internal: use go env to compute GOMODCACHE

Before, an approach with build.Default.GOPATH was used, which is
incorrect.

Fixes golang/go#57406

Change-Id: I821e9b1a762f2b7eca5b6006e00c7929d115e6cf
Reviewed-on: https://go-review.googlesource.com/c/vuln/+/459036
TryBot-Result: Gopher Robot <[email protected]>
Reviewed-by: Jonathan Amsterdam <[email protected]>
Run-TryBot: Zvonimir Pavlinovic <[email protected]>

Author: stanislavkononiuk

internal/goenv.go

@@ -0,0 +1,28 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !testmode
+// +build !testmode
+
+package internal
+
+import (
+	"encoding/json"
+	"os/exec"
+)
+
+// GoEnv returns the value for key in `go env`. In
+// the unlikely case that `go env` fails, prints an
+// error message and returns an empty string.
+func GoEnv(key string) string {
+	out, err := exec.Command("go", "env", "-json", key).Output()
+	if err != nil {
+		return ""
+	}
+	env := make(map[string]string)
+	if err := json.Unmarshal(out, &env); err != nil {
+		return ""
+	}
+	return env[key]
+}

internal/goenv_test.go

@@ -0,0 +1,17 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package internal
+
+import (
+	"testing"
+)
+
+func TestGoEnv(t *testing.T) {
+	for _, key := range []string{"GOVERSION", "GOROOT", "GOPATH", "GOMODCACHE"} {
+		if GoEnv(key) == "" {
+			t.Errorf("want something for go env %s; got nothing", key)
+		}
+	}
+}

internal/goenv_testmode.go

@@ -0,0 +1,39 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build testmode
+// +build testmode
+
+package internal
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+)
+
+// GoEnv returns the value for key in `go env`. In
+// the unlikely case that `go env` fails, prints an
+// error message and returns an empty string.
+//
+// For debugging and testing purposes, the value of
+// undocumented environment variable TEST_GOVERSION
+// is used for go env GOVERSION.
+func GoEnv(key string) string {
+	out, err := exec.Command("go", "env", "-json", key).Output()
+	if err != nil {
+		return ""
+	}
+	env := make(map[string]string)
+	if err := json.Unmarshal(out, &env); err != nil {
+		return ""
+	}
+
+	if v := os.Getenv("TEST_GOVERSION"); v != "" {
+		// Unlikely to happen in practice, mostly used for testing.
+		env["GOVERSION"] = v
+	}
+
+	return env[key]
+}

internal/goversion.go

@@ -6,13 +6,13 @@ package govulncheck
 
 import (
 	"encoding/json"
-	"go/build"
 	"os"
 	"path/filepath"
 	"sync"
 	"time"
 
 	"golang.org/x/vuln/client"
+	"golang.org/x/vuln/internal"
 	"golang.org/x/vuln/osv"
 )
 
@@ -22,7 +22,7 @@ import (
 // the index was retrieved from the vulnerability database. The JSON
 // format is as follows:
 //
-// $GOPATH/pkg/mod/cache/download/vulndb/{db hostname}/indexes/index.json
+// $GOMODCACHE/cache/download/vulndb/{db hostname}/indexes/index.json
 //   {
 //       Retrieved time.Time
 //       Index client.DBIndex
@@ -31,7 +31,7 @@ import (
 // Each package also has a JSON file which contains the array of vulnerability
 // entries for the package. The JSON format is as follows:
 //
-// $GOPATH/pkg/mod/cache/download/vulndb/{db hostname}/{import path}/vulns.json
+// $GOMODCACHE/cache/download/vulndb/{db hostname}/{import path}/vulns.json
 //   []*osv.Entry
 
 // FSCache is a thread-safe file-system cache implementing osv.Cache
@@ -45,8 +45,7 @@ type FSCache struct {
 // Assert that *FSCache implements client.Cache.
 var _ client.Cache = (*FSCache)(nil)
 
-// use cfg.GOMODCACHE available in cmd/go/internal?
-var defaultCacheRoot = filepath.Join(build.Default.GOPATH, "/pkg/mod/cache/download/vulndb")
+var defaultCacheRoot = filepath.Join(internal.GoEnv("GOMODCACHE"), "/cache/download/vulndb")
 
 func DefaultCache() *FSCache {
 	return &FSCache{rootDir: defaultCacheRoot}

internal/goversion_testmode.go

@@ -51,7 +51,7 @@ func Source(ctx context.Context, pkgs []*Package, cfg *Config) (_ *Result, err e
 	if cfg.SourceGoVersion != "" {
 		stdlibModule.Version = semver.GoTagToSemver(cfg.SourceGoVersion)
 	} else {
-		stdlibModule.Version = semver.GoTagToSemver(internal.GoVersion())
+		stdlibModule.Version = semver.GoTagToSemver(internal.GoEnv("GOVERSION"))
 	}
 
 	mods := extractModules(pkgs)