transformer

package
v1.14.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 17, 2026 License: AGPL-3.0 Imports: 29 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func AdvisoryCreateRequestToModel added in v1.10.0 

func AdvisoryCreateRequestToModel(c dtos.AdvisoryCreate) models.Advisory

func AdvisoryUpdateRequestToModel added in v1.10.0 

func AdvisoryUpdateRequestToModel(c dtos.AdvisoryUpdate, advisory models.Advisory) models.Advisory

func AffectedComponentToDTO added in v1.0.1 

func AffectedComponentToDTO(ac models.AffectedComponent) dtos.AffectedComponentDTO

func AffectedComponentsFromOSV 

func AffectedComponentsFromOSV(osv *dtos.OSV) []models.AffectedComponent

func AffectedPackageToModel added in v1.10.0 

func AffectedPackageToModel(c dtos.AffectedPackage) models.AffectedPackage

func AllUpstreamVEXRulesToVEXRules added in v1.12.0 

func AllUpstreamVEXRulesToVEXRules(rules []models.UpstreamVEXRule, createdByID string, assetID uuid.UUID) []models.VEXRule

func ApplyAssetPatchRequestToModel 

func ApplyAssetPatchRequestToModel(assetPatch dtos.AssetPatchRequest, asset *models.Asset) bool

func ApplyOrgPatchRequestToModel 

func ApplyOrgPatchRequestToModel(p dtos.OrgPatchRequest, org *models.Org) bool

func ApplyProjectPatchRequestToModel 

func ApplyProjectPatchRequestToModel(projectPatch dtos.ProjectPatchRequest, project *models.Project) bool

func ApplyReleasePatchRequestToModel 

func ApplyReleasePatchRequestToModel(r dtos.ReleasePatchRequest, rel *models.Release)

func ArtifactModelToDTO 

func ArtifactModelToDTO(artifact models.Artifact) dtos.ArtifactDTO

func ArtifactRiskHistoryToDTO 

func ArtifactRiskHistoryToDTO(history models.ArtifactRiskHistory) dtos.RiskHistoryDTO

func ArtifactRiskHistoryWithVersionToDTO added in v1.13.1 

func ArtifactRiskHistoryWithVersionToDTO(history models.ArtifactRiskHistoryWithVersion) dtos.RiskHistoryWithVersionDTO

func AssetCreateRequestToModel 

func AssetCreateRequestToModel(assetCreateRequest dtos.AssetCreateRequest, projectID uuid.UUID) models.Asset

func AssetModelToDTO 

func AssetModelToDTO(asset models.Asset) dtos.AssetDTO

func AssetModelToDetailsDTO 

func AssetModelToDetailsDTO(asset models.Asset, members []dtos.UserDTO) dtos.AssetDetailsDTO

func AssetModelToDetailsWithSecretsDTO 

func AssetModelToDetailsWithSecretsDTO(asset models.Asset, members []dtos.UserDTO) dtos.AssetDetailsWithSecretsDTO

func AssetModelsToDTOs 

func AssetModelsToDTOs(assets []models.Asset) []dtos.AssetDTO

func AssetVersionModelToDTO 

func AssetVersionModelToDTO(assetVersion models.AssetVersion) dtos.AssetVersionDTO

func BuildArtifactIndex added in v1.8.0 

func BuildArtifactIndex(artifacts []models.Artifact) map[uuid.UUID]map[string][]string

func BuildAssetEntries added in v1.8.0 

func BuildAssetEntries(assets []models.Asset, versionsByAssetID map[uuid.UUID][]models.AssetVersion, artifactIndex map[uuid.UUID]map[string][]string) []dtos.AssetEntryDTO

func BuildExternalProjectTree added in v1.8.0 

func BuildExternalProjectTree(
	projects []models.Project,
	subProjects []models.Project,
	assets []models.Asset,
	assetVersions []models.AssetVersion,
	artifacts []models.Artifact,
) []dtos.ProjectExternalEntityTree

func CSAFVEXToRules added in v1.9.0 

func CSAFVEXToRules(advisory *gocsaf.Advisory, source string) ([]models.UpstreamVEXRule, error)

CSAFVEXToRules converts a CSAF advisory into VEX rules.

CSAF is path-granular: DevGuard encodes each dependency path as a chain of nested default_component_of relationships (artifact <- p1 <- ... <- vulnerable component). The leaf product of each chain is what a ProductStatus bucket references. This function walks that chain back to reconstruct the exact component-only path and turns it into a (non-wildcard) VEX rule path pattern, so only the path-specific vuln is affected.

func CVEToDTO 

func CVEToDTO(cve models.CVE) dtos.CVEDTO

func ComplianceComponentImplementsControlStatementToDTO added in v1.10.0 

func ComplianceComponentImplementsControlStatementToDTO(m models.ComplianceComponentImplementsControlStatement) dtos.ComplianceComponentImplementsControlStatementDTO

func ComplianceComponentImplementsControlToDTO added in v1.10.0 

func ComplianceComponentImplementsControlToDTO(m models.ComplianceComponentImplementsControl) dtos.ComplianceComponentImplementsControlDTO

func ComplianceComponentToDTO added in v1.10.0 

func ComplianceComponentToDTO(m models.ComplianceComponent) dtos.ComplianceComponentDTO

func ComplianceComponentToDetailsDTO added in v1.10.0 

func ComplianceComponentToDetailsDTO(m models.ComplianceComponent) dtos.ComplianceComponentDetailsDTO

func CompliancePostureToDTO added in v1.10.0 

func CompliancePostureToDTO(c models.CompliancePosture) dtos.CompliancePostureWithDetailsDTO

func ComponentDependencyToDTO 

func ComponentDependencyToDTO(m models.ComponentDependency) dtos.ComponentDependencyDTO

func ComponentModelToDTO 

func ComponentModelToDTO(m models.Component) dtos.ComponentDTO

func ComponentOccurrenceToDTO 

func ComponentOccurrenceToDTO(m models.ComponentOccurrence) dtos.ComponentOccurrenceDTO

func ComponentsToCdx added in v1.14.0 

func ComponentsToCdx(components []models.Component, licenseOverwrites map[string]string) map[string]cyclonedx.Component

ComponentsToCdx renders stored component metadata for CycloneDX export, keyed by component id. A merkle tree carries only ids, so this is what puts licenses and types back into an exported document.

func ConvertCompliancePosturesToSystemSecurityPlanOSCAL added in v1.10.0 

func ConvertCompliancePosturesToSystemSecurityPlanOSCAL(compliancePostures []dtos.CompliancePostureWithDetailsDTO, frameworkControls []models.FrameworkControl) (oscalTypes.OscalCompleteSchema, error)

func ConvertVulnEventDetailToDto added in v1.3.0 

func ConvertVulnEventDetailToDto(e models.VulnEventDetail) dtos.VulnEventDTO

func ConvertVulnEventToDto 

func ConvertVulnEventToDto(event models.VulnEvent) dtos.VulnEventDTO

func ConvertVulnEventsToDtos 

func ConvertVulnEventsToDtos(events []models.VulnEventDetail) []dtos.VulnEventDTO

func CycloneDXVEXFromVulnerabilities added in v1.14.0 

func CycloneDXVEXFromVulnerabilities(vulns []cdx.Vulnerability, metadata normalize.BOMMetadata) *cdx.BOM

CycloneDXVEXFromVulnerabilities builds a CycloneDX VEX BOM directly from a set of vulnerabilities, without going through an SBOMGraph. The affected components (from each vulnerability's Affects refs) become the BOM's components, all declared as direct dependencies of the root component described by metadata.

func CycloneDXVEXToRules added in v1.9.0 

func CycloneDXVEXToRules(bom *cdx.BOM, source string) ([]models.UpstreamVEXRule, error)

CycloneDXVEXToRules converts the vulnerabilities of a CycloneDX VEX BOM into VEX rules.

CycloneDX is component-level: Affects[].Ref only carries the vulnerable component PURL, so unless the BOM carries an explicit devguard:pathPattern property (which DevGuard adds for vulns it has already matched to a rule), the reconstructed path pattern is a component-level wildcard that matches every path reaching that component.

func DependencyVulnToDTO 

func DependencyVulnToDTO(f models.DependencyVuln) dtos.DependencyVulnDTO

func DependencyVulnToDetailedDTO 

func DependencyVulnToDetailedDTO(dependencyVuln models.DependencyVuln) dtos.DetailedDependencyVulnDTO

func ExploitModelToDTO 

func ExploitModelToDTO(exploit models.Exploit) dtos.ExploitDTO

func FirstPartyVulnDTOToModel added in v1.7.0 

func FirstPartyVulnDTOToModel(v dtos.FirstPartyVulnDTO) models.FirstPartyVuln

func FirstPartyVulnToDto 

func FirstPartyVulnToDto(f models.FirstPartyVuln) dtos.FirstPartyVulnDTO

func ForestToCycloneDX added in v1.14.0 

func ForestToCycloneDX(f normalize.MerkleForest, metadata normalize.BOMMetadata, components map[string]cdx.Component) *cdx.BOM

ToCycloneDX renders every SBOM in the forest as one document, which is how an artifact with several origins is exported.

components supplies the metadata (licenses, types, hashes) the trees do not carry, keyed by component id. A component missing from it is emitted with just its purl.

Note that flattening several SBOMs into one document does merge their dependency edges - CycloneDX has no way to say "these two sources disagree". The storage keeps them apart; only this export view combines them.

func FromJSONSnippetContents 

func FromJSONSnippetContents(firstPartyVuln models.FirstPartyVuln) (dtos.SnippetContents, error)

func GithubAppInstallationToDTO 

func GithubAppInstallationToDTO(g models.GithubAppInstallation) dtos.GithubAppInstallationDTO

func InstanceSettingsToDTO added in v1.13.1 

func InstanceSettingsToDTO(settings shared.InstanceSettings, gitlabOAuthConfigs []dtos.GitlabOauth2ConfigDTO) dtos.InstanceSettingsDTO

func LicenseDistribution added in v1.14.0 

func LicenseDistribution(components map[string]cyclonedx.Component, componentIDs []string) map[string]int

LicenseDistribution counts how often each license appears among the given components. A component counts once however many SBOMs report it.

func LicenseRiskToDTO 

func LicenseRiskToDTO(f models.LicenseRisk) dtos.LicenseRiskDTO

func MaliciousAffectedComponentFromOSV 

func MaliciousAffectedComponentFromOSV(osv *dtos.OSV, maliciousPackageID string) []models.MaliciousAffectedComponent

MaliciousAffectedComponentFromOSV converts OSV data to MaliciousAffectedComponent entries

func MergeCycloneDXVEX added in v1.14.0 

func MergeCycloneDXVEX(boms []*cdx.BOM, rootName string) *cdx.BOM

MergeCycloneDXVEX merges several CycloneDX VEX BOMs into one under a single release root. Because the components and dependencies are derived from the vulnerabilities' affected refs, merging is simply rebuilding the BOM from the union of all vulnerabilities.

func MerkleTreeFromCycloneDX added in v1.14.0 

func MerkleTreeFromCycloneDX(bom *cdx.BOM, artifactName string) (*normalize.ParsedSBOM, error)

MerkleTreeFromCycloneDX parses a CycloneDX document into a content-addressed tree rooted at artifactName.

Components without an identifiable purl are dropped and their dependencies reparented onto their own parents, so an unidentifiable intermediate does not disconnect the subtree beneath it.

func OSVToCVE 

func OSVToCVE(osv *dtos.OSV) models.CVE

func OSVToCVERelationships 

func OSVToCVERelationships(osv *dtos.OSV) []models.CVERelationship

need Optimus Prime here

func OpenVEXToRules added in v1.9.0 

func OpenVEXToRules(doc *vex.VEX, source string) ([]models.UpstreamVEXRule, error)

OpenVEXToRules converts an OpenVEX document into VEX rules.

