>>> gosec: Building community/gosec 2.28.0-r1 (using abuild 3.18.0_rc7-r1) started Sat, 24 Oct 2026 02:39:06 +0000 >>> gosec: Validating /home/buildozer/aports/community/gosec/APKBUILD... >>> gosec: Analyzing dependencies... >>> gosec: Installing for build: build-base go (1/2) Installing go (1.27.3-r0) (2/2) Installing .makedepends-gosec (20261024.023907) Executing busybox-1.38.0-r7.trigger OK: 576.5 MiB in 109 packages >>> gosec: Cleaning up srcdir >>> gosec: Cleaning up pkgdir >>> gosec: Cleaning up tmpdir >>> gosec: Fetching https://distfiles.alpinelinux.org/distfiles/edge//gosec-2.28.0.tar.gz Connecting to distfiles.alpinelinux.org (172.105.82.32:443) saving to '/var/cache/distfiles/edge/gosec-2.28.0.tar.gz.part' gosec-2.28.0.tar.gz. 100% |********************************| 380k 0:00:00 ETA '/var/cache/distfiles/edge/gosec-2.28.0.tar.gz.part' saved /var/cache/distfiles/edge/gosec-2.28.0.tar.gz: OK >>> gosec: Fetching https://distfiles.alpinelinux.org/distfiles/edge//gosec-2.28.0.tar.gz /var/cache/distfiles/edge/gosec-2.28.0.tar.gz: OK >>> gosec: Unpacking /var/cache/distfiles/edge/gosec-2.28.0.tar.gz... fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git make build fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git make[1]: Entering directory '/home/buildozer/aports/community/gosec/src/gosec-2.28.0' fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git go build -ldflags " -X 'main.Version=' -X 'main.GitTag=' -X 'main.BuildDate=2026-10-24T02:39:11Z'" -o gosec ./cmd/gosec/ fatal: not a git repository (or any of the parent directories): .git fatal: not a git repository (or any of the parent directories): .git go: downloading github.com/ccojocar/zxcvbn-go v1.0.4 go: downloading github.com/anthropics/anthropic-sdk-go v1.57.0 go: downloading github.com/openai/openai-go/v3 v3.42.0 go: downloading google.golang.org/genai v1.63.0 go: downloading github.com/google/uuid v1.6.0 go: downloading golang.org/x/sync v0.22.0 go: downloading golang.org/x/tools v0.48.0 go: downloading go.yaml.in/yaml/v3 v3.0.4 go: downloading github.com/gookit/color v1.6.1 go: downloading cloud.google.com/go/auth v0.21.0 go: downloading cloud.google.com/go v0.123.0 go: downloading github.com/google/go-cmp v0.7.0 go: downloading github.com/gorilla/websocket v1.5.3 go: downloading github.com/invopop/jsonschema v0.14.0 go: downloading github.com/pb33f/ordered-map/v2 v2.3.1 go: downloading github.com/standard-webhooks/standard-webhooks/libraries v0.0.1 go: downloading github.com/tidwall/gjson v1.19.0 go: downloading github.com/tidwall/sjson v1.2.5 go: downloading github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e go: downloading github.com/bahlo/generic-list-go v0.2.0 go: downloading github.com/buger/jsonparser v1.2.0 go: downloading go.yaml.in/yaml/v4 v4.0.0-rc.6 go: downloading golang.org/x/mod v0.38.0 go: downloading github.com/googleapis/gax-go/v2 v2.23.0 go: downloading cloud.google.com/go/compute/metadata v0.9.0 go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 go: downloading go.opentelemetry.io/otel v1.44.0 go: downloading go.opentelemetry.io/otel/trace v1.44.0 go: downloading golang.org/x/net v0.57.0 go: downloading google.golang.org/api v0.288.0 go: downloading github.com/tidwall/match v1.2.0 go: downloading github.com/tidwall/pretty v1.2.1 go: downloading github.com/google/s2a-go v0.1.9 go: downloading google.golang.org/grpc v1.82.0 go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.18 go: downloading github.com/felixge/httpsnoop v1.1.0 go: downloading go.opentelemetry.io/otel/metric v1.44.0 go: downloading google.golang.org/protobuf v1.36.11 go: downloading github.com/go-logr/logr v1.4.3 go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 go: downloading golang.org/x/text v0.40.0 go: downloading github.com/cespare/xxhash/v2 v2.3.0 go: downloading github.com/go-logr/stdr v1.2.2 go: downloading go.opentelemetry.io/auto/sdk v1.2.1 go: downloading golang.org/x/sys v0.47.0 go: downloading golang.org/x/crypto v0.54.0 make[1]: Leaving directory '/home/buildozer/aports/community/gosec/src/gosec-2.28.0' go: downloading github.com/onsi/ginkgo/v2 v2.32.0 go: downloading github.com/go-task/slim-sprig/v3 v3.0.0 go: downloading github.com/Masterminds/semver/v3 v3.5.0 go: downloading github.com/google/pprof v0.0.0-20260709232956-b9395ee17fa0 go: downloading github.com/onsi/gomega v1.42.1 go: downloading github.com/stretchr/testify v1.11.1 go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 go: downloading gopkg.in/yaml.v3 v3.0.1 Running Suite: gosec Suite - /home/buildozer/aports/community/gosec/src/gosec-2.28.0 ==================================================================================== Random Seed: 1792809582 Will run 289 of 289 specs ------------------------------ Analyzer when processing a package should not report an error if the package contains no Go files github.com/securego/gosec/v2/analyzer_test.go:49 • [0.000 seconds] ------------------------------ Analyzer when processing a