sbom

package

v0.2.2 Latest Latest Go to latest Published: Sep 23, 2026 License: GPL-3.0 Imports: 5 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/MorganKryze/sealift

Links

Open Source Insights

Documentation ¶

Overview ¶

Package sbom writes CycloneDX software bills of materials for npm packages.

Index ¶

func PURL(name, version string) string
func WriteCycloneDX(w io.Writer, components []Component) error
type Component

Examples ¶

WriteCycloneDX

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func PURL ¶

func PURL(name, version string) string

PURL returns the package URL of an npm package, such as pkg:npm/express@4.21.2 or pkg:npm/%40esbuild/linux-x64@0.25.0.

func WriteCycloneDX ¶

func WriteCycloneDX(w io.Writer, components []Component) error

WriteCycloneDX writes a CycloneDX 1.6 JSON document listing each component once, sorted by name, then version. `trivy sbom` scans the result.

Example ¶

package main

import (
	"os"

	"github.com/MorganKryze/sealift/sbom"
)

func main() {
	_ = sbom.WriteCycloneDX(os.Stdout, []sbom.Component{{Name: "@esbuild/linux-x64", Version: "0.25.0"}})
}

Output:
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "version": 1,
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:npm/%40esbuild/linux-x64@0.25.0",
      "name": "@esbuild/linux-x64",
      "version": "0.25.0",
      "purl": "pkg:npm/%40esbuild/linux-x64@0.25.0"
    }
  ]
}

Types ¶

type Component ¶

type Component struct {
	Name    string
	Version string
}

Component is one npm package version.

Source Files ¶

View all Source files

sbom.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL