Documentation
¶
Index ¶
- Variables
- func BuildInfoComponents(info *buildinfo.BuildInfo, filePath string, scope altshiftSbomTypes.Scope) []*altshiftSbomTypes.Component
- func ContainerComponent(reference string, analysis *image.Analysis, scope altshiftSbomTypes.Scope) *altshiftSbomTypes.Component
- func DescribeJson(ctx context.Context, store *image.Store, sources *Sources) ([]byte, []string, error)
- func DockerfileImages(stages []*Stage) ([]string, string)
- func GenerateBom(subject *altshiftSbomTypes.Component, ...) (*altshiftSbomTypes.Bom, error)
- func GenerateBomJson(subject *altshiftSbomTypes.Component, ...) ([]byte, error)
- func ImageComponents(analysis *image.Analysis, scope altshiftSbomTypes.Scope) ([]*altshiftSbomTypes.Component, error)
- func Nest(container *altshiftSbomTypes.Component, ...) *altshiftSbomTypes.Component
- func ParseDockerfile(data []byte) ([]*altshiftSbomTypes.Component, error)
- func ParseGoModules(goListOutput []byte) ([]*altshiftSbomTypes.Component, error)
- func ParseGoSum(data []byte) ([]*altshiftSbomTypes.Component, error)
- func ParseNodePackageLock(data []byte) ([]*altshiftSbomTypes.Component, error)
- type Description
- type Sources
- type Stage
Constants ¶
This section is empty.
Variables ¶
var ErrBomRefConflict = errors.New("bom-ref conflict")
ErrBomRefConflict reports two different components claiming the same bom-ref.
Functions ¶
func BuildInfoComponents ¶ added in v1.29.0
func BuildInfoComponents(info *buildinfo.BuildInfo, filePath string, scope altshiftSbomTypes.Scope) []*altshiftSbomTypes.Component
BuildInfoComponents lists what a Go executable was built from, as its embedded build info records it: the main module (an application), the standard library at the Go version used, and each dependency module at the version linked (replacements taken into account). It is what a go.sum can only over-approximate. filePath, when given, is recorded on every component as where the executable was found.
func ContainerComponent ¶ added in v1.29.0
func ContainerComponent(reference string, analysis *image.Analysis, scope altshiftSbomTypes.Scope) *altshiftSbomTypes.Component
ContainerComponent describes a container image. The analysis, when given, contributes the image's identity (its repo tag and ID); the reference is the image as named by the caller or the Dockerfile.
func DescribeJson ¶ added in v1.30.0
func DescribeJson(ctx context.Context, store *image.Store, sources *Sources) ([]byte, []string, error)
DescribeJson describes the sources and assembles the CycloneDX JSON of the result.
func DockerfileImages ¶ added in v1.29.0
DockerfileImages tells the images a Dockerfile builds with: the ones its intermediate stages start from (build images) and the one its final stage starts from (the base of the built image), with stage references resolved to the image the referenced stage started from and "scratch" (an empty base) left out. The final base is not among the build images.
func GenerateBom ¶
func GenerateBom(subject *altshiftSbomTypes.Component, components []*altshiftSbomTypes.Component) (*altshiftSbomTypes.Bom, error)
GenerateBom assembles a CycloneDX BOM. The subject, when given, is what the components describe (e.g. the built container image) and becomes the BOM's metadata component. Components sharing a bom-ref are merged when they agree and rejected when they do not; the result is ordered by bom-ref.
func GenerateBomJson ¶
func GenerateBomJson(subject *altshiftSbomTypes.Component, components []*altshiftSbomTypes.Component) ([]byte, error)
func ImageComponents ¶ added in v1.29.0
func ImageComponents(analysis *image.Analysis, scope altshiftSbomTypes.Scope) ([]*altshiftSbomTypes.Component, error)
ImageComponents lists what an image analysis found as components: the operating system, its packages, the Go executables' modules and the shipped node packages, each carrying the image, the path and the layer it was read from. Components found several times in the image (the Go standard library in every Go binary) are one component with several paths.
func Nest ¶ added in v1.29.0
func Nest(container *altshiftSbomTypes.Component, children []*altshiftSbomTypes.Component) *altshiftSbomTypes.Component
Nest places components inside a container component, prefixing their bom-refs with the container's so that the same package in two images stays two components. It returns the container.
func ParseDockerfile ¶
func ParseDockerfile(data []byte) ([]*altshiftSbomTypes.Component, error)
ParseDockerfile lists the distinct images a Dockerfile's stages start from as container components, "scratch" and references to earlier stages left out.
func ParseGoModules ¶
func ParseGoModules(goListOutput []byte) ([]*altshiftSbomTypes.Component, error)
func ParseGoSum ¶
func ParseGoSum(data []byte) ([]*altshiftSbomTypes.Component, error)
func ParseNodePackageLock ¶
func ParseNodePackageLock(data []byte) ([]*altshiftSbomTypes.Component, error)
Types ¶
type Description ¶ added in v1.30.0
type Description struct {
Subject *altshiftSbomTypes.Component
Components []*altshiftSbomTypes.Component
// Warnings tell what was seen but not listed, prefixed with the image or input it concerns.
Warnings []string
}
Description is what an SBOM holds before it is assembled: its subject, its components, and what could not be listed.
type Sources ¶ added in v1.30.0
type Sources struct {
// Image is the built image, as the store knows it; it becomes the SBOM's subject and its contents required
// components.
Image string
// Dockerfile is the content of the Dockerfile the image was built from; the images its build stages start from
// are described as excluded components, the final stage's base is only named.
Dockerfile []byte
// GoBinaries are local Go executables whose linked modules to list as required components.
GoBinaries []string
// NodeLock is the content of a package-lock.json whose packages to list; development dependencies are excluded
// components.
NodeLock []byte
}
Sources names what an SBOM is to describe.
type Stage ¶ added in v1.29.0
type Stage struct {
// Image is the image the stage starts from, as written; the name of an earlier stage when the stage builds on
// that stage instead.
Image string
Alias string
Platform string
}
Stage is one FROM instruction of a Dockerfile.
func ParseDockerfileStages ¶ added in v1.29.0
ParseDockerfileStages lists the FROM instructions of a Dockerfile in order.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package image analyzes container images: it reads the files that record what an image holds — the OS package databases, os-release, Go binaries' build info, shipped node packages — and hands back plain findings.
|
Package image analyzes container images: it reads the files that record what an image holds — the OS package databases, os-release, Go binaries' build info, shipped node packages — and hands back plain findings. |
|
dockerarchive
Package dockerarchive reads container images in the docker-archive format — what `podman save --format docker-archive` writes, and `docker save` in its classic layout — as a stream, resolving the layers into the final root filesystem view of the files a caller chose to capture.
|
Package dockerarchive reads container images in the docker-archive format — what `podman save --format docker-archive` writes, and `docker save` in its classic layout — as a stream, resolving the layers into the final root filesystem view of the files a caller chose to capture. |
|
Package ospkg parses the files that record which operating-system packages an image or a system holds — the apk installed database, the dpkg status database and os-release — into plain structs.
|
Package ospkg parses the files that record which operating-system packages an image or a system holds — the apk installed database, the dpkg status database and os-release — into plain structs. |