Documentation
¶
Overview ¶
Package sbom generates Software Bills of Materials by shelling out to Syft.
The document type and the Generator contract live in pkg/sbom; this package is the Syft implementation, kept internal so it can use internal/git and internal/toolexec.
Index ¶
Constants ¶
const Binary = "syft"
Binary is the tool Generate requires on PATH.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Generator ¶
type Generator struct {
// contains filtered or unexported fields
}
Generator produces SBOMs. The zero value is not usable; use New.
func New ¶
func New() *Generator
New returns a Generator that shells out to Syft and clones with git.
func (*Generator) Assemble ¶ added in v0.68.0
func (g *Generator) Assemble(release saga.Release, format saga.SBOMFormat, docs []sbom.Document) (sbom.Document, error)
Assemble combines per-target documents into one covering the whole release.
The unit problem this solves: an SBOM is asked for per *product*. A customer questionnaire, EO 14028 and the CRA all want the bill of materials of the thing you shipped. Draugr scans per repository and image, so a project with four repositories and three images produces seven documents and no answer to the question actually being asked.
What makes this assembly rather than a merge is that the hierarchy is **declared, not inferred**. A generic merge tool has a pile of documents and must guess how they relate. This one is handed a release containing named components containing named targets, so the "which component pulled this in" question — the one a triager asks the moment a CVE lands — is answered from the descriptor instead of being lost in the flattening.
Which is the trap in the obvious implementation. Deduplicating `requests@2.19.1` down to one entry answers "what do we ship" and destroys "who ships it"; keeping three answers the second and makes any consumer that counts packages report a number that means nothing. Neither is necessary: CycloneDX keeps one entry per package and a dependency graph saying which containers hold it, and both questions are answerable from the same document.
func (*Generator) Generate ¶
func (g *Generator) Generate(ctx context.Context, component string, t plugin.Target, format saga.SBOMFormat) (pkgsbom.Document, error)
Generate produces an SBOM for one target. Repositories are checked out first; images are handed to Syft by reference, which reads the registry directly and needs no local copy.
Source Files