elfgraph

type DlopenPolicy string

type FileSet struct {
	// ELF are the object files the package installs.
	ELF []string
	// Reachable are the ones the closure loads.
	Reachable []string
}

type Graph struct {
	// contains filtered or unexported fields
}

type Info struct {
	Class   elf.Class   `json:"class"`
	Machine elf.Machine `json:"machine"`
	Type    elf.Type    `json:"type"`

	// Interp is the PT_INTERP path -- the program interpreter. Empty means the
	// kernel would load this file directly, with no dynamic linker involved.
	Interp string `json:"interp,omitempty"`

	// Dynamic reports whether the file has a PT_DYNAMIC segment.
	Dynamic bool `json:"dynamic"`

	Soname  string   `json:"soname,omitempty"`
	Needed  []string `json:"needed,omitempty"`
	RPath   []string `json:"rpath,omitempty"`
	RunPath []string `json:"runpath,omitempty"`

	// Dlopen reports that this object imports dlopen or dlmopen, so its real
	// dependency set is decided at runtime by strings this package cannot read.
	Dlopen bool `json:"dlopen,omitempty"`
}

type Node struct {
	// Path is the tree-absolute path with every symlink already resolved, so
	// two names for one file are one node. Callers holding a path from
	// somewhere else -- a dpkg file list, say -- must put it through Canon
	// before looking it up, because dpkg records the pre-usrmerge /lib name for
	// files that now live under /usr/lib.
	Path string `json:"path"`

	Info *Info `json:"info"`

	// Root marks an object the closure starts from, with Why saying which rule
	// put it there and Kind saying how much that rule is worth.
	Root bool     `json:"root,omitempty"`
	Why  string   `json:"why,omitempty"`
	Kind RootKind `json:"root_kind,omitempty"`

	// Reachable is the answer this package exists to produce.
	Reachable bool `json:"reachable"`

	// Needed maps each DT_NEEDED soname to the node that satisfied it, or ""
	// when nothing did.
	Needed map[string]string `json:"needed,omitempty"`

	// NeededBy lists the objects that pulled this one in, which is the
	// explanation a reader wants when a finding says "reachable".
	NeededBy []string `json:"needed_by,omitempty"`
}

type Options struct {
	// Config is the image configuration. Entrypoint, Cmd, Env and WorkingDir
	// are all load-bearing: they decide the roots, the LD_LIBRARY_PATH, and how
	// a relative argv[0] resolves.
	Config target.ImageConfig

	// Roots are extra tree-absolute paths to treat as executed, from --roots.
	// This is the escape hatch for an image whose real entrypoint comes from
	// outside the config -- a Kubernetes command override, an init system.
	Roots []string

	// DlopenPolicy decides whether a reachable dlopen blocks conclusions.
	DlopenPolicy DlopenPolicy

	// ReadELF loads ELF metadata. Defaults to the debug/elf-backed reader.
	ReadELF Reader

	Logf func(string, ...any)
}

type Reader func(fsys target.RootFS, name string) (*Info, error)

type RootKind int

type SymbolReader func(fsys target.RootFS, name string) (defined, undefined []string, err error)

type Taint struct {
	Kind TaintKind `json:"kind"`

	// Detail is the human-readable statement of what was observed.
	Detail string `json:"detail"`

	// Path is the object that caused it, when there is one.
	Path string `json:"path,omitempty"`

	// Soname scopes an unresolved-needed taint to the library that went
	// missing. Conclusions about every other library are unaffected by it.
	Soname string `json:"soname,omitempty"`

	// Blocking says whether this taint stops a not_affected conclusion.
	// Blocking is a field rather than a property of Kind because
	// --dlopen-policy=assume-none demotes a dlopen taint to a note: the user
	// asserted the risk away, and the record should still show it was there.
	Blocking bool `json:"blocking"`

	// Global says the taint applies to every package rather than to the
	// scope named by Path or Soname.
	Global bool `json:"global,omitempty"`
}

type TaintKind string