Documentation
¶
Overview ¶
Package sbom provides format-agnostic helpers for reading SBOM files produced by the cdx16 and spdx30 sub-packages.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ReadDirectDeps ¶
ReadDirectDeps sniffs the SBOM format from the JSON payload and returns the deduped, sorted analysis-identifier keys for direct (depth=1) dependencies.
Types ¶
type DirectDep ¶
type DirectDep struct {
Key string
Location *models.LocationInfo
}
DirectDep pairs an analysis-identifier key with optional manifest-source provenance. Location is nil when the SBOM did not record it.
func ReadDirectDepsWithLocations ¶
ReadDirectDepsWithLocations is the same as ReadDirectDeps but also returns each direct dep's manifest-file provenance when the SBOM carries it.
type Package ¶ added in v0.1.3
type Package struct {
Key string
Ecosystem string
Name string
Version string
PURL string
Location *models.LocationInfo
Deps []string
}
Package is one enumerated SBOM package, format-agnostic, for display. The ecosystem is recovered from the analysis-identifier key so it matches the names used elsewhere in the tool (npm, pypi, rubygems…) rather than a purl type (gem, golang…). Deps holds the analysis keys of this package's own dependencies, so callers can walk the graph as a tree.
type Summary ¶ added in v0.1.3
type Summary struct {
Format string // "CycloneDX" or "SPDX"
SpecVersion string
Tool string
RootName string
RootDeps []string
Packages []Package
}
Summary is a format-agnostic, human-readable view of a parsed SBOM: the format and spec version, the generating tool, the root component, the root's direct dependency keys (RootDeps), and every enumerated package (root excluded). RootDeps plus each package's Deps form the dependency graph.
func ReadSummary ¶ added in v0.1.3
ReadSummary sniffs the SBOM format from the JSON payload and returns a format-agnostic Summary: metadata, the dependency graph, and every enumerated package (excluding the root), sorted by ecosystem then name then version.
Source Files
Directories