build: Makefile: add Go vulnerability checker

[odeke-em]

Adds the Go vulnerability checker to the Makefile as a directive dependency to the all directive to ensure that we get security updates scalably.

[tac0turtle]

Could you touch on what this does? Do we need to add it to ci? Git hook?

[julienrbrt]

I am curious what overlaps it has with https://github.com/actions/dependency-review-action? We have this one in CI already.

[odeke-em]

Could you touch on what this does? Do we need to add it to ci? Git hook?

@tac0turtle it uses Go's new vulnerability scanner to check for packages that are reported as vulnerable from a bunch of crowd sourced public vulnerability databases. It was announced for Go1.19 at https://go.dev/blog/vuln and there is a listing of vulnerabilities in https://pkg.go.dev/vuln/ -- it helps us scalably catch vulnerable code in supply chains. We shall need it in CI so that if for example a vulnerable unaudited downstream dependency is introduced, it'll fail loudly.

I am curious what overlaps it has with https://github.com/actions/dependency-review-action? We have this one in CI already.

@julienrbrt I believe that tagged Github action is a subset of what this new change does. That tagged Github action requires us to have a license to Github Advanced Security and it just checks from declared GHSAs which we have; The Go vulnerability checker reads from more diverse sources than just GHSA, like it reads from the National Vulnerability Database (NVD) as well where majority of the CVEs are reported directly. Please see this infographic from the website

[fedekunze]

I think this is a great addition! However, I doubt engineers will remember to run the cmd so I recommend including it in a CI action as @tac0turtle mentioned

[tac0turtle]

this needs to be added somewhere its automatically run instead of only a makefile command

[julienrbrt]

Govulncheck exits successfully (exit code 0) if there are no vulnerabilities, and exits unsuccessfully if there are. It also exits successfully if -json flag is provided, regardless of the number of detected vulnerabilities.

https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck

This means we can simply add make vulncheck here: https://github.com/cosmos/cosmos-sdk/blob/main/.github/workflows/dependencies-review.yml

added in a gh action

[sonarcloud]

[Cosmos SDK - Rosetta] Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information