spdxextract

package

v0.1.0 Latest Latest Go to latest Published: Nov 2, 2025 License: MIT Imports: 3 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/boringbin/sbomattr

Links

Open Source Insights

Documentation ¶

Overview ¶

Package spdxextract provides parsing and extraction functionality for SPDX SBOMs.

It uses the official spdx/tools-golang library for parsing SPDX SBOMs.

Index ¶

func ExtractPackages(doc *Document) []attribution.Attribution
type Document
- func ParseSBOM(data []byte) (*Document, error)
type ExternalRef
type Package

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func ExtractPackages ¶

func ExtractPackages(doc *Document) []attribution.Attribution

ExtractPackages extracts a simplified list of packages from an SPDX document. It returns a slice of Attribution structs containing name, version, purl, and license information.

Types ¶

type Document ¶

type Document struct {
	SPDXVersion string    `json:"spdxVersion"`
	SPDXID      string    `json:"SPDXID"`
	Packages    []Package `json:"packages"`
}

Document represents a minimal SPDX document with only the fields we need.

func ParseSBOM ¶

func ParseSBOM(data []byte) (*Document, error)

ParseSBOM parses SPDX JSON data from the given byte slice. It supports both standard SPDX format and GitHub-wrapped format ({"sbom": {...}}). It returns the parsed SPDX document or an error if parsing fails.

type ExternalRef ¶

type ExternalRef struct {
	ReferenceCategory string `json:"referenceCategory"`
	ReferenceType     string `json:"referenceType"`
	ReferenceLocator  string `json:"referenceLocator"`
}

ExternalRef represents an external reference (like purl).

type Package ¶

type Package struct {
	Name             string        `json:"name"`
	VersionInfo      string        `json:"versionInfo"`
	Homepage         string        `json:"homepage"`
	LicenseConcluded string        `json:"licenseConcluded"`
	LicenseDeclared  string        `json:"licenseDeclared"`
	ExternalRefs     []ExternalRef `json:"externalRefs"`
}

Package represents a minimal SPDX package with only the fields we need.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL