Add golang.org/x/vuln/vulncheck as a linter

[joerdav]

Your feature request related to a problem? Please describe.

govulncheck allows you to check if your code is calling any vulnerable code.

Describe the solution you'd like.

Add https://pkg.go.dev/golang.org/x/vuln/vulncheck as a linter.

Describe alternatives you've considered.

I can't find another vulnerability checker that can determine if the vulnerable code is being called or not.

Additional context.

No response

[boring-cyborg]

Hey, thank you for opening your first Issue ! 🙂 If you would like to contribute we have a guide for contributors.

[ldez]

Hello,

There are several problems:

• vulncheck doesn't use the go/analysis API
• vulncheck is not designed to be used as a library

https://golangci-lint.run/contributing/new-linters/#how-to-add-a-public-linter-to-golangci-lint
https://github.com/golang/vuln/tree/master/cmd/govulncheck

So I will decline this proposal.

[luxifer]

Hi,

I think the issue should be re-opened because of https://go.dev/blog/vuln and the vulncheck library that's used by the command govulncheck. I can work on it

[ryancurrah]

Looks like they have a API now, I havent looked at it though.

To directly integrate vulnerability checking into other tools and processes, the vulncheck package exports govulncheck’s functionality as a Go API.

[Dentrax]

It seems mentioned PR is currently Draft, and since they have an API as Ryan mentioned above, we can re-open this one. @ldez Wdyt?

[ldez]

As vulncheck is based on SSA, I think the integration will not work but I will re-open.

[Dentrax]

Thanks!

@luxifer Is your PR final? If so, can you please remove draft tag?

[luxifer]

I need to rewrite the commit as it's with the wrong address. But yes, I need some feedback on my proposal because it's the first time I'm using go/analysis