Documentation
¶
Overview ¶
Package sbom produces deterministic, typed CycloneDX inventories for service-agent Builder.SBOM implementations.
Index ¶
- Constants
- Variables
- func MarshalCycloneDXJSON(bom *agentv0.Bom) ([]byte, error)
- type Artifact
- type GolangOptions
- type Result
- func AttachArtifact(base *Result, artifact Artifact) (*Result, error)
- func Container(ctx context.Context, image string) (*Result, error)
- func Golang(ctx context.Context, dir string) (*Result, error)
- func GolangWithOptions(ctx context.Context, dir string, options GolangOptions) (*Result, error)
- func Node(_ context.Context, dir string, includeDev bool) (*Result, error)
- func Python(ctx context.Context, dir string, includeDev bool) (*Result, error)
- func Rust(ctx context.Context, dir string, includeDev bool) (*Result, error)
- func Swift(ctx context.Context, dir string) (*Result, error)
Constants ¶
const ( // SyftVersion and SyftImage pin the managed container generator used when // an operator-managed syft binary is not available. SyftVersion = "v1.48.0" SyftImage = "anchore/syft@sha256:b4f1df79f97b817682d8b5ff941eb6bfe74f6172553a5e312c75bbc2eabc405c" // SyftScratchSize bounds temporary layer extraction. 64 MiB is too small // for normal service images such as Redis once their layers are expanded. SyftScratchSize = "512m" )
Variables ¶
var ErrUnsupported = errors.New("authoritative SBOM generation is unsupported")
ErrUnsupported means the ecosystem has no authoritative lockfile or resolver available. Callers must surface this as UNSUPPORTED, never CLEAN.
Functions ¶
Types ¶
type Artifact ¶
Artifact identifies one compiled agent binary to wrap around a source-module inventory. SHA256 is the digest of the exact installed bytes.
type GolangOptions ¶ added in v0.2.24
type GolangOptions struct {
// UseWorkspace keeps the active go.work graph. It must be true when the
// package/build operation also used that Codefly-managed workspace.
UseWorkspace bool
}
GolangOptions selects the same dependency context used by the owning plugin.
type Result ¶
Result is the common output returned by ecosystem-specific generators.
func AttachArtifact ¶
AttachArtifact makes the compiled binary the SBOM subject while retaining the source module and its dependency graph beneath it.
func Container ¶
Container generates a package-level inventory for a registry image. The managed fallback is digest pinned, runs read-only, and does not mount the Docker socket or workspace into the scanner container.
func Golang ¶
Golang inventories the exact isolated module graph selected by go.mod/go.sum without mutating either file. Ambient go.work files are disabled by default.
func GolangWithOptions ¶ added in v0.2.24
GolangWithOptions inventories the module graph in the dependency context explicitly selected by the language plugin.
func Node ¶
Node inventories package-lock.json without executing lifecycle scripts or consulting the network. Lockfile v2+ is required because older files do not carry an authoritative physical package graph.
func Python ¶
Python delegates lock interpretation to uv's pinned/frozen CycloneDX 1.5 exporter. The command is read-only and fails when no authoritative uv.lock exists instead of inventorying an unrelated ambient Python environment.
Source Files