softwarecomposition

type Advisory struct {
	ID   string
	Link string
}

type Annotation struct {
	// 12.1: Annotator
	// Cardinality: conditional (mandatory, one) if there is an Annotation
	Annotator Annotator

	// 12.2: Annotation Date: YYYY-MM-DDThh:mm:ssZ
	// Cardinality: conditional (mandatory, one) if there is an Annotation
	AnnotationDate string

	// 12.3: Annotation Type: "REVIEW" or "OTHER"
	// Cardinality: conditional (mandatory, one) if there is an Annotation
	AnnotationType string

	// 12.4: SPDX Identifier Reference
	// Cardinality: conditional (mandatory, one) if there is an Annotation
	// This field is not used in hierarchical data formats where the referenced element is clear, such as JSON or YAML.
	AnnotationSPDXIdentifier DocElementID

	// 12.5: Annotation Comment
	// Cardinality: conditional (mandatory, one) if there is an Annotation
	AnnotationComment string
}

type Annotator struct {
	Annotator string
	// including AnnotatorType: one of "Person", "Organization" or "Tool"
	AnnotatorType string
}

type ArtifactOfProject struct {

	// DEPRECATED in version 2.1 of spec
	// 8.9: Artifact of Project Name
	// Cardinality: conditional, required if present, one per AOP
	Name string

	// DEPRECATED in version 2.1 of spec
	// 8.10: Artifact of Project Homepage: URL or "UNKNOWN"
	// Cardinality: optional, one per AOP
	HomePage string

	// DEPRECATED in version 2.1 of spec
	// 8.11: Artifact of Project Uniform Resource Identifier
	// Cardinality: optional, one per AOP
	URI string
}

type Checksum struct {
	Algorithm ChecksumAlgorithm
	Value     string
}

type ChecksumAlgorithm string

type CreationInfo struct {
	// 6.7: License List Version
	// Cardinality: optional, one
	LicenseListVersion string

	// 6.8: Creators: may have multiple keys for Person, Organization
	//      and/or Tool
	// Cardinality: mandatory, one or many
	Creators []Creator

	// 6.9: Created: data format YYYY-MM-DDThh:mm:ssZ
	// Cardinality: mandatory, one
	Created string

	// 6.10: Creator Comment
	// Cardinality: optional, one
	CreatorComment string
}

type Creator struct {
	Creator string
	// CreatorType should be one of "Person", "Organization", or "Tool"
	CreatorType string
}

type Cvss struct {
	Version        string
	Vector         string
	Metrics        CvssMetrics
	VendorMetadata json.RawMessage
}

type CvssMetrics struct {
	BaseScore           float64
	ExploitabilityScore *float64
	ImpactScore         *float64
}

type Descriptor struct {
	Name                  string
	Version               string
	Configuration         json.RawMessage
	VulnerabilityDBStatus json.RawMessage
}

type Distribution struct {
	Name    string
	Version string
	IDLike  []string
}

type DocElementID struct {
	DocumentRefID string
	ElementRefID  ElementID
	SpecialID     string
}

type Document struct {
	// Added
	DocumentDescribes []string

	// 6.1: SPDX Version; should be in the format "SPDX-2.3"
	// Cardinality: mandatory, one
	SPDXVersion string

	// 6.2: Data License; should be "CC0-1.0"
	// Cardinality: mandatory, one
	DataLicense string

	// 6.3: SPDX Identifier; should be "DOCUMENT" to represent
	//      mandatory identifier of SPDXRef-DOCUMENT
	// Cardinality: mandatory, one
	SPDXIdentifier ElementID

	// 6.4: Document Name
	// Cardinality: mandatory, one
	DocumentName string

	// 6.5: Document Namespace
	// Cardinality: mandatory, one
	DocumentNamespace string

	// 6.6: External Document References
	// Cardinality: optional, one or many
	ExternalDocumentReferences []ExternalDocumentRef

