sbom

type BuildOptions struct {
	DocumentName    string
	DocumentNS      string
	ToolName        string
	ToolNames       []string
	Created         time.Time
	RootComponentID string
	SerialNumber    string

	// Registry, when non-nil, supplies matching-stage enrichment (licenses,
	// vulnerabilities, CPEs, digests, EOL) resolved by PURL and folded onto
	// each component during projection.
	Registry *sdk.PackageRegistry
}

type Component struct {
	ID             string
	Name           string
	Version        string
	Scope          string
	PURL           string
	Ecosystem      string
	PackageManager string
	Type           string
	Copyright      string
	Licenses       []License

	// Matching-stage enrichment (populated when BuildOptions.Registry is set).
	CPEs            []string
	Digests         []Digest
	Vulnerabilities []Vulnerability
	EOL             *EOL
}

type Dependency struct {
	Ref       string
	DependsOn []string
}

type Digest struct {
	Algorithm string
	Value     string
}

type Document struct {
	Name         string
	Namespace    string
	Tool         string
	Tools        []string
	Created      time.Time
	SerialNumber string

	Components   []Component
	Dependencies []Dependency
	Roots        []string
}

type EOL struct {
	EOL           bool
	EOLDate       string
	Cycle         string
	LatestVersion string
}

type EncodeOptions struct {
	Pretty bool
}

type License struct {
	Value          string
	SPDXExpression string
	Type           string
}

type Target string

type Vulnerability struct {
	ID            string
	Source        string
	Severity      string
	Score         *float64
	Vector        string
	Method        string
	CWEs          []int
	FixedVersions []string
	Advisories    []string
	Description   string
}