Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RegisterUnpacker ¶ added in v0.3.0
func RegisterUnpacker(subjectType string, builder UnpackerBuilder)
RegisterUnpacker registers an unpacker builder for a subject type. Calling it more than once for the same subject type replaces the previous builder.
Types ¶
type DecomposableSubject ¶ added in v0.3.0
type DecomposableSubject interface {
// DecomposableType returns a stable identifier for the kind of subject
// (e.g. "codebase", "sbom", "artifact"). The registry uses it to locate the
// unpacker capable of processing the subject.
DecomposableType() string
}
DecomposableSubject abstracts anything that can yield dependency data: a codebase, an SBOM, an artifact, a filesystem, a container image, etc. An Unpacker consumes subjects, and the registry routes a subject to the unpacker that knows how to process its type.
The interface is intentionally minimal for now. Concrete subject types carry their own access details (a path, a reader, an image reference) which the unpacker that handles them type-asserts to.
type Decomposer ¶
type Decomposer interface {
Extract(*DecomposerOptions) (*sbom.NodeList, error)
Requirements(*DecomposerOptions) []Requirement
DefaultOptions() any
}
Decomposer is an interface that abstracts the logic of dependency extraction from a codebase.
type DecomposerOptions ¶
type DecomposerOptions struct {
WorkDir string
// Version is the version to use on the resulting root nodes after decomposing
Version string
// CommitHash captures the hash of the last commit when running in a repository
CommitHash string
// Networking controls how much network access decomposers are allowed.
// Defaults to NetworkEssential.
Networking NetworkLevel
// Platform is the platform dependency data is resolved for, stated as
// os or os/arch in Go's vocabulary ("linux/arm64"). Empty means the
// platform unpack runs on. Ecosystems whose dependency graphs are
// platform-conditional (Python markers, Go build constraints) read it;
// the rest resolve the same graph everywhere and ignore it.
Platform string
// IncludeDev includes development/test dependencies in the output.
// Maps to: Maven test scope, npm devDependencies, Rust dev-dependencies.
IncludeDev bool
// IncludeBuild includes build tool dependencies in the output.
// Maps to: Maven build plugins, Rust build-dependencies.
IncludeBuild bool
// IncludeOptional includes optional dependencies in the output.
// Maps to: Maven optional deps, npm optionalDependencies.
IncludeOptional bool
// IncludeFiles instructs system-package decomposers to also emit nodes for
// the files installed by each package and relate them to the package via a
// "contains" edge. Source decomposers ignore this flag.
IncludeFiles bool
// contains filtered or unexported fields
}
DecomposerOptions is the options set that goes into an Extract() run in a decomposer. They are meant to be ephimeral, for the invocation only, and derived from the Unpacker configuration whe invoked from there.
func (*DecomposerOptions) GetDriverOptions ¶
func (so *DecomposerOptions) GetDriverOptions(dec Decomposer) any
func (*DecomposerOptions) SetDriverOptions ¶
func (so *DecomposerOptions) SetDriverOptions(dec Decomposer, opts any)
type NetworkLevel ¶ added in v0.2.1
type NetworkLevel int
NetworkLevel controls how much network access the decomposers are allowed to use.
const ( // NetworkEssential is the default (zero value). Enables network calls // that are essential for building the dependency tree plus lightweight // metadata requests (e.g., deps.dev, checksum files, crates.io API). NetworkEssential NetworkLevel = iota // NetworkFull enables all network calls including downloading full // artifacts for hash computation and zip archives for license // classification. Prioritizes data completeness over bandwidth. NetworkFull // NetworkDisabled disables all network calls. Only local data is used. // Some decomposers may produce incomplete results or fail entirely. NetworkDisabled NetworkLevel = -1 )
type Requirement ¶
Requirement
type SourceDecomposer ¶
type SourceDecomposer interface {
// FindCodeBases reads a path index and locates any directories that
// contain a codebase that a decomposer understands. Typically this
// will be the root directory, but there may be cases where a directory
// contains many, for example in a monorepo structure.
FindCodeBases(*code.PathIndex) ([]string, error)
}
SourceDecomposer is a decomposer that reads data from a codebase.
type Unpacker ¶ added in v0.3.0
type Unpacker interface {
// Extract reads dependency data from the given subject and returns the
// resulting nodelists.
Extract(context.Context, DecomposableSubject) ([]*sbom.NodeList, error)
// RegisterDecomposer adds a decomposer to the unpacker.
RegisterDecomposer(Decomposer)
// UnregisterDecomposer removes a decomposer from the unpacker.
UnregisterDecomposer(Decomposer)
}
Unpacker is the entry point for dependency extraction. An unpacker knows about one kind of subject matter (codebases, SBOMs, artifacts, ...) and uses Decomposers to crack open the different flavors of that subject.
While processing its subject, an unpacker may discover child subjects that contain further dependency data (e.g. a filesystem that contains codebases, or a container image that contains an OS package database). It dispatches those child subjects to the unpacker that handles them by looking them up in the registry (see UnpackerFor), so extraction composes recursively.
func UnpackerFor ¶ added in v0.3.0
func UnpackerFor(subject DecomposableSubject) (Unpacker, error)
UnpackerFor returns a new unpacker capable of processing the given subject, or an error if no unpacker is registered for the subject's type. This is the routing mechanism unpackers use to dispatch child subjects they discover.
type UnpackerBuilder ¶ added in v0.3.0
type UnpackerBuilder func() Unpacker
UnpackerBuilder returns a new, ready-to-use Unpacker instance.
Source Files