Documentation
¶
Overview ¶
Package vexload resolves the VEX sources a descriptor names into documents a run can apply.
Separate from pkg/vex, which parses and matches, and separate from pkg/engine, which applies. Resolving is the part that touches the world — a file, an HTTPS fetch, a git clone — and the engine deliberately reaches the network only through the scanners it runs. Keeping this out of it is what lets a scan stay something you can reason about offline.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Loader ¶
type Loader struct {
// Client fetches URL sources. nil uses a client with fetchTimeout.
Client *http.Client
// Checkout clones a repository and returns the tree plus a cleanup. nil uses internal/git.
Checkout func(ctx context.Context, url, ref string) (dir string, revision string, cleanup func(), err error)
// Now is the clock, for the ReadAt stamp.
Now func() time.Time
}
Loader resolves sources. The zero value works; the fields exist so a test can supply its own transport and checkout without reaching the network.
func (*Loader) Load ¶
Load resolves every source a descriptor names.
One error per source that could not be read, joined — rather than the first. A run configured with four supplier documents and two bad paths should be told about both, because the operator fixing them is going to fix them together.
A source that cannot be read is an error and never a silent skip. The alternative is a scan that reports fewer findings than the last one for a reason nothing states, which reads exactly like a codebase that improved.
Source Files