sbom

package
v2.0.11 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 6, 2026 License: Apache-2.0 Imports: 37 Imported by: 1

Documentation

Overview

Package sbom provides core SBOM (Software Bill of Materials) parsing, processing, and manipulation functionality for handling SPDX and CycloneDX format documents.

Index

Constants

This section is empty.

Variables

View Source 
var (
	CdxSupportedLifecycle = []string{"design", "pre-build", "build", "post-build", "operations", "discovery", "decommission"}
)

Functions

func CleanKey 

func CleanKey(key string) string

Helper function to clean up keys

func SupportedPrimaryPurpose 

func SupportedPrimaryPurpose(f string) []string

SupportedPrimaryPurpose returns a list of supported primary purpose values for the given SBOM specification

func SupportedSBOMFileFormats 

func SupportedSBOMFileFormats(f string) []string

SupportedSBOMFileFormats returns a list of supported file formats for the given SBOM specification

func SupportedSBOMSpecVersions 

func SupportedSBOMSpecVersions(f string) []string

SupportedSBOMSpecVersions returns a list of supported versions for the given SBOM specification format

func SupportedSBOMSpecs 

func SupportedSBOMSpecs() []string

SupportedSBOMSpecs returns a list of all supported SBOM specification formats

Types

type Author 

type Author struct {
	Name       string
	Email      string
	AuthorType string // person or org
	Phone      string
}

Author represents a concrete implementation of author information

func (Author) GetEmail 

func (a Author) GetEmail() string

GetEmail returns the email address of the author

func (Author) GetName 

func (a Author) GetName() string

GetName returns the name of the author

func (Author) GetPhone 

func (a Author) GetPhone() string

GetPhone returns the phone number of the author

func (Author) GetType 

func (a Author) GetType() string

GetType returns the type of author (person or organization)

type CdxDoc 

type CdxDoc struct {
	CdxSpec *Specs

	Comps         []GetComponent
	CdxAuthors    []GetAuthor
	CdxTools      []GetTool
	Relationships []GetRelationship

	Lifecycle        []string
	CdxSupplier      GetSupplier
	CdxManufacturer  GetManufacturer
	Compositions     []GetComposition
	PrimaryComponent PrimaryComponentInfo
	Vuln             []GetVulnerabilities
	SignatureDetail  GetSignature
	// contains filtered or unexported fields
}

func (CdxDoc) Authors 

func (c CdxDoc) Authors() []GetAuthor

func (CdxDoc) Components 

func (c CdxDoc) Components() []GetComponent

func (CdxDoc) Composition added in v2.0.3 

func (c CdxDoc) Composition() []GetComposition

func (CdxDoc) Files added in v2.0.7 

func (c CdxDoc) Files() []GetComponent

Files returns all files defined in the SBOM (SPDX-specific, empty for CycloneDX)

func (CdxDoc) GetDirectDependencies added in v2.0.4 

func (c CdxDoc) GetDirectDependencies(compID string, relTypes ...string) []GetComponent

func (CdxDoc) GetOutgoingRelations added in v2.0.4 

func (c CdxDoc) GetOutgoingRelations(compID string) []GetRelationship

func (CdxDoc) GetRelationships 

func (c CdxDoc) GetRelationships() []GetRelationship

func (CdxDoc) Lifecycles 

func (c CdxDoc) Lifecycles() []string

func (CdxDoc) Logs 

func (c CdxDoc) Logs() []string

func (CdxDoc) Manufacturer 

func (c CdxDoc) Manufacturer() GetManufacturer

func (CdxDoc) PrimaryComp 

func (c CdxDoc) PrimaryComp() GetPrimaryComponentInfo

func (CdxDoc) SchemaValidation 

func (c CdxDoc) SchemaValidation() bool

func (CdxDoc) Signature 

func (c CdxDoc) Signature() GetSignature

func (CdxDoc) Spec 

func (c CdxDoc) Spec() Spec

func (CdxDoc) Supplier 

func (c CdxDoc) Supplier() GetSupplier

func (CdxDoc) Tools 

func (c CdxDoc) Tools() []GetTool

func (CdxDoc) Vulnerabilities 

func (c CdxDoc) Vulnerabilities() []GetVulnerabilities

type Checksum 

type Checksum struct {
	Alg     string
	Content string
}

Checksum represents a concrete implementation of cryptographic checksum information

func (Checksum) GetAlgo 

func (c Checksum) GetAlgo() string

GetAlgo returns the cryptographic algorithm used for the checksum

func (Checksum) GetContent 

func (c Checksum) GetContent() string

GetContent returns the hexadecimal checksum value

type Component 

type Component struct {
	Name             string
	Version          string
	Cpes             []cpe.CPE
	Purls            []purl.PURL
	Swhid            []swhid.SWHID
	OmniID           []omniborid.OMNIBORID
	Swid             []swid.SWID
	Licenses         []licenses.License
	DeclaredLicense  []licenses.License
	ConcludedLicense []licenses.License
	Checksums        []GetChecksum
	Purpose          string

	ID               string
	Athrs            []GetAuthor
	Supplier         Supplier
	Manufacture      Manufacturer
	Count            int
	Dep              []string
	SourceCodeURL    string
	DownloadLocation string

	HasRelationships        bool
	RelationshipState       string
	Spdxid                  string
	FileAnalyzed            bool
	CopyRight               string
	PackageLicenseConcluded string
	PackageLicenseDeclared  string
	ExternalRefs            []GetExternalReference
	Props                   []ComponentProperty
	PackageFilename         string
	// contains filtered or unexported fields
}

Component represents a concrete implementation of SBOM component information and metadata

func NewComponent 

func NewComponent() *Component

NewComponent creates a new instance of Component with default values

func (Component) Authors 

func (c Component) Authors() []GetAuthor

Authors returns the author information for the component

func (Component) ConcludedLicenses 

func (c Component) ConcludedLicenses() []licenses.License

ConcludedLicenses returns the concluded licenses for the component

func (Component) CountOfDependencies 

func (c Component) CountOfDependencies() int

CountOfDependencies returns the number of dependencies for the component

func (Component) DeclaredLicenses 

func (c Component) DeclaredLicenses() []licenses.License

DeclaredLicenses returns the explicitly declared licenses for the component

func (Component) Deps added in v2.0.2 

func (c Component) Deps() []string

Deps returns the list of dependency identifiers for the component

func (Component) ExternalReferences 

func (c Component) ExternalReferences() []GetExternalReference

ExternalReferences returns external references associated with the component

func (Component) GetChecksums 

func (c Component) GetChecksums() []GetChecksum

GetChecksums returns the cryptographic checksums for the component

func (Component) GetCopyRight 

func (c Component) GetCopyRight() string

GetCopyRight returns the copyright information for the component

func (Component) GetCpes 

func (c Component) GetCpes() []cpe.CPE

GetCpes returns the Common Platform Enumeration identifiers for the component

func (Component) GetDownloadLocationURL 

func (c Component) GetDownloadLocationURL() string

GetDownloadLocationURL returns the download location URL for the component

func (Component) GetFileAnalyzed 

func (c Component) GetFileAnalyzed() bool

GetFileAnalyzed returns whether files in the component have been analyzed

func (Component) GetFilename added in v2.0.5 

func (c Component) GetFilename() string

GetFilename returns the filename of the component. For SPDX this is PackageFileName (section 7.13); for CDX it is the bsi:component:filename property.

func (Component) GetID 

func (c Component) GetID() string

GetID returns the unique identifier of the component

func (Component) GetLicenses 

func (c Component) GetLicenses() []licenses.License

GetLicenses returns all licenses associated with the component

func (Component) GetName 

func (c Component) GetName() string

GetName returns the name of the component

func (Component) GetPackageLicenseConcluded 

func (c Component) GetPackageLicenseConcluded() string

GetPackageLicenseConcluded returns the concluded license string for the package

func (Component) GetPackageLicenseDeclared 

func (c Component) GetPackageLicenseDeclared() string

GetPackageLicenseDeclared returns the declared license string for the package

func (Component) GetProperties added in v2.0.5 

func (c Component) GetProperties() []ComponentProperty

GetProperties returns all component properties as key-value pairs

func (Component) GetPropertyValue added in v2.0.5 

func (c Component) GetPropertyValue(name string) string

GetPropertyValue returns the value of a component property by name, or empty string if not found

func (Component) GetPurls 

func (c Component) GetPurls() []purl.PURL

GetPurls returns the Package URL identifiers for the component

func (Component) GetSourceCodeURL 

func (c Component) GetSourceCodeURL() string

GetSourceCodeURL returns the source code repository URL for the component

func (Component) GetSpdxID 

func (c Component) GetSpdxID() string

GetSpdxID returns the SPDX identifier for the component

func (Component) GetVersion 

func (c Component) GetVersion() string

GetVersion returns the version of the component

func (Component) HasRelationShips 

func (c Component) HasRelationShips() bool

HasRelationShips returns whether the component has defined relationships

func (Component) IsPrimaryComponent 

func (c Component) IsPrimaryComponent() bool

IsPrimaryComponent returns whether this component is the primary component in the SBOM

func (Component) Manufacturer 

func (c Component) Manufacturer() GetManufacturer

Manufacturer returns the manufacturer information for the component

func (Component) OmniborIDs 

func (c Component) OmniborIDs() []omniborid.OMNIBORID

OmniborIDs returns the OmniBOR identifiers for the component

func (Component) PrimaryPurpose 

func (c Component) PrimaryPurpose() string

PrimaryPurpose returns the primary purpose classification of the component

func (Component) RelationShipState 

func (c Component) RelationShipState() string

RelationShipState returns the state of relationships for the component

func (Component) RequiredFields 

func (c Component) RequiredFields() bool

RequiredFields returns whether all required fields are present for the component

func (Component) SourceCodeHash 

func (c Component) SourceCodeHash() string

SourceCodeHash returns the hash of the source code for the component

func (Component) Suppliers 

func (c Component) Suppliers() GetSupplier

Suppliers returns the supplier information for the component

func (Component) Swhids 

func (c Component) Swhids() []swhid.SWHID

Swhids returns the Software Heritage identifiers for the component

func (Component) Swids 

func (c Component) Swids() []swid.SWID

Swids returns the Software Identification tags for the component

type ComponentProperty added in v2.0.5 

type ComponentProperty struct {
	Name  string
	Value string
}

ComponentProperty represents a key-value property on a component

type Composition added in v2.0.3 

type Composition struct {
	// contains filtered or unexported fields
}

func NewComposition added in v2.0.3 

func NewComposition(id string, scope CompositionScope, aggregate CompositionAggregate,
	deps []string, assemblies []string, vulns []string,
) Composition

NewComposition constructs a Composition instance.

func (Composition) Aggregate added in v2.0.3 

func (c Composition) Aggregate() CompositionAggregate

Aggregate returns the declared level of completeness.

func (Composition) Assemblies added in v2.0.3 

func (c Composition) Assemblies() []string

Assemblies returns the component IDs whose internal assemblies (bundled or shaded components) are covered by this composition.

func (Composition) Dependencies added in v2.0.3 

func (c Composition) Dependencies() []string

Dependencies returns the component IDs whose dependency graphs are covered by this composition.

func (Composition) ID added in v2.0.3 

func (c Composition) ID() string

ID returns the unique identifier of the composition itself. Ex. bom-ref

func (Composition) IsSBOMComplete added in v2.0.3 

func (c Composition) IsSBOMComplete() bool

IsSBOMComplete returns true if this composition explicitly declares the entire SBOM as complete.

func (Composition) Scope added in v2.0.3 

func (c Composition) Scope() CompositionScope

Scope returns the dimension this composition applies to (e.g. dependencies, assemblies, vulnerabilities, or global).

func (Composition) Vulnerabilities added in v2.0.3 

func (c Composition) Vulnerabilities() []string

Vulnerabilities returns the vulnerability IDs covered by this composition.

type CompositionAggregate added in v2.0.3 

type CompositionAggregate string

CompositionAggregate defines the *declared level of completeness* for a given composition scope. 

const (
	// AggregateComplete indicates the producer asserts that
	// nothing relevant is missing for the given scope.
	AggregateComplete CompositionAggregate = "complete"

	// AggregateIncomplete indicates the producer knows that
	// some information is missing for the given scope.
	AggregateIncomplete CompositionAggregate = "incomplete"

	// AggregateUnknown indicates the producer cannot assert
	// whether the information is complete or not.
	AggregateUnknown CompositionAggregate = "unknown"

	// AggregateMissing indicates no completeness assertion
	// is provided for the given scope.
	AggregateMissing CompositionAggregate = "missing"

	// AggregateIncompleteFirstPartyOnly indicates completeness
	// is asserted only for first-party components, not third-party
	AggregateIncompleteFirstPartyOnly CompositionAggregate = "incomplete_first_party_only"
)

type CompositionScope added in v2.0.3 

type CompositionScope string

CompositionScope defines *what aspect* of completeness is being declared. It indicates which dimension of the SBOM the composition applies to. 

const (
	// ScopeAssemblies applies to bundled / shaded components inside another component.
	ScopeAssemblies CompositionScope = "assemblies"

	// ScopeDependencies applies to the dependency graph of a component.
	ScopeDependencies CompositionScope = "dependencies"

	// ScopeVulnerabilities applies to vulnerability coverage completeness.
	ScopeVulnerabilities CompositionScope = "vulnerabilities"

	// ScopeGlobal applies to the entire SBOM.
	// This is a derived scope when no specific dimension is declared.
	ScopeGlobal CompositionScope = "global"
)

type Contact 

type Contact struct {
	Name  string
	Email string
	Phone string
}

Contact represents a concrete implementation of contact information

func (Contact) GetEmail 

func (c Contact) GetEmail() string

GetEmail returns the email address of the contact

func (Contact) GetName 

func (c Contact) GetName() string

GetName returns the name of the contact

func (Contact) GetPhone 

func (c Contact) GetPhone() string

GetPhone returns the phone number of the contact

type Document 

type Document interface {
	// Spec returns the SBOM specification information
	Spec() Spec

	// SchemaValidation returns whether the SBOM passes schema validation
	SchemaValidation() bool

	// Components returns all components defined in the SBOM
	Components() []GetComponent

	// Files returns all files defined in the SBOM (SPDX-specific)
	Files() []GetComponent

	// Authors returns the authors of the SBOM
	Authors() []GetAuthor

	// Tools returns the tools used to create the SBOM
	Tools() []GetTool

	// Logs returns any log messages associated with the SBOM processing
	Logs() []string

	// Lifecycles returns the lifecycle phases represented in the SBOM
	Lifecycles() []string

	// Manufacturer returns the manufacturer information for the SBOM
	Manufacturer() GetManufacturer

	// Supplier returns the supplier information for the SBOM
	Supplier() GetSupplier

	// PrimaryComp returns information about the primary component in the SBOM
	PrimaryComp() GetPrimaryComponentInfo

	// Raw relationship graph
	GetRelationships() []GetRelationship

	// Represents all outgoing relationships for a given component
	GetOutgoingRelations(compID string) []GetRelationship

	// Dependency helpers (semantic, but generic)
	GetDirectDependencies(compID string, relTypes ...string) []GetComponent

	// Vulnerabilities returns all vulnerabilities defined in the SBOM
	Vulnerabilities() []GetVulnerabilities

	// Signature returns the cryptographic signature information for the SBOM
	Signature() GetSignature

	Composition() []GetComposition
}

Document defines the interface for accessing SBOM document information, components, and metadata

func NewSBOMDocument 

func NewSBOMDocument(ctx context.Context, f io.ReadSeeker, sig Signature) (Document, error)

NewSBOMDocument creates a new SBOM document from the provided reader, automatically detecting the format and specification

func NewSBOMDocumentFromBytes added in v2.0.3 

func NewSBOMDocumentFromBytes(ctx context.Context, b []byte, sig Signature) (Document, error)

type ExternalReference 

type ExternalReference struct {
	RefType    string
	RefLocator string
	RefHashes  []GetChecksum
}

ExternalReference represents a concrete implementation of external reference information

func (ExternalReference) GetRefHashes added in v2.0.5 

func (e ExternalReference) GetRefHashes() []GetChecksum

GetRefHashes returns the cryptographic hashes associated with the external reference

func (ExternalReference) GetRefLocator 

func (e ExternalReference) GetRefLocator() string

GetRefLocator returns the locator/URL of the external reference

func (ExternalReference) GetRefType 

func (e ExternalReference) GetRefType() string

GetRefType returns the type of the external reference (e.g., website, vcs, etc.)

type FileFormat 

type FileFormat string

FileFormat represents the file encoding format of an SBOM (JSON, XML, YAML, etc.) 

const (
	// FileFormatJSON represents JSON file format
	FileFormatJSON FileFormat = "json"
	// FileFormatRDF represents RDF file format
	FileFormatRDF FileFormat = "rdf"
	// FileFormatYAML represents YAML file format
	FileFormatYAML FileFormat = "yaml"
	// FileFormatTagValue represents SPDX tag-value file format
	FileFormatTagValue FileFormat = "tag-value"
	// FileFormatXML represents XML file format
	FileFormatXML FileFormat = "xml"
	// FileFormatUnknown represents an unknown or unsupported file format
	FileFormatUnknown FileFormat = "unknown"
)

type FormatVersion 

type FormatVersion string

FormatVersion represents the version string of an SBOM specification

type GetAuthor 

type GetAuthor interface {
	// GetName returns the name of the author
	GetName() string
	// GetType returns the type of author (person or organization)
	GetType() string
	// GetEmail returns the email address of the author
	GetEmail() string
	// GetPhone returns the phone number of the author
	GetPhone() string
}

GetAuthor defines the interface for accessing author information in SBOMs

type GetChecksum 

type GetChecksum interface {
	// GetAlgo returns the cryptographic algorithm used for the checksum
	GetAlgo() string
	// GetContent returns the hexadecimal checksum value
	GetContent() string
}

GetChecksum defines the interface for accessing cryptographic checksum information

type GetComponent 

type GetComponent interface {
	// GetID returns the unique identifier of the component
	GetID() string
	// GetName returns the name of the component
	GetName() string
	// GetVersion returns the version of the component
	GetVersion() string
	// GetCpes returns the Common Platform Enumeration identifiers for the component
	GetCpes() []cpe.CPE
	// GetPurls returns the Package URL identifiers for the component
	GetPurls() []purl.PURL
	// Swhids returns the Software Heritage identifiers for the component
	Swhids() []swhid.SWHID
	// OmniborIDs returns the OmniBOR identifiers for the component
	OmniborIDs() []omniborid.OMNIBORID
	// Swids returns the Software Identification tags for the component
	Swids() []swid.SWID
	// GetLicenses returns all licenses associated with the component
	GetLicenses() []licenses.License
	// DeclaredLicenses returns the explicitly declared licenses for the component
	DeclaredLicenses() []licenses.License
	// ConcludedLicenses returns the concluded licenses for the component
	ConcludedLicenses() []licenses.License
	// GetChecksums returns the cryptographic checksums for the component
	GetChecksums() []GetChecksum
	// PrimaryPurpose returns the primary purpose classification of the component
	PrimaryPurpose() string
	// RequiredFields returns whether all required fields are present for the component
	RequiredFields() bool
	// Suppliers returns the supplier information for the component
	Suppliers() GetSupplier
	// Authors returns the author information for the component
	Authors() []GetAuthor
	// Manufacturer returns the manufacturer information for the component
	Manufacturer() GetManufacturer
	// CountOfDependencies returns the number of dependencies for the component
	CountOfDependencies() int
	// Deps returns the list of dependency identifiers for the component
	Deps() []string
	// GetSourceCodeURL returns the source code repository URL for the component
	GetSourceCodeURL() string
	// GetDownloadLocationURL returns the download location URL for the component
	GetDownloadLocationURL() string
	// SourceCodeHash returns the hash of the source code for the component
	SourceCodeHash() string
	// IsPrimaryComponent returns whether this component is the primary component in the SBOM
	IsPrimaryComponent() bool
	// HasRelationShips returns whether the component has defined relationships
	HasRelationShips() bool
	// RelationShipState returns the state of relationships for the component
	RelationShipState() string
	// GetSpdxID returns the SPDX identifier for the component
	GetSpdxID() string
	// GetFileAnalyzed returns whether files in the component have been analyzed
	GetFileAnalyzed() bool
	// GetCopyRight returns the copyright information for the component
	GetCopyRight() string
	// GetPackageLicenseDeclared returns the declared license string for the package
	GetPackageLicenseDeclared() string
	// GetPackageLicenseConcluded returns the concluded license string for the package
	GetPackageLicenseConcluded() string
	// ExternalReferences returns external references associated with the component
	ExternalReferences() []GetExternalReference
	// GetPropertyValue returns the value of a component property by name, or empty string if not found
	GetPropertyValue(name string) string
	// GetProperties returns all component properties as key-value pairs
	GetProperties() []ComponentProperty
	// GetFilename returns the filename of the component (PackageFileName in SPDX, bsi:component:filename in CDX)
	GetFilename() string
}

GetComponent defines the interface for accessing SBOM component information and metadata

type GetComposition added in v2.0.3 

type GetComposition interface {
	ID() string
	Aggregate() CompositionAggregate
	Scope() CompositionScope
	IsSBOMComplete() bool
	Dependencies() []string
	Assemblies() []string
	Vulnerabilities() []string
}

GetComposition represents a producer-declared completeness assertion for a specific dimension of an SBOM.

type GetContact 

type GetContact interface {
	// GetName returns the name of the contact
	GetName() string
	// GetEmail returns the email address of the contact
	GetEmail() string
	// GetPhone returns the phone number of the contact
	GetPhone() string
}

GetContact defines the interface for accessing contact information in SBOMs

type GetExternalReference 

type GetExternalReference interface {
	// GetRefType returns the type of the external reference (e.g., website, vcs, etc.)
	GetRefType() string
	// GetRefLocator returns the locator/URL of the external reference
	GetRefLocator() string
	// GetRefHashes returns the cryptographic hashes associated with the external reference
	GetRefHashes() []GetChecksum
}

GetExternalReference defines the interface for accessing external reference information in SBOMs

type GetManufacturer 

type GetManufacturer interface {
	// GetName returns the name of the manufacturer
	GetName() string

	// GetURL returns the website URL of the manufacturer
	GetURL() string

	// GetEmail returns the email address of the manufacturer
	GetEmail() string

	// GetContacts returns the contact information for the manufacturer
	GetContacts() []Contact

	// IsAbsent returns whether manufacturer information is available
	IsAbsent() bool
}

GetManufacturer defines the interface for accessing manufacturer information in SBOMs

type GetPrimaryComponentInfo added in v2.0.4 

type GetPrimaryComponentInfo interface {
	// GetID returns the unique identifier of the primary component
	GetID() string

	// GetName returns the name of the primary component
	GetName() string

	// GetVersion returns the version of the primary component
	GetVersion() string

	// GetType returns the type of the primary component
	GetType() string

	// IsPresent returns whether primary component information is available
	IsPresent() bool

	Component() GetComponent
}

type GetRelationship added in v2.0.4 

type GetRelationship interface {
	GetFrom() string
	GetTo() string
	GetType() string
}

type GetSignature 

type GetSignature interface {
	// GetAlgorithm returns the signature algorithm (e.g., RS256, ES256)
	GetAlgorithm() string
	// GetKeyID returns the key identifier
	GetKeyID() string
	// GetSigValue returns the cryptographic signature value
	GetSigValue() string
	// GetPublicKey returns the public key used for signature verification
	GetPublicKey() string
	// GetCertificatePath returns the certificate chain path
	GetCertificatePath() []string
	// GetExcludes returns the list of properties excluded from signing
	GetExcludes() []string
}

GetSignature defines the interface for accessing cryptographic signature information in SBOMs

type GetSupplier 

type GetSupplier interface {
	// GetName returns the name of the supplier
	GetName() string

	// GetEmail returns the email address of the supplier
	GetEmail() string

	// GetURL returns the website URL of the supplier
	GetURL() string

	// GetContacts returns the contact information for the supplier
	GetContacts() []Contact

	// IsAbsent returns whether supplier information is available
	IsAbsent() bool
}

GetSupplier defines the interface for accessing supplier information in SBOMs

type GetTool 

type GetTool interface {
	// GetName returns the name of the tool
	GetName() string
	// GetVersion returns the version of the tool
	GetVersion() string
}

GetTool defines the interface for accessing tool information used in SBOM creation

type GetVulnerabilities 

type GetVulnerabilities interface {
	// GetID returns the unique identifier of the vulnerability (e.g., CVE ID)
	GetID() string
}

GetVulnerabilities defines the interface for accessing vulnerability information in SBOMs

type Manufacturer 

type Manufacturer struct {
	Name     string
	URL      string
	Email    string
	Contacts []Contact
	Absent   bool
}

Manufacturer represents a concrete implementation of manufacturer information

func (Manufacturer) GetContacts 

func (m Manufacturer) GetContacts() []Contact

GetContacts returns the contact information for the manufacturer

func (Manufacturer) GetEmail 

func (m Manufacturer) GetEmail() string

GetEmail returns the email address of the manufacturer

func (Manufacturer) GetName 

func (m Manufacturer) GetName() string

GetName returns the name of the manufacturer

func (Manufacturer) GetURL 

func (m Manufacturer) GetURL() string

GetURL returns the website URL of the manufacturer

func (Manufacturer) IsAbsent added in v2.0.5 

func (m Manufacturer) IsAbsent() bool

IsAbsent returns whether manufacturer information is available

type PrimaryComponentInfo added in v2.0.4 

type PrimaryComponentInfo struct {
	ID      string
	Name    string
	Version string
	Type    string
	Present bool
}

PrimaryComp represents a concrete implementation of primary component information

func (PrimaryComponentInfo) Component added in v2.0.4 

func (pc PrimaryComponentInfo) Component() GetComponent

Component return the primary component as a Component type

func (PrimaryComponentInfo) GetID added in v2.0.4 

func (pc PrimaryComponentInfo) GetID() string

GetID returns the unique identifier of the primary component

func (PrimaryComponentInfo) GetName added in v2.0.4 

func (pc PrimaryComponentInfo) GetName() string

GetName returns the name of the primary component

func (PrimaryComponentInfo) GetType added in v2.0.4 

func (pc PrimaryComponentInfo) GetType() string

GetType returns the name of the primary component

func (PrimaryComponentInfo) GetVersion added in v2.0.4 

func (pc PrimaryComponentInfo) GetVersion() string

GetVersion returns the version of the primary component

func (PrimaryComponentInfo) IsPresent added in v2.0.4 

func (pc PrimaryComponentInfo) IsPresent() bool

IsPresent returns whether primary component information is available

type Relationship added in v2.0.4 

type Relationship struct {
	From string // component ID
	To   string // component ID
	Type string // relationship type
}

func (Relationship) GetFrom added in v2.0.4 

func (r Relationship) GetFrom() string

func (Relationship) GetTo added in v2.0.4 

func (r Relationship) GetTo() string

func (Relationship) GetType added in v2.0.4 

func (r Relationship) GetType() string

type Signature 

type Signature struct {
	Algorithm       string
	KeyID           string
	SigValue        string
	PublicKey       string
	CertificatePath []string
	Excludes        []string
}

