Documentation
¶
Overview ¶
Package sbomcache is a filesystem-backed, content-addressed cache of generated SBOMs. It implements the analyzer-version cache-invalidation idea (learned from Trivy): the cache key folds together a cheap digest of the workspace CONTENT and the SBOM producer VERSION, so an unchanged tree re-scanned with the same producer reuses the cataloged SBOM, and a producer bump makes every prior entry a miss.
The workspace digest is metadata-based (path + size + mtime), which is deliberately CHEAPER than reading and hashing every byte – the whole point is to be faster than the Syft cataloging pass it replaces. That matches Trivy's filesystem-cache posture: a content edit that preserves BOTH size and mtime (pathological; editors and git checkouts always bump mtime) is the only stale case, and it is bounded by the fact that a producer version bump always invalidates. The cache is opt-in.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Cache ¶
type Cache struct {
// contains filtered or unexported fields
}
Cache stores generated SBOMs under a root directory, one JSON file per key.
Source Files