sbom

package
v1.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 20, 2026 License: AGPL-3.0 Imports: 10 Imported by: 0

Documentation

Overview

Package sbom builds a human-readable software bill of materials for a Factum release: every Go module in the module graph plus production npm packages locked for the Vue GUI.

Index

Constants

View Source 
const GeneratedMarker = "<!-- factum-sbom: generated -->"

GeneratedMarker is written at the top of a generated inventory so a release binary can tell a real SBOM from the placeholder file that keeps `go build -tags release` compiling between builds.

Variables

This section is empty.

Functions

func FindRepoRoot 

func FindRepoRoot(dir string) (string, error)

FindRepoRoot walks up from dir (or the process cwd) until it finds this module's go.mod.

func Generate 

func Generate(repoRoot string, meta Meta) (string, error)

Generate runs `go list -m -json all` and reads the GUI lockfile under repoRoot, then renders the inventory markdown. Empty Meta fields are filled from git / the running Go toolchain.

func Markdown 

func Markdown(meta Meta, modules []GoModule, npm []NPMPackage) string

Markdown renders the operator-facing inventory page (no YAML front matter; docs.Get keeps title/order from docs/user/sbom.md).

Types

type GoModule 

type GoModule struct {
	Path           string
	Version        string
	Indirect       bool
	ReplacePath    string
	ReplaceVersion string
}

GoModule is one module from `go list -m -json all` (the main module is omitted from the table; it is named in the heading).

func ParseGoListJSON 

func ParseGoListJSON(r io.Reader) ([]GoModule, error)

ParseGoListJSON reads concatenated JSON objects from `go list -m -json all` and returns every module except the main module.

type Meta 

type Meta struct {
	Version   string
	Commit    string
	Date      string
	GoVersion string
}

Meta is the release identity stamped into the inventory heading.

type NPMPackage 

type NPMPackage struct {
	Name    string
	Version string
	License string
	// Tree is "direct", "transitive", "development", or
	// "development (transitive)".
	Tree string
}

NPMPackage is one package from package-lock.json (v2/v3 `packages` map).

func ParseNPMLock 

func ParseNPMLock(data []byte) ([]NPMPackage, error)

ParseNPMLock reads an npm lockfile v2/v3 `packages` map and returns every non-link package, unique by name@version.

Source Files

View all Source files

Directories

Path Synopsis
Command gensbom writes the release software-bill-of-materials markdown that factum2-web embeds under -tags release.
 Command gensbom writes the release software-bill-of-materials markdown that factum2-web embeds under -tags release.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.