Repository: google/osv-scanner

Issue:
`--license` for the go standard library shows up as UNKNOWN
Anytime you scan a go project with `--license` there will be at least 1 UNKNOWN for the go stdlib. We should hardcode an exception, or update it on deps.dev's license API side. 

Discussion:
@shahar-h: See related [issue](https://github.com/google/deps.dev/issues/86) in deps.dev.@github-actions: This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv-scanner/blob/main/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.@another-rex: I think this might be fixed now with stdlib being added to deps.dev. Will test and see
@another-rex: Actually, this still needs to be updated on the osv-scanner side, as  stdlib uses a different versioning scheme (no v prefix)

Solution patch:
diff --git a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
index 33d74677..471303e9 100755
--- a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
+++ b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
@@ -188,6 +188,25 @@ Total 0 packages affected by 0 known vulnerabilities (0 Critical, 0 High, 0 Medi
 
 ---
 
+[TestCommand/Go_project_with_an_overridden_go_version_and_licences - 1]
+Scanning dir ./testdata/go-project
+Scanned <rootdir>/testdata/go-project/go.mod file and found 1 package
+Total 0 packages affected by 0 known vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
+0 vulnerabilities can be fixed.
+
+
++--------------+-------------------------+
+| LICENSE      | NO. OF PACKAGE VERSIONS |
++--------------+-------------------------+
+| BSD-3-Clause |                       1 |
++--------------+-------------------------+
+
+---
+
+[TestCommand/Go_project_with_an_overridden_go_version_and_licences - 2]
+
+---
+
 [TestCommand/PURL_SBOM_case_sensitivity_(api) - 1]
 Scanning dir ./testdata/sbom-insecure/alpine.cdx.xml
 Scanned <rootdir>/testdata/sbom-insecure/alpine.cdx.xml file and found 15 packages
diff --git a/internal/clients/clientimpl/licensematcher/licensematcher.go b/internal/clients/clientimpl/licensematcher/licensematcher.go
index 0973fd51..9780f9d1 100644
--- a/internal/clients/clientimpl/licensematcher/licensematcher.go
+++ b/internal/clients/clientimpl/licensematcher/licensematcher.go
@@ -96,7 +96,7 @@ func (matcher *DepsDevLicenseMatcher) makeVersionRequest(ctx context.Context, qu
 }
 
 func versionQuery(system depsdevpb.System, name string, version string) *depsdevpb.GetVersionRequest {
-	if system == depsdevpb.System_GO {
+	if system == depsdevpb.System_GO && name != "stdlib" {
 		version = "v" + version
 	}
 



Test patch:
diff --git a/cmd/osv-scanner/scan/source/command_test.go b/cmd/osv-scanner/scan/source/command_test.go
index 46c26954..1453a982 100644
--- a/cmd/osv-scanner/scan/source/command_test.go
+++ b/cmd/osv-scanner/scan/source/command_test.go
@@ -265,6 +265,12 @@ func TestCommand(t *testing.T) {
 			Args: []string{"", "source", "--offline", "--download-offline-databases", "--format", "table", "./testdata/sbom-insecure/alpine.cdx.xml"},
 			Exit: 1,
 		},
+		// Go project with an overridden go version and licenses
+		{
+			Name: "Go project with an overridden go version and licences",
+			Args: []string{"", "source", "--config=./testdata/go-project/go-version-config.toml", "--licenses", "./testdata/go-project"},
+			Exit: 0,
+		},
 		// Go project with an overridden go version
 		{
 			Name: "Go project with an overridden go version",