Documentation
¶
Overview ¶
Package srcreach implements deterministic Tier-1 reachability over a first-party source import scan, shared by every language whose dependency usage is observable as an import/require/use statement.
SAFETY: an "unreachable" verdict suppresses work, so a false unreachable is worse than no verdict. The analyzer therefore REFUSES to answer — returning a no-coverage error, which leaves any prior tier standing — whenever the scan reports that anything could hide a reference: dynamic loading, macro expansion, computed include paths, metaprogramming, an unreadable file or an exhausted budget. Only a completely observed target can produce a negative.
Matching is deliberately GENEROUS. A package may be referenced under several plausible names (a Rust crate's hyphens become underscores in `use`, a PHP package's Composer name is not its namespace, a Ruby gem's require path often differs from its gem name), so every plausible name counts as a reference. Over-matching biases toward "reachable", which is the safe direction; under-matching would suppress a real finding.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NormalizeCandidates ¶
NormalizeCandidates lowercases, trims, sorts and deduplicates a candidate list so matching is deterministic regardless of how a language's namer produced it.
Types ¶
type Analyzer ¶
type Analyzer struct {
// contains filtered or unexported fields
}
Analyzer implements the reachproof analyzer contract over a source import scan.
func New ¶
func New(scanner importScanner, candidates CandidateNamer, directDeps DirectDependencyReader) (*Analyzer, error)
New validates and returns the analyzer.
func (*Analyzer) Analyze ¶
func (a *Analyzer) Analyze(ctx context.Context, dir string, subjects []string) (*reachability.Analysis, error)
Analyze reports, for each subject package name, whether first-party source references it.
func (*Analyzer) Analyzeable ¶
Lang reports the ecosystem this analyzer answers for.
type CandidateNamer ¶
CandidateNamer expands a dependency name into every plausible source-level reference name. It is the one piece that differs per language.
type DirectDependencyReader ¶
DirectDependencyReader reports the dependency names a first-party manifest declares.
It is the guard that keeps a TRANSITIVE package out of a Tier-1 answer. A lockfile-derived SBOM is a fully resolved graph, so most of its components are transitive — and first-party source never writes an import for a package it receives through a parent. Answering "not referenced" for those would suppress the majority of real findings, so a subject that is not a declared direct dependency is refused instead.
Source Files