Documentation
¶
Overview ¶
Package report builds the files an export writes beside its archive: manifest.json, findings.csv and summary.md.
Index ¶
Constants ¶
const ManifestFormatVersion = 1
ManifestFormatVersion is the current schema version of manifest.json. It changes only when a field is added, removed or reinterpreted.
Variables ¶
var FindingsHeader = []string{
"dependency", "current_version", "selected_version",
"package", "package_version", "vulnerability_id",
"severity", "status", "fixed_version", "title",
}
FindingsHeader is the exact column order findings.csv commits to.
Functions ¶
func WriteFindingsCSV ¶
func WriteFindingsCSV(w io.Writer, rows []FindingsRow) error
WriteFindingsCSV writes findings.csv: the header followed by rows sorted by dependency, then vulnerability ID, then package, so the same input always gives the same file.
Types ¶
type ArchiveManifest ¶
ArchiveManifest describes the archive file itself.
type DependencyChange ¶
type DependencyChange struct {
Name string
CurrentVersion string
SelectedVersion string
Before rank.Vector
After rank.Vector
}
DependencyChange is one updated dependency's row in summary.md.
type DependencyResolution ¶
type DependencyResolution struct {
Name string
CurrentVersion string
SelectedVersion string
CurrentKeys []string
SelectedKeys []string
}
DependencyResolution names one dependency's current and selected resolutions as rank.Index keys ("name@version"), so FindingsRows can compare them.
type FindingsRow ¶
type FindingsRow struct {
Dependency string
CurrentVersion string
SelectedVersion string
Package string
PackageVersion string
VulnerabilityID string
Severity rank.Severity
Status rank.Status
FixedVersion string
Title string
}
FindingsRow is one line of findings.csv: one dependency update paired with one vulnerability affecting one package of its resolution.
func FindingsRows ¶
func FindingsRows(ix rank.Index, deps []DependencyResolution) []FindingsRow
FindingsRows expands ix into one row per dependency, status and affected package. rank.Index.Set collapses several packages carrying the same vulnerability ID into the worst one; this instead keeps every affected package, because findings.csv reports one row per affected package.
type Manifest ¶
type Manifest struct {
FormatVersion int `json:"formatVersion"`
ToolVersion string `json:"toolVersion"`
AnalysisID string `json:"analysisId"`
CreatedAt time.Time `json:"createdAt"`
Target store.Target `json:"target"`
Archive ArchiveManifest `json:"archive"`
Packages []PackageEntry `json:"packages"`
}
Manifest is the content of an export's manifest.json: what the archive holds and what it was built from.
type PackageEntry ¶
type PackageEntry struct {
Name string `json:"name"`
Version string `json:"version"`
File string `json:"file"`
OriginalIntegrity string `json:"originalIntegrity"`
ShippedSHA512 string `json:"shippedSha512"`
PublishConfigStripped bool `json:"publishConfigStripped"`
}
PackageEntry describes one tarball the archive carries.
type SignalNote ¶
SignalNote is a non-blocking signal on a selected version, shown so the reader sees what the export accepted even though it did not block the candidate.
type Summary ¶
type Summary struct {
AnalysisDate time.Time
TrivyDBDate time.Time
TrivyVersion string
ToolVersion string
Target store.Target
Before rank.Vector
After *rank.Vector // nil when the analysis' combined check never ran
Dependencies []DependencyChange
RemainingCritical []rank.Finding
RemainingHigh []rank.Finding
Signals []SignalNote
ArchiveSize int64
ArchiveSHA256 string
PackageCount int
}
Summary is the content of an export's summary.md.
Source Files