sbom

package
v0.1.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 24, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package sbom emits CycloneDX 1.5 software bills of materials.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Generate

func Generate(archive *deb.Archive, artifact string, epoch time.Time) ([]byte, error)

Generate builds a deterministic SBOM for a parsed binary package.

func Write

func Write(w io.Writer, archive *deb.Archive, artifact string, epoch time.Time) error

Write encodes a BOM to w.

Types

type Component

type Component struct {
	Type       string     `json:"type"`
	BOMRef     string     `json:"bom-ref"`
	Name       string     `json:"name"`
	Version    string     `json:"version,omitempty"`
	PURL       string     `json:"purl,omitempty"`
	Hashes     []Hash     `json:"hashes,omitempty"`
	Properties []Property `json:"properties,omitempty"`
}

Component is a software component.

type Dependency

type Dependency struct {
	Ref       string   `json:"ref"`
	DependsOn []string `json:"dependsOn,omitempty"`
}

Dependency links a component to the components it needs.

type Document

type Document struct {
	BOMFormat    string       `json:"bomFormat"`
	SpecVersion  string       `json:"specVersion"`
	SerialNumber string       `json:"serialNumber"`
	Version      int          `json:"version"`
	Metadata     Metadata     `json:"metadata"`
	Components   []Component  `json:"components,omitempty"`
	Dependencies []Dependency `json:"dependencies"`
}

Document is a CycloneDX 1.5 BOM.

type Hash

type Hash struct {
	Alg     string `json:"alg"`
	Content string `json:"content"`
}

Hash is a checksum of a component.

type Metadata

type Metadata struct {
	Timestamp string    `json:"timestamp"`
	Component Component `json:"component"`
}

Metadata describes the subject of the BOM.

type Property

type Property struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

Property is an arbitrary key/value annotation.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL