extractor

type Annotation int64

type BaseImageDetails struct {
	// Repository is the name of the image. (e.g. `debian`, `circleci/node`)
	Repository string
	// Registry is the name of the registry. (e.g. `docker.io`, `ghcr.io`)
	Registry string
	// Plugin name of the plugin used to extract the base image.
	Plugin string
	// ChainID used to query this layer. This is calculated including empty layers, so will not correspond
	// to the ChainID of any layer in the inventory.
	ChainID digest.Digest
}

type ContainerImageMetadata struct {
	// Index of the container image in the full inventory.
	Index int
	// OSInfo is the key value map from /etc/os-release.
	OSInfo map[string]string
	// LayerMetadata stores metadata about the layers in the container image.
	// Currently this does not store any empty layers.
	LayerMetadata []*LayerMetadata
	// BaseImages stores metadata about the base images that the container image is based on.
	// The first element is always empty.
	BaseImages [][]*BaseImageDetails
}

type Extractor interface {
	plugin.Plugin
}

type LayerMetadata struct {
	ParentContainer *ContainerImageMetadata

	// Index of the layer in the ParentContainer image.
	Index   int
	DiffID  digest.Digest
	ChainID digest.Digest
	Command string
	IsEmpty bool
	// Index of the base image match in the ParentContainer image. 0 means no match.
	BaseImageIndex int
}

type Package struct {
	// A human-readable name representation of the package. Note that this field
	// should only be used for things like logging as different packages can have
	// multiple different types of names (e.g. .deb packages have a source name
	// and a binary name), in which case we arbitrarily pick one of them to use here.
	// In cases when the exact name type used is important (e.g. when matching
	// against vuln feeds) you should use the specific name field from the Metadata.
	Name string
	// The version of this package.
	Version string
	// Source code level package identifiers.
	SourceCode *SourceCodeIdentifier
	// Paths or source of files related to the package.
	Locations []string
	// The PURL type of this package, e.g. "pypi". Used for purl generation.
	PURLType string
	// The names of the Plugins that found this software instance. Set by the core library.
	Plugins []string
	// Deprecated - use ExploitabilitySignals instead
	// TODO(b/400910349): Remove once integrators stop using this.
	AnnotationsDeprecated []Annotation
	// Signals to indicate that specific vulnerabilities are not applicable to this package.
	ExploitabilitySignals []*vex.PackageExploitabilitySignal
	// Details about the layer that the package was attributed to.
	LayerMetadata *LayerMetadata
	// The additional data found in the package.
	Metadata any
	// Licenses information of this package
	Licenses []string
}

type SourceCodeIdentifier struct {
	Repo   string
	Commit string
}