commands

package
v1.10.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: AGPL-3.0 Imports: 53 Imported by: 0

Documentation

Overview

Copyright (C) 2024 Tim Bastin, l3montree GmbH

This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.

Index

Constants

This section is empty.

Variables

View Source 
var RootCmd = &cobra.Command{
	SilenceUsage:      true,
	Use:               "devguard-scanner",
	Short:             "Secure your Software Supply Chain",
	Version:           scannerVersion(),
	DisableAutoGenTag: true,
	Long: `Secure your Software Supply Chain

DevGuard Scanner is a small CLI to help generate, sign and upload SBOMs, SARIF
reports and attestations to a DevGuard backend. Use commands like 'sca', 'sarif',
and 'attest' to interact with the platform. Configuration can be provided via a
./.devguard config file or environment variables (prefix DEVGUARD_).`,
	Example: `  # Run Software Composition Analysis on a container image
  devguard-scanner sca ghcr.io/org/image:tag

  # Run SCA on a local project directory
  devguard-scanner sca ./path/to/project

  # Create and upload an attestation
  devguard-scanner attest predicate.json ghcr.io/org/image:tag --predicateType https://cyclonedx.org/vex/1.0

  # Upload a SARIF report
  devguard-scanner sarif results.sarif.json`,

	PersistentPreRunE: func(cmd *cobra.Command, args []string) error {

		level, err := cmd.Flags().GetString("logLevel")
		if err != nil {
			return err
		}

		switch level {
		case "debug":
			initLogger(slog.LevelDebug)
		case "info":
			initLogger(slog.LevelInfo)
		case "warn":
			initLogger(slog.LevelWarn)
		case "error":
			initLogger(slog.LevelError)
		default:
			initLogger(slog.LevelInfo)
		}

		runsInCI := utils.RunsInCI()
		if runsInCI {
			slog.Debug("Running in CI")
			err := utils.GitLister.MarkAllPathsAsSafe()
			if err != nil {
				slog.Debug("could not mark all paths as safe", "err", err)
			}
		}

		err = initializeConfig(cmd)
		if err != nil {
			return err
		}

		telemetryOnce.Do(func() {
			go telemetry.SendScannerStartup(cmd.Context(), telemetry.ConfigFromEnv(), &utils.EgressClient, scannerVersion(), config.RuntimeBaseConfig.APIURL, runsInCI, cmd.Name())
		})

		return nil
	},
}

Functions

func Execute added in v0.17.0 

func Execute()

func MergeSupplementarySBOMs added in v1.9.0 

func MergeSupplementarySBOMs(bom *cyclonedx.BOM, extras []*cyclonedx.BOM) error

mergeSupplementarySBOMs enriches bom's dependency graph with each extra, via normalize.SBOMGraph.EnrichSBOM (see there for exact replace-vs-attach semantics). bom.Metadata.Component itself is left untouched; only Components/Dependencies are replaced with the enriched graph's exported view (via ToCycloneDX, reusing bom's own root identity through RootName) - the root's own entry in Dependencies (its declared children) is kept, but the root component itself is dropped from the returned Components slice, since it's already represented by Metadata.Component.

Each extra can carry its own top-level ExternalReferences (e.g. a link to that specific binary's VEX document) - those are merged into bom's own top-level ExternalReferences, since that's the only place the backend looks for VEX URLs to auto-fetch (see controllers/scan_controller.go's bom.ExternalReferences scan).

func NewAttestCommand 

func NewAttestCommand() *cobra.Command

func NewAttestationCommand added in v1.0.0 

func NewAttestationCommand() *cobra.Command

func NewAuthCommand added in v1.6.0 

func NewAuthCommand() *cobra.Command

func NewCleanCommand added in v0.17.0 

func NewCleanCommand() *cobra.Command

NewCleanCommand returns a command that removes attestations/signatures from an OCI image.

func NewContainerScanningCommand 

func NewContainerScanningCommand() *cobra.Command

func NewCurlCommand added in v0.17.0 

func NewCurlCommand() *cobra.Command

func NewDiscoverBaseImageAttestationsCommand added in v0.19.0 

func NewDiscoverBaseImageAttestationsCommand() *cobra.Command

func NewGenerateTagCommand added in v1.0.0 

func NewGenerateTagCommand() *cobra.Command

func NewGetCommand added in v0.17.0 

func NewGetCommand() *cobra.Command

func NewIaCCommand added in v0.17.0 

func NewIaCCommand() *cobra.Command

func NewInspectCommand 

func NewInspectCommand() *cobra.Command

func NewLoginCommand 

func NewLoginCommand() *cobra.Command

func NewMergeSBOMSCommand added in v0.18.7 

func NewMergeSBOMSCommand() *cobra.Command

func NewPURLInspectCommand added in v1.0.0 

func NewPURLInspectCommand() *cobra.Command

NewPURLInspectCommand creates the inspect command for PURL inspection

func NewSCACommand 

func NewSCACommand() *cobra.Command

func NewSarifCommand added in v0.17.0 

func NewSarifCommand() *cobra.Command

func NewSastCommand added in v0.17.0 

func NewSastCommand() *cobra.Command

func NewSbomCommand added in v0.17.0 

func NewSbomCommand() *cobra.Command

func NewSecretScanningCommand added in v0.17.0 

func NewSecretScanningCommand() *cobra.Command

func NewSignCommand 

func NewSignCommand() *cobra.Command

func NewSlugCommand added in v0.17.0 

func NewSlugCommand() *cobra.Command

func NewVexCommand added in v0.19.0 

func NewVexCommand() *cobra.Command

Types

type CurlOptions added in v0.17.0 

type CurlOptions struct {
	// contains filtered or unexported fields
}

type MergeSBOMsConfigFile added in v0.18.7 

type MergeSBOMsConfigFile struct {
	Purl  string   `json:"purl"`
	SBOMs []string `json:"sboms"`
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.