	// 6.11: Document Comment
	// Cardinality: optional, one
	DocumentComment string

	CreationInfo  *CreationInfo
	Packages      []*Package
	Files         []*File
	OtherLicenses []*OtherLicense
	Relationships []*Relationship
	Annotations   []Annotation
	Snippets      []Snippet

	// DEPRECATED in version 2.0 of spec
	Reviews []*Review
}

type ElementID string

type ExternalDocumentRef struct {
	// DocumentRefID is the ID string defined in the start of the
	// reference. It should _not_ contain the "DocumentRef-" part
	// of the mandatory ID string.
	DocumentRefID string

	// URI is the URI defined for the external document
	URI string

	// Checksum is the actual hash data
	Checksum Checksum
}

type File struct {
	// 8.1: File Name
	// Cardinality: mandatory, one
	FileName string

	// 8.2: File SPDX Identifier: "SPDXRef-[idstring]"
	// Cardinality: mandatory, one
	FileSPDXIdentifier ElementID

	// 8.3: File Types
	// Cardinality: optional, multiple
	FileTypes []string

	// 8.4: File Checksum: may have keys for SHA1, SHA256, MD5, SHA3-256, SHA3-384, SHA3-512, BLAKE2b-256, BLAKE2b-384, BLAKE2b-512, BLAKE3, ADLER32
	// Cardinality: mandatory, one SHA1, others may be optionally provided
	Checksums []Checksum

	// 8.5: Concluded License: SPDX License Expression, "NONE" or "NOASSERTION"
	// Cardinality: optional, one
	LicenseConcluded string

	// 8.6: License Information in File: SPDX License Expression, "NONE" or "NOASSERTION"
	// Cardinality: optional, one or many
	LicenseInfoInFiles []string

	// 8.7: Comments on License
	// Cardinality: optional, one
	LicenseComments string

	// 8.8: Copyright Text: copyright notice(s) text, "NONE" or "NOASSERTION"
	// Cardinality: mandatory, one
	FileCopyrightText string

	// DEPRECATED in version 2.1 of spec
	// 8.9-8.11: Artifact of Project variables (defined below)
	// Cardinality: optional, one or many
	ArtifactOfProjects []*ArtifactOfProject

	// 8.12: File Comment
	// Cardinality: optional, one
	FileComment string

	// 8.13: File Notice
	// Cardinality: optional, one
	FileNotice string

	// 8.14: File Contributor
	// Cardinality: optional, one or many
	FileContributors []string

	// 8.15: File Attribution Text
	// Cardinality: optional, one or many
	FileAttributionTexts []string

	// DEPRECATED in version 2.0 of spec
	// 8.16: File Dependencies
	// Cardinality: optional, one or many
	FileDependencies []string

	// Snippets contained in this File
	// Note that Snippets could be defined in a different Document! However,
	// the only ones that _THIS_ document can contain are this ones that are
	// defined here -- so this should just be an ElementID.
	Snippets map[ElementID]*Snippet

	Annotations []Annotation
}

type Fix struct {
	Versions []string
	State    string
}

type GrypeDocument struct {
	Matches        []Match
	IgnoredMatches []IgnoredMatch
	Source         *Source
	Distro         Distribution
	Descriptor     Descriptor
}

type GrypePackage struct {
	Name         string
	Version      string
	Type         SyftType
	Locations    []SyftCoordinates
	Language     SyftLanguage
	Licenses     []string
	CPEs         []string
	PURL         string
	Upstreams    []UpstreamPackage
	MetadataType MetadataType
	Metadata     json.RawMessage
}

type IgnoreRule struct {
	Vulnerability string
	FixState      string
	Package       *IgnoreRulePackage
}

type IgnoreRulePackage struct {
	Name     string
	Version  string
	Type     string
	Location string
}

type IgnoredMatch struct {
	Match
	AppliedIgnoreRules []IgnoreRule
}

type Match struct {
	Vulnerability          Vulnerability
	RelatedVulnerabilities []VulnerabilityMetadata
	MatchDetails           []MatchDetails
	Artifact               GrypePackage
}

type MatchDetails struct {
	Type       string
	Matcher    string
	SearchedBy json.RawMessage
	Found      json.RawMessage
}

type MetadataType string

type Originator struct {
	// can be "NOASSERTION"
	Originator string
	// OriginatorType can be one of "Person", "Organization", or empty if Originator is "NOASSERTION"
	OriginatorType string
}

type OtherLicense struct {
	// 10.1: License Identifier: "LicenseRef-[idstring]"
	// Cardinality: conditional (mandatory, one) if license is not
	//              on SPDX License List
	LicenseIdentifier string

	// 10.2: Extracted Text
	// Cardinality: conditional (mandatory, one) if there is a
	//              License Identifier assigned
	ExtractedText string

	// 10.3: License Name: single line of text or "NOASSERTION"
	// Cardinality: conditional (mandatory, one) if license is not
	//              on SPDX License List
	LicenseName string

	// 10.4: License Cross Reference
	// Cardinality: conditional (optional, one or many) if license
	//              is not on SPDX License List
	LicenseCrossReferences []string

	// 10.5: License Comment
	// Cardinality: optional, one
	LicenseComment string
}

type Package struct {
	// Added
	HasFiles []string

	// NOT PART OF SPEC
	// flag: does this "package" contain files that were in fact "unpackaged",
	// e.g. included directly in the Document without being in a Package?
	IsUnpackaged bool

	// 7.1: Package Name
	// Cardinality: mandatory, one
	PackageName string

	// 7.2: Package SPDX Identifier: "SPDXRef-[idstring]"
	// Cardinality: mandatory, one
	PackageSPDXIdentifier ElementID

	// 7.3: Package Version
	// Cardinality: optional, one
	PackageVersion string

	// 7.4: Package File Name
	// Cardinality: optional, one
	PackageFileName string

	// 7.5: Package Supplier: may have single result for either Person or Organization,
	//                        or NOASSERTION
	// Cardinality: optional, one
	PackageSupplier *Supplier

	// 7.6: Package Originator: may have single result for either Person or Organization,
	//                          or NOASSERTION
	// Cardinality: optional, one
	PackageOriginator *Originator

	// 7.7: Package Download Location
	// Cardinality: mandatory, one
	PackageDownloadLocation string

	// 7.8: FilesAnalyzed
	// Cardinality: optional, one; default value is "true" if omitted
	FilesAnalyzed bool
	// NOT PART OF SPEC: did FilesAnalyzed tag appear?
	IsFilesAnalyzedTagPresent bool

	// 7.9: Package Verification Code
	// Cardinality: if FilesAnalyzed == true must be present, if FilesAnalyzed == false must be omitted
	PackageVerificationCode *PackageVerificationCode

	// 7.10: Package Checksum: may have keys for SHA1, SHA256, SHA512, MD5, SHA3-256, SHA3-384, SHA3-512, BLAKE2b-256, BLAKE2b-384, BLAKE2b-512, BLAKE3, ADLER32
	// Cardinality: optional, one or many
	PackageChecksums []Checksum

	// 7.11: Package Home Page
	// Cardinality: optional, one
	PackageHomePage string

	// 7.12: Source Information
	// Cardinality: optional, one
	PackageSourceInfo string

	// 7.13: Concluded License: SPDX License Expression, "NONE" or "NOASSERTION"
	// Cardinality: optional, one
	PackageLicenseConcluded string

	// 7.14: All Licenses Info from Files: SPDX License Expression, "NONE" or "NOASSERTION"
	// Cardinality: optional, one or many if filesAnalyzed is true / omitted;
	//              zero (must be omitted) if filesAnalyzed is false
	PackageLicenseInfoFromFiles []string

	// 7.15: Declared License: SPDX License Expression, "NONE" or "NOASSERTION"
	// Cardinality: optional, one
	PackageLicenseDeclared string

	// 7.16: Comments on License
	// Cardinality: optional, one
	PackageLicenseComments string

