Documentation
¶
Overview ¶
Package baseline implements portable, package-specific finding suppression.
Index ¶
- Constants
- func ResolvePath(selection string, target sdk.ExecutionTarget) (path string, required, ok bool, err error)
- func WriteAtomic(path string, document Document, replace bool) error
- type Document
- func Load(path string) (Document, error)
- func NewDocument(findings []sdk.Finding, registry *sdk.PackageRegistry) Document
- func Prune(existing Document, current []sdk.Finding, registry *sdk.PackageRegistry) Document
- func Update(existing Document, current []sdk.Finding, registry *sdk.PackageRegistry) Document
- type Entry
- type LoadResult
- type Resolver
Constants ¶
const ( // SchemaVersion is the current baseline document schema. SchemaVersion = "bomly.finding-baseline/v1" // DefaultRelativePath is the conventional project baseline location. DefaultRelativePath = ".bomly/baseline.json" )
Variables ¶
This section is empty.
Functions ¶
func ResolvePath ¶
func ResolvePath(selection string, target sdk.ExecutionTarget) (path string, required, ok bool, err error)
ResolvePath resolves a baseline selection for an execution target. The required result distinguishes explicit paths from optional auto-discovery.
Types ¶
type Document ¶
type Document struct {
SchemaVersion string `json:"schema_version"`
Entries []Entry `json:"entries"`
}
Document is a portable collection of package-specific finding entries.
func NewDocument ¶
func NewDocument(findings []sdk.Finding, registry *sdk.PackageRegistry) Document
NewDocument constructs a deterministic document from findings.
func Prune ¶
Prune removes entries that are not present in a complete current scan and never adds findings that have not already been accepted.
type Entry ¶
type Entry struct {
PackageRef string `json:"package_ref"`
Kind sdk.FindingKind `json:"kind"`
Auditor string `json:"auditor"`
RuleID string `json:"rule_id,omitempty"`
AdvisoryIDs []string `json:"advisory_ids,omitempty"`
Severity sdk.SeverityLevel `json:"severity,omitempty"`
PolicyStatus sdk.FindingPolicyStatus `json:"policy_status,omitempty"`
Reachability sdk.ReachabilityStatus `json:"reachability,omitempty"`
}
Entry identifies one package finding that may be suppressed.
func EntryFromFinding ¶
func EntryFromFinding(finding sdk.Finding, registry *sdk.PackageRegistry) Entry
EntryFromFinding constructs a portable entry from a finding and registry.
type LoadResult ¶
type LoadResult struct {
Resolvers []sdk.FindingPolicyResolver
Path string
Entries int
Automatic bool
}
LoadResult describes a baseline discovered for one execution target.
func ResolversForTarget ¶
func ResolversForTarget(selection string, target sdk.ExecutionTarget, logger *zap.Logger) (LoadResult, error)
ResolversForTarget discovers or loads the selected baseline for target.
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver applies a validated baseline during the audit stage.
func NewResolver ¶
NewResolver validates document and constructs a policy-status resolver.
func (*Resolver) ResolveFindingPolicy ¶
func (r *Resolver) ResolveFindingPolicy(_ context.Context, finding sdk.Finding, registry *sdk.PackageRegistry) (sdk.FindingPolicyDecision, bool)
ResolveFindingPolicy accepts a finding when a compatible package entry exists.
Source Files