Signature represents a concrete implementation of cryptographic signature information

func (*Signature) GetAlgorithm added in v2.0.2 

func (s *Signature) GetAlgorithm() string

GetAlgorithm returns the signature algorithm

func (*Signature) GetCertificatePath added in v2.0.2 

func (s *Signature) GetCertificatePath() []string

GetCertificatePath returns the certificate chain path

func (*Signature) GetExcludes added in v2.0.2 

func (s *Signature) GetExcludes() []string

GetExcludes returns the list of properties excluded from signing

func (*Signature) GetKeyID added in v2.0.2 

func (s *Signature) GetKeyID() string

GetKeyID returns the key identifier

func (*Signature) GetPublicKey 

func (s *Signature) GetPublicKey() string

GetPublicKey returns the public key used for signature verification

func (*Signature) GetSigValue 

func (s *Signature) GetSigValue() string

GetSigValue returns the cryptographic signature value

type SpdxDoc 

type SpdxDoc struct {
	SpdxSpec *Specs

	Comps         []GetComponent
	Auths         []GetAuthor
	SpdxTools     []GetTool
	Relationships []GetRelationship

	PrimaryComponent PrimaryComponentInfo
	Lifecycle        string

	Vuln []GetVulnerabilities

	File []GetComponent
	// contains filtered or unexported fields
}

func (SpdxDoc) Authors 

func (s SpdxDoc) Authors() []GetAuthor

func (SpdxDoc) Components 

func (s SpdxDoc) Components() []GetComponent

func (SpdxDoc) Composition added in v2.0.3 

func (s SpdxDoc) Composition() []GetComposition

func (SpdxDoc) Files added in v2.0.7 

func (s SpdxDoc) Files() []GetComponent

func (SpdxDoc) GetDirectDependencies added in v2.0.4 

func (s SpdxDoc) GetDirectDependencies(compID string, relTypes ...string) []GetComponent

func (SpdxDoc) GetOutgoingRelations added in v2.0.4 

func (s SpdxDoc) GetOutgoingRelations(compID string) []GetRelationship

func (SpdxDoc) GetRelationships 

func (s SpdxDoc) GetRelationships() []GetRelationship

func (SpdxDoc) Lifecycles 

func (s SpdxDoc) Lifecycles() []string

func (SpdxDoc) Logs 

func (s SpdxDoc) Logs() []string

func (SpdxDoc) Manufacturer 

func (s SpdxDoc) Manufacturer() GetManufacturer

func (SpdxDoc) PrimaryComp 

func (s SpdxDoc) PrimaryComp() GetPrimaryComponentInfo

func (SpdxDoc) SchemaValidation 

func (s SpdxDoc) SchemaValidation() bool

func (SpdxDoc) Signature 

func (s SpdxDoc) Signature() GetSignature

func (SpdxDoc) Spec 

func (s SpdxDoc) Spec() Spec

func (SpdxDoc) Supplier 

func (s SpdxDoc) Supplier() GetSupplier

func (SpdxDoc) Tools 

func (s SpdxDoc) Tools() []GetTool

func (SpdxDoc) Vulnerabilities 

func (s SpdxDoc) Vulnerabilities() []GetVulnerabilities

type Spec 

type Spec interface {
	// GetVersion returns the specification version
	GetVersion() string
	// FileFormat returns the file format of the SBOM
	FileFormat() string
	// Parsable returns whether the SBOM can be successfully parsed
	Parsable() bool
	// GetName returns the name of the SBOM specification
	GetName() string
	// GetSpecType returns the type of the SBOM specification (SPDX, CycloneDX, etc.)
	GetSpecType() string
	// RequiredFields returns whether all required fields are present in the specification
	RequiredFields() bool
	// GetCreationTimestamp returns the creation timestamp of the SBOM
	GetCreationTimestamp() string
	// GetLicenses returns the licenses associated with the SBOM
	GetLicenses() []licenses.License
	// GetNamespace returns the namespace of the SBOM
	GetNamespace() string
	// GetURI returns the URI of the SBOM
	GetURI() string
	// GetOrganization returns the organization that created the SBOM
	GetOrganization() string
	// GetComment returns any comments associated with the SBOM
	GetComment() string
	// GetSpdxID returns the SPDX identifier for the SBOM
	GetSpdxID() string
	// GetExtDocRef returns external document references
	GetExtDocRef() []string
}