	// 7.17: Copyright Text: copyright notice(s) text, "NONE" or "NOASSERTION"
	// Cardinality: mandatory, one
	PackageCopyrightText string

	// 7.18: Package Summary Description
	// Cardinality: optional, one
	PackageSummary string

	// 7.19: Package Detailed Description
	// Cardinality: optional, one
	PackageDescription string

	// 7.20: Package Comment
	// Cardinality: optional, one
	PackageComment string

	// 7.21: Package External Reference
	// Cardinality: optional, one or many
	PackageExternalReferences []*PackageExternalReference

	// 7.23: Package Attribution Text
	// Cardinality: optional, one or many
	PackageAttributionTexts []string

	// 7.24: Primary Package Purpose
	// Cardinality: optional, one or many
	// Allowed values: APPLICATION, FRAMEWORK, LIBRARY, CONTAINER, OPERATING-SYSTEM, DEVICE, FIRMWARE, SOURCE, ARCHIVE, FILE, INSTALL, OTHER
	PrimaryPackagePurpose string

	// 7.25: Release Date: YYYY-MM-DDThh:mm:ssZ
	// Cardinality: optional, one
	ReleaseDate string

	// 7.26: Build Date: YYYY-MM-DDThh:mm:ssZ
	// Cardinality: optional, one
	BuiltDate string

	// 7.27: Valid Until Date: YYYY-MM-DDThh:mm:ssZ
	// Cardinality: optional, one
	ValidUntilDate string

	// Files contained in this Package
	Files []*File

	Annotations []Annotation
}

type PackageExternalReference struct {
	// category is "SECURITY", "PACKAGE-MANAGER" or "OTHER"
	Category string

	// type is an [idstring] as defined in Appendix VI;
	// called RefType here due to "type" being a Golang keyword
	RefType string

	// locator is a unique string to access the package-specific
	// info, metadata or content within the target location
	Locator string

	// 7.22: Package External Reference Comment
	// Cardinality: conditional (optional, one) for each External Reference
	ExternalRefComment string
}

type PackageVerificationCode struct {
	// Cardinality: mandatory, one if filesAnalyzed is true / omitted;
	//              zero (must be omitted) if filesAnalyzed is false
	Value string
	// Spec also allows specifying files to exclude from the
	// verification code algorithm; intended to enable exclusion of
	// the SPDX document file itself.
	ExcludedFiles []string
}

type Relationship struct {

	// 11.1: Relationship
	// Cardinality: optional, one or more; one per Relationship
	//              one mandatory for SPDX Document with multiple packages
	// RefA and RefB are first and second item
	// Relationship is type from 11.1.1
	RefA         DocElementID
	RefB         DocElementID
	Relationship string

	// 11.2: Relationship Comment
	// Cardinality: optional, one
	RelationshipComment string
}

type ReportMeta struct {
	CreatedAt metav1.Time
}

type Review struct {

	// DEPRECATED in version 2.0 of spec
	// 13.1: Reviewer
	// Cardinality: optional, one
	Reviewer string
	// including AnnotatorType: one of "Person", "Organization" or "Tool"
	ReviewerType string

	// DEPRECATED in version 2.0 of spec
	// 13.2: Review Date: YYYY-MM-DDThh:mm:ssZ
	// Cardinality: conditional (mandatory, one) if there is a Reviewer
	ReviewDate string

	// DEPRECATED in version 2.0 of spec
	// 13.3: Review Comment
	// Cardinality: optional, one
	ReviewComment string
}

