disk should be possible to save an empty configuration to file github.com/securego/gosec/v2/config_test.go:41 • [0.000 seconds] ------------------------------ Configuration when saving to disk should be possible to save configuration to file github.com/securego/gosec/v2/config_test.go:50 • [0.001 seconds] ------------------------------ Configuration when configuring rules should be possible to get configuration for a rule github.com/securego/gosec/v2/config_test.go:64 • [0.000 seconds] ------------------------------ Configuration when using global configuration options should have a default global section github.com/securego/gosec/v2/config_test.go:78 • [0.001 seconds] ------------------------------ Configuration when using global configuration options should save global settings to correct section github.com/securego/gosec/v2/config_test.go:85 • [0.000 seconds] ------------------------------ Configuration when using global configuration options should find global settings which are enabled github.com/securego/gosec/v2/config_test.go:100 • [0.000 seconds] ------------------------------ Configuration when using global configuration options should parse the global settings of type string from file github.com/securego/gosec/v2/config_test.go:107 • [0.001 seconds] ------------------------------ Configuration when using global configuration options should parse the global settings of other types from file github.com/securego/gosec/v2/config_test.go:122 • [0.000 seconds] ------------------------------ Configuration when managing exclude rules should set and get exclude rules github.com/securego/gosec/v2/config_test.go:140 • [0.000 seconds] ------------------------------ Configuration when managing exclude rules should handle empty exclude rules github.com/securego/gosec/v2/config_test.go:156 • [0.000 seconds] ------------------------------ Configuration when managing exclude rules should overwrite previous exclude rules github.com/securego/gosec/v2/config_test.go:164 • [0.000 seconds] ------------------------------ Configuration when managing exclude rules should persist exclude rules in configuration github.com/securego/gosec/v2/config_test.go:179 • [0.000 seconds] ------------------------------ Configuration when managing exclude rules should handle nil configuration gracefully github.com/securego/gosec/v2/config_test.go:200 • [0.000 seconds] ------------------------------ Analyzer when processing a package should not report an error if the package contains no Go files github.com/securego/gosec/v2/analyzer_test.go:49 • [0.001 seconds] ------------------------------ Analyzer when processing a package should report an error if the package fails to build github.com/securego/gosec/v2/analyzer_test.go:58 • [0.001 seconds] ------------------------------ Analyzer when processing a package should be able to analyze multiple Go files github.com/securego/gosec/v2/analyzer_test.go:74 • [0.224 seconds] ------------------------------ Analyzer when processing a package should be able to analyze multiple Go files concurrently github.com/securego/gosec/v2/analyzer_test.go:101 • [0.207 seconds] ------------------------------ Analyzer when processing a package should not race when analyzing G304 patterns across many packages concurrently (issue #1586) github.com/securego/gosec/v2/analyzer_test.go:124 • [2.747 seconds] ------------------------------ Analyzer when processing a package should be able to analyze multiple Go packages github.com/securego/gosec/v2/analyzer_test.go:169 • [0.453 seconds] ------------------------------ Analyzer when processing a package should find errors when nosec is not in use github.com/securego/gosec/v2/analyzer_test.go:193 • [0.297 seconds] ------------------------------ Analyzer when processing a package should find errors when nosec is not in use github.com/securego/gosec/v2/analyzer_test.go:209 • [0.259 seconds] ------------------------------ Analyzer when processing a package should find errors when nosec is not in use github.com/securego/gosec/v2/analyzer_test.go:225 • [0.288 seconds] ------------------------------ Analyzer when processing a package should report Go build errors and invalid files github.com/securego/gosec/v2/analyzer_test.go:241 • [0.212 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec line comment is present github.com/securego/gosec/v2/analyzer_test.go:269 • [0.309 seconds] ------------------------------ Analyzer when processing a package should not report errors when a disable directive is present github.com/securego/gosec/v2/analyzer_test.go:286 • [0.278 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec line comment is present github.com/securego/gosec/v2/analyzer_test.go:303 • [0.291 seconds] ------------------------------ Analyzer when processing a package should not report errors when a disable directive is present github.com/securego/gosec/v2/analyzer_test.go:320 • [0.278 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec line comment is present github.com/securego/gosec/v2/analyzer_test.go:337 • [0.271 seconds] ------------------------------ Analyzer when processing a package should not report errors when a disable directive is present github.com/securego/gosec/v2/analyzer_test.go:354 • [0.263 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec block comment is present github.com/securego/gosec/v2/analyzer_test.go:371 • [0.320 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec block comment is present github.com/securego/gosec/v2/analyzer_test.go:388 • [0.263 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec block comment is present github.com/securego/gosec/v2/analyzer_test.go:405 • [0.260 