v1

package
v0.3.241 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 22, 2026 License: Apache-2.0 Imports: 41 Imported by: 0

Documentation

Index

Constants

View Source
const (

	// AdmissionWindow is admissionWindow, exported for callers outside this
	// package that need to size a request deadline around it.
	AdmissionWindow = admissionWindow
)
View Source
const (
	MaxgRPCMessageSize = 128 * 1024 * 1024
)

Variables

View Source
var (
	ErrScannerCrashed  = errors.New("SBOM scanner sidecar crashed during scan")
	ErrScannerNotReady = errors.New("SBOM scanner sidecar not ready")
	ErrImageTooLarge   = errors.New("image size exceeds maximum allowed size")
	// ErrScannerBusy reports that the sidecar could not admit this scan within
	// the admission window -- another scan holds the single admission slot.
	//
	// It is emphatically NOT a scan failure: no scan work was dispatched, so
	// neither caller may route it through its failure/retry accounting
	// (reportFailure, failureRetries, crashLoopRetries, or the host path's
	// sidecar-failure counter). Both callers retry it under a short bounded
	// backoff instead; see busyRetryDelay in pkg/sbommanager/v1.
	ErrScannerBusy = errors.New("SBOM scanner sidecar busy")
	// ErrHostDocumentTooLargeToTransfer reports that a host SBOM was produced
	// successfully but its serialized form exceeds the gRPC transfer budget, so
	// the sidecar declined to send it.
	//
	// It exists so that an oversized host document reaches the SAME terminal
	// state via the sidecar as it would in-process: without it, the send would
	// fail as a generic transport error and the host path would re-walk the
	// whole root filesystem every rescan interval forever, which is exactly the
	// outcome the TooLarge state machine exists to prevent.
	ErrHostDocumentTooLargeToTransfer = errors.New("host SBOM document exceeds the gRPC transfer budget")
	// ErrScannerHostScanRejected reports a pre-dispatch rejection of a host scan
	// request (an invalid source_name, or a HOST_ROOT that does not resolve to a
	// plausible host filesystem). Like ErrScannerBusy, no scan work was
	// dispatched, so the caller may fall back in-process for this one cycle at
	// no double-scan cost -- unlike ErrScannerBusy, this is a configuration
	// defect, not transient contention, so the caller logs it at a level an
	// operator will notice rather than treating it as routine.
	ErrScannerHostScanRejected = errors.New("SBOM scanner sidecar rejected the host scan request before dispatch")
)

Functions

func NewScannerServer

func NewScannerServer() pb.SBOMScannerServer

func RunServer added in v0.3.129

func RunServer(ctx context.Context, accountID, accessKey string)

Types

type HostDocumentTooLargeError added in v0.3.241

type HostDocumentTooLargeError struct {
	Size int64
}

HostDocumentTooLargeError carries the serialized size the sidecar measured before declining to send an oversized host document. The size is what the host path records in ResourceSizeMetadataKey and compares against cfg.MaxSBOMSize, standing in for size.Of(wipSbom) on this one path.

It unwraps to ErrHostDocumentTooLargeToTransfer, so callers that only need the classification can use errors.Is and ignore the size.

func (*HostDocumentTooLargeError) Error added in v0.3.241

func (e *HostDocumentTooLargeError) Error() string

func (*HostDocumentTooLargeError) Unwrap added in v0.3.241

func (e *HostDocumentTooLargeError) Unwrap() error

type HostScanRequest added in v0.3.241

type HostScanRequest struct {
	// SourceName is the Syft source alias name, i.e. the host SBOM's CR name.
	// The sidecar cannot derive it: it comes from the host identity only
	// node-agent resolves.
	SourceName          string
	EnableEmbeddedSBOMs bool
	Timeout             time.Duration
}

HostScanRequest is the host counterpart of ScanRequest. It carries none of the image-shaped fields (no image ID/tag, no layer paths, no CRI image status) and no root path: the sidecar resolves and validates its own HOST_ROOT. See ScanHostFilesystemRequest in the proto for why each omitted field is omitted.

type HostScanResult added in v0.3.241

type HostScanResult struct {
	SyftDocument v1beta1.SyftDocument
	SBOMSize     int64
}

type SBOMScannerClient

type SBOMScannerClient interface {
	CreateSBOM(ctx context.Context, req ScanRequest) (*ScanResult, error)
	// ScanHostFilesystem scans the sidecar's own view of the node root
	// filesystem. It may return ErrScannerBusy (admission window exhausted, not
	// a scan failure) or a *HostDocumentTooLargeError (scan succeeded, document
	// undeliverable).
	ScanHostFilesystem(ctx context.Context, req HostScanRequest) (*HostScanResult, error)
	Ready() bool
	Close() error
}

func NewSBOMScannerClient

func NewSBOMScannerClient(socketPath string) (SBOMScannerClient, error)

type ScanRequest

type ScanRequest struct {
	ImageID             string
	ImageTag            string
	LayerPaths          []string
	ImageStatus         []byte // serialized CRI ImageStatusResponse JSON
	MaxImageSize        int64
	MaxSBOMSize         int32
	EnableEmbeddedSBOMs bool
	Timeout             time.Duration
}

type ScanResult

type ScanResult struct {
	SyftDocument v1beta1.SyftDocument
	SBOMSize     int64
}

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL