Documentation
¶
Overview ¶
Package depsdev asks deps.dev what is known about the packages a scan found.
What leaves the machine ¶
A list of package names and versions, and nothing else. No source, no findings, no descriptor. That is still a disclosure, and the control declares it, because a reader deciding whether to switch this on is entitled to know that their dependency list reaches a third party.
Why the cache is an hour ¶
The service permits caching in its own documentation and the Google API Terms of Service cap a cached copy at what the response's cache header allows. That header says `max-age=3600`, so an hour is the contract rather than a tuning choice, and a longer one would need a different source for the same data rather than a larger number here.
An hour is enough for the case that matters: a developer running a scan repeatedly while fixing something pays for one lookup. It is not enough for an air-gapped run, which this signal therefore does not claim to support.
Index ¶
Constants ¶
const CacheTTL = time.Hour
CacheTTL is how long a response may be kept. Set by the API's own cache header; see the package comment before changing it, because this is a term rather than a preference.
const Host = "api.deps.dev"
Host is what the control declares it contacts.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
HTTP *http.Client
// Now is the clock, injectable so a test can age the cache without sleeping.
Now func() time.Time
// Endpoint overrides where requests go. Empty means the real service; a test points this at
// its own server rather than at somebody else's, because a unit test that depends on a third
// party is a test that fails when their week goes badly.
Endpoint string
// contains filtered or unexported fields
}
Client looks packages up, through a cache.
func (*Client) Lookup ¶
Lookup answers for as many of these packages as the service indexes.
A purl in an ecosystem deps.dev does not cover is skipped rather than reported as an error: a container image is mostly operating-system packages, and a run that failed because Debian is not indexed would fail every time on most projects.
The error is returned only when the service could not be reached at all. A caller should report that and carry on: this signal never gates, so a lookup that did not happen must cost a reader a line of evidence rather than a verdict.
type Key ¶
type Key struct {
System, Name, Version string
}
Key identifies one package version to the service.
func Parse ¶
Parse turns a purl into the identifiers deps.dev wants, and reports whether it indexes that ecosystem at all.
The name is everything between the type and the version, which for Go is a module path with slashes in it and for Maven is a group and an artifact the service joins with a colon.
Source Files