sbom

package
v2.2.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 29, 2026 License: GPL-3.0 Imports: 8 Imported by: 0

Documentation

Overview

Package sbom provides Software Bill of Materials (SBOM) generation for YAP packages in CycloneDX and SPDX formats.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func Generate 

func Generate(pkg *pkgbuild.PKGBUILD, artifactPath string,
	opts Options) ([]string, error)

Generate writes one SBOM sidecar per requested format next to artifactPath. Returns the list of sidecar paths written, or an error if generation fails. If SBOM generation is disabled (empty Formats), returns empty list and nil error.

Types

type CycloneDXBOM 

type CycloneDXBOM struct {
	BOMFormat          string                 `json:"bomFormat"`
	SpecVersion        string                 `json:"specVersion"`
	SerialNumber       string                 `json:"serialNumber"`
	Version            int                    `json:"version"`
	Metadata           *CycloneDXMetadata     `json:"metadata,omitempty"`
	Components         []*CycloneDXComponent  `json:"components,omitempty"`
	Dependencies       []*CycloneDXDependency `json:"dependencies,omitempty"`
	ExternalReferences []*CycloneDXExtRef     `json:"externalReferences,omitempty"`
}

CycloneDXBOM represents a CycloneDX 1.5 Bill of Materials.

type CycloneDXComponent 

type CycloneDXComponent struct {
	Type               string              `json:"type"`
	Name               string              `json:"name"`
	Version            string              `json:"version,omitempty"`
	Description        string              `json:"description,omitempty"`
	Licenses           []*CycloneDXLicense `json:"licenses,omitempty"`
	Purl               string              `json:"purl,omitempty"`
	ExternalReferences []*CycloneDXExtRef  `json:"externalReferences,omitempty"`
	Hashes             []*CycloneDXHash    `json:"hashes,omitempty"`
}

CycloneDXComponent represents a component in CycloneDX BOM.

type CycloneDXDependency 

type CycloneDXDependency struct {
	Ref     string   `json:"ref"`
	Depends []string `json:"depends,omitempty"`
}

CycloneDXDependency represents a dependency in CycloneDX BOM.

type CycloneDXExtRef 

type CycloneDXExtRef struct {
	Type   string           `json:"type"`
	URL    string           `json:"url"`
	Hashes []*CycloneDXHash `json:"hashes,omitempty"`
}

CycloneDXExtRef represents an external reference in CycloneDX BOM.

type CycloneDXHash 

type CycloneDXHash struct {
	Alg   string `json:"alg"`
	Value string `json:"content"`
}

CycloneDXHash represents a hash in CycloneDX BOM.

type CycloneDXLicense 

type CycloneDXLicense struct {
	License *CycloneDXLicenseChoice `json:"license,omitempty"`
}

CycloneDXLicense represents a license in CycloneDX BOM.

type CycloneDXLicenseChoice 

type CycloneDXLicenseChoice struct {
	Name string `json:"name,omitempty"`
	ID   string `json:"id,omitempty"`
}

CycloneDXLicenseChoice represents a license choice.

type CycloneDXMetadata 

type CycloneDXMetadata struct {
	Timestamp string              `json:"timestamp,omitempty"`
	Component *CycloneDXComponent `json:"component,omitempty"`
}

CycloneDXMetadata represents metadata in CycloneDX BOM.

type Format 

type Format string

Format is the SBOM output format. 

const (
	// FormatCycloneDX represents CycloneDX 1.5 JSON format.
	FormatCycloneDX Format = "cyclonedx"
	// FormatSPDX represents SPDX 2.3 JSON format.
	FormatSPDX Format = "spdx"
)

type Options 

type Options struct {
	// Formats is a list of SBOM formats to generate.
	// Empty list means no SBOM generation.
	Formats []Format
}

Options controls SBOM generation.

type SPDXCreationInfo 

type SPDXCreationInfo struct {
	Created            string   `json:"created"`
	Creators           []string `json:"creators"`
	LicenseListVersion string   `json:"licenseListVersion,omitempty"`
}

SPDXCreationInfo represents creation information in SPDX document.

type SPDXDocument 

type SPDXDocument struct {
	SPDXVersion       string              `json:"spdxVersion"`
	DataLicense       string              `json:"dataLicense"`
	SPDXID            string              `json:"SPDXID"`
	Name              string              `json:"name"`
	DocumentNamespace string              `json:"documentNamespace"`
	CreationInfo      *SPDXCreationInfo   `json:"creationInfo"`
	Packages          []*SPDXPackage      `json:"packages,omitempty"`
	Relationships     []*SPDXRelationship `json:"relationships,omitempty"`
}

SPDXDocument represents an SPDX 2.3 document.

type SPDXExternalRef 

type SPDXExternalRef struct {
	ReferenceCategory string `json:"referenceCategory"`
	ReferenceType     string `json:"referenceType"`
	ReferenceLocator  string `json:"referenceLocator"`
}

SPDXExternalRef represents an external reference in SPDX package.

type SPDXPackage 

type SPDXPackage struct {
	SPDXID             string             `json:"SPDXID"`
	Name               string             `json:"name"`
	Version            string             `json:"versionInfo,omitempty"`
	Description        string             `json:"description,omitempty"`
	DownloadLocation   string             `json:"downloadLocation"`
	FilesAnalyzed      bool               `json:"filesAnalyzed"`
	LicenseConcluded   string             `json:"licenseConcluded,omitempty"`
	LicenseDeclared    string             `json:"licenseDeclared,omitempty"`
	CopyrightText      string             `json:"copyrightText,omitempty"`
	ExternalReferences []*SPDXExternalRef `json:"externalReferences,omitempty"`
}

SPDXPackage represents a package in SPDX document.

type SPDXRelationship 

type SPDXRelationship struct {
	SpdxElementID      string `json:"spdxElementId"`
	RelationshipType   string `json:"relationshipType"`
	RelatedSpdxElement string `json:"relatedSpdxElement"`
}

SPDXRelationship represents a relationship in SPDX document.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.