type SBOMSPDXv2p3 struct {
	metav1.TypeMeta
	metav1.ObjectMeta

	Spec   SBOMSPDXv2p3Spec
	Status SBOMSPDXv2p3Status
}

type SBOMSPDXv2p3Filtered struct {
	metav1.TypeMeta
	metav1.ObjectMeta

	Spec   SBOMSPDXv2p3Spec
	Status SBOMSPDXv2p3Status
}

type SBOMSPDXv2p3FilteredList struct {
	metav1.TypeMeta
	metav1.ListMeta

	Items []SBOMSPDXv2p3Filtered
}

type SBOMSPDXv2p3List struct {
	metav1.TypeMeta
	metav1.ListMeta

	Items []SBOMSPDXv2p3
}

type SBOMSPDXv2p3Spec struct {
	Metadata SPDXMeta
	SPDX     Document
}

type SBOMSPDXv2p3Status struct {
}

type SPDXMeta struct {
	Tool   ToolMeta
	Report ReportMeta
}

type Snippet struct {

	// 9.1: Snippet SPDX Identifier: "SPDXRef-[idstring]"
	// Cardinality: mandatory, one
	SnippetSPDXIdentifier ElementID

	// 9.2: Snippet from File SPDX Identifier
	// Cardinality: mandatory, one
	SnippetFromFileSPDXIdentifier ElementID

	// Ranges denotes the start/end byte offsets or line numbers that the snippet is relevant to
	Ranges []SnippetRange

	// 9.5: Snippet Concluded License: SPDX License Expression, "NONE" or "NOASSERTION"
	// Cardinality: optional, one
	SnippetLicenseConcluded string

	// 9.6: License Information in Snippet: SPDX License Expression, "NONE" or "NOASSERTION"
	// Cardinality: optional, one or many
	LicenseInfoInSnippet []string

	// 9.7: Snippet Comments on License
	// Cardinality: optional, one
	SnippetLicenseComments string

	// 9.8: Snippet Copyright Text: copyright notice(s) text, "NONE" or "NOASSERTION"
	// Cardinality: mandatory, one
	SnippetCopyrightText string

	// 9.9: Snippet Comment
	// Cardinality: optional, one
	SnippetComment string

	// 9.10: Snippet Name
	// Cardinality: optional, one
	SnippetName string

	// 9.11: Snippet Attribution Text
	// Cardinality: optional, one or many
	SnippetAttributionTexts []string
}

type SnippetRange struct {
	StartPointer SnippetRangePointer
	EndPointer   SnippetRangePointer
}

type SnippetRangePointer struct {
	// 5.3: Snippet Byte Range: [start byte]:[end byte]
	// Cardinality: mandatory, one
	Offset int

	// 5.4: Snippet Line Range: [start line]:[end line]
	// Cardinality: optional, one
	LineNumber int

	FileSPDXIdentifier ElementID
}

type Source struct {
	Type   string
	Target json.RawMessage
}

type Supplier struct {
	// can be "NOASSERTION"
	Supplier string
	// SupplierType can be one of "Person", "Organization", or empty if Supplier is "NOASSERTION"
	SupplierType string
}

type SyftCoordinates struct {
	RealPath     string
	FileSystemID string
}

type SyftLanguage string

type SyftType string

type ToolMeta struct {
	Name    string
	Version string
}

type UpstreamPackage struct {
	Name    string
	Version string
}

type Vulnerability struct {
	VulnerabilityMetadata
	Fix        Fix
	Advisories []Advisory
}

type VulnerabilityManifest struct {
	metav1.TypeMeta
	metav1.ObjectMeta

	Spec   VulnerabilityManifestSpec
	Status VulnerabilityManifestStatus
}

type VulnerabilityManifestList struct {
	metav1.TypeMeta
	metav1.ListMeta

	Items []VulnerabilityManifest
}

type VulnerabilityManifestMeta struct {
	WithRelevancy bool
	Tool          VulnerabilityManifestToolMeta
	Report        VulnerabilityManifestReportMeta
}

type VulnerabilityManifestReportMeta struct {
	CreatedAt metav1.Time
}

type VulnerabilityManifestSpec struct {
	Metadata VulnerabilityManifestMeta
	Payload  GrypeDocument
}

type VulnerabilityManifestStatus struct {
}

type VulnerabilityManifestToolMeta struct {
	Name            string
	Version         string
	DatabaseVersion string
}

type VulnerabilityMetadata struct {
	ID          string
	DataSource  string
	Namespace   string
	Severity    string
	URLs        []string
	Description string
	Cvss        []Cvss
}