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:422 • [0.272 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:440 • [0.278 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:458 • [0.250 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:476 • [0.277 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:494 • [0.259 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:512 • [0.279 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec block and line comment are present github.com/securego/gosec/v2/analyzer_test.go:530 • [0.270 seconds] ------------------------------ Analyzer when processing a package should not report errors when only a nosec block is present github.com/securego/gosec/v2/analyzer_test.go:545 • [0.260 seconds] ------------------------------ Analyzer when processing a package should not report errors when a single line nosec is present on a multi-line issue github.com/securego/gosec/v2/analyzer_test.go:560 • [0.455 seconds] ------------------------------ Analyzer when processing a package should not report errors when a disable directive block and line comment are present github.com/securego/gosec/v2/analyzer_test.go:576 • [0.260 seconds] ------------------------------ Analyzer when processing a package should not report errors when only a disable directive block is present github.com/securego/gosec/v2/analyzer_test.go:591 • [0.270 seconds] ------------------------------ Analyzer when processing a package should not report errors when a single line nosec is present on a multi-line issue github.com/securego/gosec/v2/analyzer_test.go:606 • [0.477 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:622 • [0.284 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:639 • [0.298 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:656 • [0.299 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:673 • [0.295 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:690 • [0.263 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:707 • [0.292 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:724 • [0.441 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:743 • [0.396 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:762 • [0.417 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:781 • [0.413 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:800 • [0.380 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:819 • [0.369 seconds] ------------------------------ Analyzer when processing a package should not panic if a file can not compile github.com/securego/gosec/v2/analyzer_test.go:838 • [0.210 seconds] ------------------------------ Analyzer when processing a package should exclude a reportable file, if excluded by build tags github.com/securego/gosec/v2/analyzer_test.go:852 • [0.003 seconds] ------------------------------ Analyzer when processing a package should attempt to analyse a file with build tags github.com/securego/gosec/v2/analyzer_test.go:871 • [0.249 seconds] ------------------------------ Analyzer when processing a package should report issues from a file with build tags github.com/securego/gosec/v2/analyzer_test.go:892 • [0.261 seconds] ------------------------------ Analyzer when processing a package should process an empty package with test file github.com/securego/gosec/v2/analyzer_test.go:913 • [0.504 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues github.com/securego/gosec/v2/analyzer_test.go:928 • [0.248 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite disable directive, and report issues github.com/securego/gosec/v2/analyzer_test.go:951 • [0.232 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues github.com/securego/gosec/v2/analyzer_test.go:974 • [0.227 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite disable directive comments, and report issues github.com/securego/gosec/v2/analyzer_test.go:997 • [0.219 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues github.com/securego/gosec/v2/analyzer_test.go:1020 • [0.260 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite disable directive comments, and report issues github.com/securego/gosec/v2/analyzer_test.go:1043 • [0.218 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues but they should not be counted github.com/securego/gosec/v2/analyzer_test.go:1066 • [0.297 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues but they should not be counted github.com/securego/gosec/v2/analyzer_test.go:1092 • [0.266 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues but they should not be counted github.com/securego/gosec/v2/analyzer_test.go:1118 • [0.271 seconds] ------------------------------ Analyzer when processing a package should not report errors when nosec tag is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1144 • [0.260 seconds] ------------------------------ Analyzer when processing a package should not report errors when disable directive is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1161 • [0.274 seconds] ------------------------------ Analyzer when processing a package should not report errors when nosec tag is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1178 • [0.289 seconds] ------------------------------ Analyzer when processing a package should not report errors when disable directive is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1195 • [0.269 seconds] ------------------------------ Analyzer when processing a package should not report errors when nosec tag is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1212 • [0.252 seconds] ------------------------------ Analyzer when processing a package should not report errors when disable directive is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1229 • [0.254 seconds] ------------------------------ Analyzer when processing a package should report errors when nosec tag is not in front of a line github.com/securego/gosec/v2/analyzer_test.go:1246 • [0.280 seconds] ------------------------------ Analyzer when processing a package should report errors when nosec tag is not in front of a line github.com/securego/gosec/v2/analyzer_test.go:1263 • [0.265 seconds] ------------------------------ Analyzer when processing a package should report errors when nosec tag is not in front of a line github.com/securego/gosec/v2/analyzer_test.go:1280 • [0.272 seconds] ------------------------------ Analyzer when processing a package should not report errors when rules are in front of nosec tag even rules are wrong github.com/securego/gosec/v2/analyzer_test.go:1297 • [0.295 seconds] ------------------------------ Analyzer when processing a package should not report errors when rules are in front of nosec tag even rules are wrong github.com/securego/gosec/v2/analyzer_test.go:1314 • [0.280 seconds] ------------------------------ Analyzer when processing a package should not report errors when rules are in front of nosec tag even rules are wrong github.com/securego/gosec/v2/analyzer_test.go:1331 • [0.251 seconds] ------------------------------ Analyzer when processing a package should report errors when there are nosec tags after a #nosec WrongRuleList annotation github.com/securego/gosec/v2/analyzer_test.go:1348 • [0.273 seconds] ------------------------------ Analyzer when processing a package should report errors when there are disable directives after a //gosec:disable WrongRuleList github.com/securego/gosec/v2/analyzer_test.go:1365 • [0.306 seconds] ------------------------------ Analyzer when processing a package should report errors when there are nosec tags after a #nosec WrongRuleList annotation github.com/securego/gosec/v2/analyzer_test.go:1382 • [0.285 seconds] ------------------------------ Analyzer when processing a package should report errors when there are disable directives after a //gosec:disable WrongRuleList github.com/securego/gosec/v2/analyzer_test.go:1399 • [0.280 seconds] ------------------------------ Analyzer when processing a package should report errors when there are nosec tags after a #nosec WrongRuleList annotation github.com/securego/gosec/v2/analyzer_test.go:1416 • [0.278 seconds] ------------------------------ Analyzer when processing a package should report errors when there are disable directives after a //gosec:disable WrongRuleList github.com/securego/gosec/v2/analyzer_test.go:1433 • [0.277 seconds] ------------------------------ Analyzer when processing a package should be possible to use an alternative nosec tag github.com/securego/gosec/v2/analyzer_test.go:1450 • [0.293 seconds] ------------------------------ Analyzer when processing a package should be possible to use an alternative nosec tag github.com/securego/gosec/v2/analyzer_test.go:1473 • [0.251 seconds] ------------------------------ Analyzer when processing a package should be possible to use an alternative nosec tag github.com/securego/gosec/v2/analyzer_test.go:1496 • [0.239 seconds] ------------------------------ Analyzer when processing a package should ignore vulnerabilities when the default tag is found github.com/securego/gosec/v2/analyzer_test.go:1519 • [0.269 seconds] ------------------------------ Analyzer when processing a package should ignore vulnerabilities when the default tag is found github.com/securego/gosec/v2/analyzer_test.go:1542 • [0.262 seconds] ------------------------------ Analyzer when processing a package should ignore vulnerabilities when the default tag is found github.com/securego/gosec/v2/analyzer_test.go:1565 • [0.235 seconds] ------------------------------ Analyzer when processing a package should be able to analyze Go test package github.com/securego/gosec/v2/analyzer_test.go:1588 • [0.242 seconds] ------------------------------ Analyzer when processing a package should be able to scan generated files if NOT excluded when using the rules github.com/securego/gosec/v2/analyzer_test.go:1613 • [0.053 seconds] ------------------------------ Analyzer when processing a package should be able to skip generated files if excluded when using the rules github.com/securego/gosec/v2/analyzer_test.go:1634 • [0.057 seconds] ------------------------------ Analyzer when processing a package should be able to scan generated files if NOT excluded when using the analyzes github.com/securego/gosec/v2/analyzer_test.go:1655 [FAILED] in [It] - github.com/securego/gosec/v2/analyzer_test.go:1676 @ 10/23/26 14:55:08.482 • [FAILED] [0.249 seconds] Analyzer when processing a package [It] should be able to scan generated files if NOT excluded when using the analyzes github.com/securego/gosec/v2/analyzer_test.go:1655 [FAILED] Expected <[]*issue.Issue | len:0, cap:16>: [] to have length 1 In [It] at: github.com/securego/gosec/v2/analyzer_test.go:1676 @ 10/23/26 14:55:08.482 ------------------------------ SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS Summarizing 1 Failure: [FAIL] Analyzer when processing a package [It] should be able to scan generated files if NOT excluded when using the analyzes github.com/securego/gosec/v2/analyzer_test.go:1676 Ran 100 of 289 Specs in 25.555 seconds FAIL! -- 99 Passed | 1 Failed | 0 Pending | 189 Skipped --- FAIL: TestGosec (25.56s) FAIL Ginkgo ran 1 suite in 31.658032074s Test Suite Failed exit status 1 >>> ERROR: gosec: check failed >>> gosec: Uninstalling dependencies... (1/2) Purging .makedepends-gosec (20261023.145338) (2/2) Purging go (1.27.3-r0) Executing busybox-1.38.0-r7.trigger OK: 290.2 MiB in 105 packages