package should report an error if the package fails to build github.com/securego/gosec/v2/analyzer_test.go:58 • [0.000 seconds] ------------------------------ Analyzer when processing a package should be able to analyze multiple Go files github.com/securego/gosec/v2/analyzer_test.go:74 • [0.061 seconds] ------------------------------ Analyzer when processing a package should be able to analyze multiple Go files concurrently github.com/securego/gosec/v2/analyzer_test.go:101 • [0.048 seconds] ------------------------------ Analyzer when processing a package should not race when analyzing G304 patterns across many packages concurrently (issue #1586) github.com/securego/gosec/v2/analyzer_test.go:124 • [0.770 seconds] ------------------------------ Analyzer when processing a package should be able to analyze multiple Go packages github.com/securego/gosec/v2/analyzer_test.go:169 • [0.095 seconds] ------------------------------ Analyzer when processing a package should find errors when nosec is not in use github.com/securego/gosec/v2/analyzer_test.go:193 • [0.078 seconds] ------------------------------ Analyzer when processing a package should find errors when nosec is not in use github.com/securego/gosec/v2/analyzer_test.go:209 • [0.076 seconds] ------------------------------ Analyzer when processing a package should find errors when nosec is not in use github.com/securego/gosec/v2/analyzer_test.go:225 • [0.076 seconds] ------------------------------ Analyzer when processing a package should report Go build errors and invalid files github.com/securego/gosec/v2/analyzer_test.go:241 • [0.050 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec line comment is present github.com/securego/gosec/v2/analyzer_test.go:269 • [0.102 seconds] ------------------------------ Analyzer when processing a package should not report errors when a disable directive is present github.com/securego/gosec/v2/analyzer_test.go:286 • [0.082 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec line comment is present github.com/securego/gosec/v2/analyzer_test.go:303 • [0.067 seconds] ------------------------------ Analyzer when processing a package should not report errors when a disable directive is present github.com/securego/gosec/v2/analyzer_test.go:320 • [0.070 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec line comment is present github.com/securego/gosec/v2/analyzer_test.go:337 • [0.066 seconds] ------------------------------ Analyzer when processing a package should not report errors when a disable directive is present github.com/securego/gosec/v2/analyzer_test.go:354 • [0.067 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec block comment is present github.com/securego/gosec/v2/analyzer_test.go:371 • [0.071 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec block comment is present github.com/securego/gosec/v2/analyzer_test.go:388 • [0.067 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec block comment is present github.com/securego/gosec/v2/analyzer_test.go:405 • [0.079 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:422 • [0.083 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:440 • [0.075 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:458 • [0.074 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:476 • [0.071 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:494 • [0.070 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for the correct rule github.com/securego/gosec/v2/analyzer_test.go:512 • [0.064 seconds] ------------------------------ Analyzer when processing a package should not report errors when a nosec block and line comment are present github.com/securego/gosec/v2/analyzer_test.go:530 • [0.061 seconds] ------------------------------ Analyzer when processing a package should not report errors when only a nosec block is present github.com/securego/gosec/v2/analyzer_test.go:545 • [0.079 seconds] ------------------------------ Analyzer when processing a package should not report errors when a single line nosec is present on a multi-line issue github.com/securego/gosec/v2/analyzer_test.go:560 • [0.118 seconds] ------------------------------ Analyzer when processing a package should not report errors when a disable directive block and line comment are present github.com/securego/gosec/v2/analyzer_test.go:576 • [0.065 seconds] ------------------------------ Analyzer when processing a package should not report errors when only a disable directive block is present github.com/securego/gosec/v2/analyzer_test.go:591 • [0.064 seconds] ------------------------------ Analyzer when processing a package should not report errors when a single line nosec is present on a multi-line issue github.com/securego/gosec/v2/analyzer_test.go:606 • [0.135 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:622 • [0.095 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:639 • [0.083 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:656 • [0.073 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:673 • [0.073 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:690 • [0.068 seconds] ------------------------------ Analyzer when processing a package should report errors when an exclude comment is present for a different rule github.com/securego/gosec/v2/analyzer_test.go:707 • [0.085 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:724 • [0.107 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:743 • [0.106 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:762 • [0.102 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:781 • [0.104 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:800 • [0.100 seconds] ------------------------------ Analyzer when processing a package should not report errors when an exclude comment is present for multiple rules, including the correct rule github.com/securego/gosec/v2/analyzer_test.go:819 • [0.106 seconds] ------------------------------ Analyzer when processing a package should not panic if a file can not compile github.com/securego/gosec/v2/analyzer_test.go:838 • [0.051 seconds] ------------------------------ Analyzer when processing a package should exclude a reportable file, if excluded by build tags github.com/securego/gosec/v2/analyzer_test.go:852 • [0.000 seconds] ------------------------------ Analyzer when processing a package should attempt to analyse a file with build tags github.com/securego/gosec/v2/analyzer_test.go:871 • [0.069 seconds] ------------------------------ Analyzer when processing a package should report issues from a file with build tags github.com/securego/gosec/v2/analyzer_test.go:892 • [0.071 seconds] ------------------------------ Analyzer when processing a package should process an empty package with test file github.com/securego/gosec/v2/analyzer_test.go:913 • [0.126 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues github.com/securego/gosec/v2/analyzer_test.go:928 • [0.066 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite disable directive, and report issues github.com/securego/gosec/v2/analyzer_test.go:951 • [0.067 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues github.com/securego/gosec/v2/analyzer_test.go:974 • [0.065 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite disable directive comments, and report issues github.com/securego/gosec/v2/analyzer_test.go:997 • [0.068 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues github.com/securego/gosec/v2/analyzer_test.go:1020 • [0.057 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite disable directive comments, and report issues github.com/securego/gosec/v2/analyzer_test.go:1043 • [0.065 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues but they should not be counted github.com/securego/gosec/v2/analyzer_test.go:1066 • [0.079 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues but they should not be counted github.com/securego/gosec/v2/analyzer_test.go:1092 • [0.079 seconds] ------------------------------ Analyzer when processing a package should be possible to overwrite nosec comments, and report issues but they should not be counted github.com/securego/gosec/v2/analyzer_test.go:1118 • [0.068 seconds] ------------------------------ Analyzer when processing a package should not report errors when nosec tag is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1144 • [0.076 seconds] ------------------------------ Analyzer when processing a package should not report errors when disable directive is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1161 • [0.089 seconds] ------------------------------ Analyzer when processing a package should not report errors when nosec tag is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1178 • [0.069 seconds] ------------------------------ Analyzer when processing a package should not report errors when disable directive is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1195 • [0.070 seconds] ------------------------------ Analyzer when processing a package should not report errors when nosec tag is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1212 • [0.066 seconds] ------------------------------ Analyzer when processing a package should not report errors when disable directive is in front of a line github.com/securego/gosec/v2/analyzer_test.go:1229 • [0.079 seconds] ------------------------------ Analyzer when processing a package should report errors when nosec tag is not in front of a line github.com/securego/gosec/v2/analyzer_test.go:1246 • [0.072 seconds] ------------------------------ Analyzer when processing a package should report errors when nosec tag is not in front of a line github.com/securego/gosec/v2/analyzer_test.go:1263 • [0.072 seconds] ------------------------------ Analyzer when processing a package should report errors when nosec tag is not in front of a line github.com/securego/gosec/v2/analyzer_test.go:1280 • [0.065 seconds] ------------------------------ Analyzer when processing a package should not report errors