Documentation
¶
Overview ¶
Package skald renders scan results and verdicts into evidence: a JSON summary and merged SARIF. A skald is the poet who records deeds — here, the record of a scan.
Index ¶
- Constants
- func MergedSARIF(run engine.Result) sarif.Report
- func RenderJSON(w io.Writer, release saga.Release, run engine.Result, verdict norn.Result, ...) error
- func RenderJSONWith(w io.Writer, release saga.Release, run engine.Result, verdict norn.Result, ...) error
- func RenderJSONWithFeeds(w io.Writer, release saga.Release, run engine.Result, verdict norn.Result, ...) error
- func ScopeOfReport(rep sarif.Report) (string, bool)
- func ScopeProvenance(scope engine.Scope) (sarif.Provenance, bool)
- func WriteSARIF(w io.Writer, run engine.Result) error
- func WriteSARIFWith(w io.Writer, run engine.Result, opts sarif.MarshalOptions) error
- type FeedProvenance
Constants ¶
const ScopeProvenanceTool = "draugr/scope"
ScopeProvenanceTool is the provenance entry a scoped run stamps on its SARIF.
Variables ¶
This section is empty.
Functions ¶
func MergedSARIF ¶
MergedSARIF combines all controls' reports into one SARIF report.
func RenderJSON ¶
func RenderJSON(w io.Writer, release saga.Release, run engine.Result, verdict norn.Result, minPriority string) error
RenderJSON writes a JSON evidence summary combining the run result and the verdict. Controls are emitted in name order for stable output. When minPriority is non-empty (e.g. "P2"), a ranked `findings` list of findings at or above that band is included; priority counts are always included when the run was prioritized.
func RenderJSONWith ¶ added in v0.35.0
func RenderJSONWith(w io.Writer, release saga.Release, run engine.Result, verdict norn.Result, minPriority string, opts sarif.MarshalOptions) error
RenderJSONWith is RenderJSON with marshalling options; Compact drops the indentation.
func RenderJSONWithFeeds ¶ added in v0.56.0
func RenderJSONWithFeeds(w io.Writer, release saga.Release, run engine.Result, verdict norn.Result, minPriority string, feeds []FeedProvenance, opts sarif.MarshalOptions) error
RenderJSONWithFeeds is RenderJSONWith plus the exploitability datasets the run used.
func ScopeOfReport ¶ added in v0.71.0
ScopeOfReport describes what a loaded report was scoped to, and reports whether it was scoped at all. The inverse of ScopeProvenance, for a consumer reading a file somebody else wrote.
func ScopeProvenance ¶ added in v0.71.0
func ScopeProvenance(scope engine.Scope) (sarif.Provenance, bool)
ScopeProvenance renders a scope as a SARIF provenance entry, and reports whether there was one to render.
Provenance is the right carrier and already says so: it is what a run states about itself rather than about what it found, and it survives a round trip through the file.
func WriteSARIF ¶
WriteSARIF writes the merged run results as SARIF 2.1.0 JSON.
func WriteSARIFWith ¶ added in v0.35.0
WriteSARIFWith is WriteSARIF with marshalling options.
Types ¶
type FeedProvenance ¶ added in v0.56.0
type FeedProvenance struct {
Name string `json:"name"`
URL string `json:"url,omitempty"`
FetchedAt *time.Time `json:"fetchedAt,omitempty"`
SHA256 string `json:"sha256,omitempty"`
Stale bool `json:"stale,omitempty"`
}
FeedProvenance is one exploitability dataset as a run saw it: where it came from, when, and whether it was already older than the run allowed for.
Source Files