Spec defines the interface for accessing SBOM specification metadata and properties

type SpecFormat 

type SpecFormat string

SpecFormat represents the SBOM specification format type (SPDX, CycloneDX, etc.) 

const (
	// SBOMSpecSPDX represents the SPDX SBOM specification format
	SBOMSpecSPDX SpecFormat = "spdx"
	// SBOMSpecCDX represents the CycloneDX SBOM specification format
	SBOMSpecCDX SpecFormat = "cyclonedx"
	// SBOMSpecUnknown represents an unknown or unsupported SBOM specification format
	SBOMSpecUnknown SpecFormat = "unknown"
)

type Specs 

type Specs struct {
	Version  string
	Format   string
	SpecType string
	Name     string

	Licenses             []licenses.License
	CreationTimestamp    string
	Namespace            string
	URI                  string
	Organization         string
	Comment              string
	Spdxid               string
	ExternalDocReference []string
	// contains filtered or unexported fields
}

Specs represents the concrete implementation of SBOM specification metadata

func NewSpec 

func NewSpec() *Specs

NewSpec creates a new instance of Specs with default values

func (Specs) FileFormat 

func (s Specs) FileFormat() string

FileFormat returns the file format of the SBOM

func (Specs) GetComment 

func (s Specs) GetComment() string

GetComment returns any comments associated with the SBOM

func (Specs) GetCreationTimestamp 

func (s Specs) GetCreationTimestamp() string

GetCreationTimestamp returns the creation timestamp of the SBOM

func (Specs) GetExtDocRef 

func (s Specs) GetExtDocRef() []string

GetExtDocRef returns external document references

func (Specs) GetLicenses 

func (s Specs) GetLicenses() []licenses.License

GetLicenses returns the licenses associated with the SBOM

func (Specs) GetName 

func (s Specs) GetName() string

GetName returns the name of the SBOM specification

func (Specs) GetNamespace 

func (s Specs) GetNamespace() string

GetNamespace returns the namespace of the SBOM

func (Specs) GetOrganization 

func (s Specs) GetOrganization() string

GetOrganization returns the organization that created the SBOM

func (Specs) GetSpdxID 

func (s Specs) GetSpdxID() string

GetSpdxID returns the SPDX identifier for the SBOM

func (Specs) GetSpecType 

func (s Specs) GetSpecType() string

GetSpecType returns the type of the SBOM specification (SPDX, CycloneDX, etc.)

func (Specs) GetURI 

func (s Specs) GetURI() string

GetURI returns the URI of the SBOM

func (Specs) GetVersion 

func (s Specs) GetVersion() string

GetVersion returns the specification version

func (Specs) Parsable 

func (s Specs) Parsable() bool

Parsable returns whether the SBOM can be successfully parsed

func (Specs) RequiredFields 

func (s Specs) RequiredFields() bool

RequiredFields returns whether all required fields are present in the specification

type Supplier 

type Supplier struct {
	Name     string
	Email    string
	URL      string
	Contacts []Contact
	Absent   bool
}

Supplier represents a concrete implementation of supplier information

func (Supplier) GetContacts 

func (s Supplier) GetContacts() []Contact

GetContacts returns the contact information for the supplier

func (Supplier) GetEmail 

func (s Supplier) GetEmail() string

GetEmail returns the email address of the supplier

func (Supplier) GetName 

func (s Supplier) GetName() string

GetName returns the name of the supplier

func (Supplier) GetURL 

func (s Supplier) GetURL() string

GetURL returns the website URL of the supplier

func (Supplier) IsAbsent added in v2.0.5 

func (s Supplier) IsAbsent() bool

IsAbsent returns whether supplier information is available

type Tool 

type Tool struct {
	Name    string
	Version string
}

Tool represents a concrete implementation of tool information used in SBOM creation

func (Tool) GetName 

func (t Tool) GetName() string

GetName returns the name of the tool

func (Tool) GetVersion 

func (t Tool) GetVersion() string

GetVersion returns the version of the tool

type Vulnerability 

type Vulnerability struct {
	ID string
}

Vulnerability represents a concrete implementation of vulnerability information

func (Vulnerability) GetID 

func (v Vulnerability) GetID() string

GetID returns the unique identifier of the vulnerability (e.g., CVE ID)

Source Files

View all Source files

Directories

Path Synopsis
Code generated by counterfeiter.
 Code generated by counterfeiter.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.