Documentation
¶
Overview ¶
Package composer implements dependency extraction for PHP codebases managed by Composer. The lockfile is the richest in mainstream use: resolved versions, the dependency graph, licenses, descriptions, homepages and the exact git commit of every package are all in it, so extraction is offline and licenses need no enrichment at all.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ExtractInstalled ¶
ExtractInstalled reads every installed Composer environment on a filesystem and returns their merged graph, or (nil, nil) when the filesystem holds none.
Types ¶
type ComposerDist ¶
type ComposerDist struct {
Type string `json:"type"`
URL string `json:"url"`
Reference string `json:"reference"`
// Shasum is the archive's SHA-1 — when the registry states one, which
// Packagist does not: its archives are built from the source commit,
// and the commit is the integrity anchor.
Shasum string `json:"shasum"`
}
ComposerDist points at a package's installable archive.
type ComposerJSON ¶
type ComposerJSON struct {
Name string `json:"name"`
Version string `json:"version"`
Description string `json:"description"`
Homepage string `json:"homepage"`
Require map[string]string `json:"require"`
RequireDev map[string]string `json:"require-dev"`
// RawLicense is a string or a list; Licenses() reads both.
RawLicense json.RawMessage `json:"license"`
}
ComposerJSON is the manifest, read for what the lock does not carry: the project's own identity and which requirements are direct.
func ParseComposerJSON ¶
func ParseComposerJSON(data []byte) (*ComposerJSON, error)
ParseComposerJSON reads a composer.json document.
func ReadComposerJSON ¶
func ReadComposerJSON(workDir string) (*ComposerJSON, error)
ReadComposerJSON reads a composer.json from a directory.
func (*ComposerJSON) Licenses ¶
func (m *ComposerJSON) Licenses() []string
Licenses returns the manifest's license declaration, which the schema allows as one identifier or a list of them.
type ComposerLock ¶
type ComposerLock struct {
// Packages are what the project needs; PackagesDev what development
// additionally needs. The partition is Composer's own.
Packages []*ComposerPackage `json:"packages"`
PackagesDev []*ComposerPackage `json:"packages-dev"`
ContentHash string `json:"content-hash"`
}
ComposerLock is a parsed composer.lock.
func ParseComposerLock ¶
func ParseComposerLock(data []byte) (*ComposerLock, error)
ParseComposerLock reads a composer.lock document.
func ParseInstalledJSON ¶
func ParseInstalledJSON(data []byte) (*ComposerLock, error)
ParseInstalledJSON reads an installed.json document, in either generation's shape, into the lock structure everything else builds from.
func ReadComposerLock ¶
func ReadComposerLock(workDir string) (*ComposerLock, error)
ReadComposerLock reads a composer.lock from a directory.
type ComposerPackage ¶
type ComposerPackage struct {
// Name is vendor/name, Composer's two-part identity.
Name string `json:"name"`
Version string `json:"version"`
// Source is where the package's code lives — for registry packages a
// git repository and the exact commit — and Dist the archive an
// install downloads.
Source ComposerSource `json:"source"`
Dist ComposerDist `json:"dist"`
// Require maps requirement names to constraints: the edges. Platform
// requirements (php, extensions) appear here too, slash-less.
Require map[string]string `json:"require"`
License []string `json:"license"`
Description string `json:"description"`
Homepage string `json:"homepage"`
}
ComposerPackage is one locked package.
type ComposerSource ¶
type ComposerSource struct {
Type string `json:"type"`
URL string `json:"url"`
Reference string `json:"reference"`
}
ComposerSource points at a package's code.
type Decomposer ¶
type Decomposer struct{}
Decomposer reads dependency data from PHP codebases managed by Composer.
func (*Decomposer) DefaultOptions ¶
func (d *Decomposer) DefaultOptions() any
DefaultOptions returns the driver-level options used when none are set.
func (*Decomposer) Extract ¶
func (d *Decomposer) Extract(opts *api.DecomposerOptions) (*sbom.NodeList, error)
Extract reads composer.lock and composer.json and builds the graph.
func (*Decomposer) FindCodeBases ¶
func (d *Decomposer) FindCodeBases(index *code.PathIndex) ([]string, error)
FindCodeBases locates PHP codebases by their composer.lock files.
func (*Decomposer) Requirements ¶
func (d *Decomposer) Requirements(_ *api.DecomposerOptions) []api.Requirement
Requirements returns nothing: extraction is pure Go, offline.
Source Files