FOSSA's scanner chokes on `replace` directives in go.mod. It's a known limitation they don't advertise clearly.
You'll see errors like:
```
failed to resolve dependencies: error parsing go.mod: invalid module version
```
Example problematic structure:
```go
module example.com/myapp
go 1.21
require (
example.com/private v0.0.0
)
replace example.com/private v0.0.0 => ../local/path
```
Workarounds I've validated:
* Pre-process the go.mod file to strip `replace` directives before scanning. Use `go mod edit -dropreplace` in your pipeline.
* For CI, consider a two-stage scan: one for the main module, another for the local replaced module if it's separate code.
* If the replacement points to another VCS location, you might need to manually vendor.
This creates blind spots in your SCA. You're either skipping scans on replaced modules or adding complex pre-processing steps. Another case of tool sprawl—now you need custom scripts to make your SCA tool work.
null