when rules are in front of nosec tag even rules are wrong github.com/securego/gosec/v2/analyzer_test.go:1297 • [0.073 seconds] ------------------------------ Analyzer when processing a package should not report errors when rules are in front of nosec tag even rules are wrong github.com/securego/gosec/v2/analyzer_test.go:1314 • [0.079 seconds] ------------------------------ Analyzer when processing a package should not report errors when rules are in front of nosec tag even rules are wrong github.com/securego/gosec/v2/analyzer_test.go:1331 • [0.070 seconds] ------------------------------ Analyzer when processing a package should report errors when there are nosec tags after a #nosec WrongRuleList annotation github.com/securego/gosec/v2/analyzer_test.go:1348 • [0.074 seconds] ------------------------------ Analyzer when processing a package should report errors when there are disable directives after a //gosec:disable WrongRuleList github.com/securego/gosec/v2/analyzer_test.go:1365 • [0.074 seconds] ------------------------------ Analyzer when processing a package should report errors when there are nosec tags after a #nosec WrongRuleList annotation github.com/securego/gosec/v2/analyzer_test.go:1382 • [0.084 seconds] ------------------------------ Analyzer when processing a package should report errors when there are disable directives after a //gosec:disable WrongRuleList github.com/securego/gosec/v2/analyzer_test.go:1399 • [0.074 seconds] ------------------------------ Analyzer when processing a package should report errors when there are nosec tags after a #nosec WrongRuleList annotation github.com/securego/gosec/v2/analyzer_test.go:1416 • [0.072 seconds] ------------------------------ Analyzer when processing a package should report errors when there are disable directives after a //gosec:disable WrongRuleList github.com/securego/gosec/v2/analyzer_test.go:1433 • [0.065 seconds] ------------------------------ Analyzer when processing a package should be possible to use an alternative nosec tag github.com/securego/gosec/v2/analyzer_test.go:1450 • [0.076 seconds] ------------------------------ Analyzer when processing a package should be possible to use an alternative nosec tag github.com/securego/gosec/v2/analyzer_test.go:1473 • [0.076 seconds] ------------------------------ Analyzer when processing a package should be possible to use an alternative nosec tag github.com/securego/gosec/v2/analyzer_test.go:1496 • [0.068 seconds] ------------------------------ Analyzer when processing a package should ignore vulnerabilities when the default tag is found github.com/securego/gosec/v2/analyzer_test.go:1519 • [0.060 seconds] ------------------------------ Analyzer when processing a package should ignore vulnerabilities when the default tag is found github.com/securego/gosec/v2/analyzer_test.go:1542 • [0.068 seconds] ------------------------------ Analyzer when processing a package should ignore vulnerabilities when the default tag is found github.com/securego/gosec/v2/analyzer_test.go:1565 • [0.064 seconds] ------------------------------ Analyzer when processing a package should be able to analyze Go test package github.com/securego/gosec/v2/analyzer_test.go:1588 • [0.069 seconds] ------------------------------ Analyzer when processing a package should be able to scan generated files if NOT excluded when using the rules github.com/securego/gosec/v2/analyzer_test.go:1613 • [0.025 seconds] ------------------------------ Analyzer when processing a package should be able to skip generated files if excluded when using the rules github.com/securego/gosec/v2/analyzer_test.go:1634 • [0.025 seconds] ------------------------------ Analyzer when processing a package should be able to scan generated files if NOT excluded when using the analyzes github.com/securego/gosec/v2/analyzer_test.go:1655 [FAILED] in [It] - github.com/securego/gosec/v2/analyzer_test.go:1676 @ 10/24/26 02:39:53.054 • [FAILED] [0.061 seconds] Analyzer when processing a package [It] should be able to scan generated files if NOT excluded when using the analyzes github.com/securego/gosec/v2/analyzer_test.go:1655 [FAILED] Expected <[]*issue.Issue | len:0, cap:16>: [] to have length 1 In [It] at: github.com/securego/gosec/v2/analyzer_test.go:1676 @ 10/24/26 02:39:53.054 ------------------------------ SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS Summarizing 1 Failure: [FAIL] Analyzer when processing a package [It] should be able to scan generated files if NOT excluded when using the analyzes github.com/securego/gosec/v2/analyzer_test.go:1676 Ran 85 of 289 Specs in 6.840 seconds FAIL! -- 84 Passed | 1 Failed | 0 Pending | 204 Skipped --- FAIL: TestGosec (6.84s) FAIL Ginkgo ran 1 suite in 10.644180532s Test Suite Failed exit status 1 >>> ERROR: gosec: check failed >>> gosec: Uninstalling dependencies... (1/2) Purging .makedepends-gosec (20261024.023907) (2/2) Purging go (1.27.3-r0) Executing busybox-1.38.0-r7.trigger OK: 387.9 MiB in 107 packages