When a statement's product lists subcomponents, the resulting path pattern narrows to that product/subcomponent pair: ["*", productPurl, "*", subcomponentPurl]. When no subcomponent is given, it falls back to the product-level wildcard ["*", productPurl].

func OrgCreateRequestToModel 

func OrgCreateRequestToModel(c dtos.OrgCreateRequest) models.Org

func OrgDTOFromModel 

func OrgDTOFromModel(org models.Org) dtos.OrgDTO

func OrgSettingsDTOFromModel added in v1.4.0 

func OrgSettingsDTOFromModel(org models.Org, members []dtos.UserDTO) dtos.OrgSettingsDTO

func PATModelToDTO added in v1.6.0 

func PATModelToDTO(pat models.PAT) dtos.PATDTO

func ProjectCreateRequestToModel 

func ProjectCreateRequestToModel(projectCreate dtos.ProjectCreateRequest) models.Project

func ProjectModelToDTO 

func ProjectModelToDTO(project models.Project) dtos.ProjectDTO

func RelationshipToDTO 

func RelationshipToDTO(relation models.CVERelationship) dtos.RelationshipDTO

func ReleaseCreateRequestToModel 

func ReleaseCreateRequestToModel(r dtos.ReleaseCreateRequest, projectID uuid.UUID) models.Release

func ReleaseItemToDTO 

func ReleaseItemToDTO(i models.ReleaseItem) dtos.ReleaseItemDTO

func ReleaseToDTO 

func ReleaseToDTO(r models.Release) dtos.ReleaseDTO

func SnippetContentsToJSON 

func SnippetContentsToJSON(s dtos.SnippetContents) (databasetypes.JSONB, error)

func TransformPackagistToDepsDev added in v1.5.0 

func TransformPackagistToDepsDev(
	packagistResponse dtos.PackagistPackageResponse, packageKey string, packageVersion string,
) (dtos.OpenSourceInsightsVersionResponse, error)

func TreeToCycloneDX added in v1.14.0 

func TreeToCycloneDX(t *normalize.MerkleTree, metadata normalize.BOMMetadata, components map[string]cdx.Component) *cdx.BOM

ToCycloneDX renders the tree back into a CycloneDX document.

func UpstreamVEXRuleToVEXRule added in v1.12.0 

func UpstreamVEXRuleToVEXRule(rule models.UpstreamVEXRule, createdByID string, assetID uuid.UUID) models.VEXRule

func VEXRuleRecommendationToDTO added in v1.12.0 

func VEXRuleRecommendationToDTO(rec models.VEXRuleRecommendation) dtos.VexRuleRecommendation

VEXRuleRecommendationToDTO converts a stored recommendation to its DTO. A recommendation either matched an asset-owned VEX rule (VEXRuleID set) via the crowdsourced vote, or, failing that, a trusted upstream VEX rule (UpstreamVEXRuleID set).

func VEXRuleToDTOWithCount 

func VEXRuleToDTOWithCount(rule models.VEXRule, appliesToCount int) dtos.VEXRuleDTO

func VEXRuleToOriginRecommendationDTO added in v1.12.0 

func VEXRuleToOriginRecommendationDTO(rule models.VEXRule, originProjectSlug, originAssetSlug string) dtos.VexRuleRecommendation

func VEXRuleToUpstreamVEXRule added in v1.12.0 

func VEXRuleToUpstreamVEXRule(rule models.VEXRule) models.UpstreamVEXRule

func VEXRulesToUpstreamVEXRules added in v1.12.0 

func VEXRulesToUpstreamVEXRules(rules []models.VEXRule) []models.UpstreamVEXRule

func VulnInPackageToDTO added in v1.0.1 

func VulnInPackageToDTO(vuln models.VulnInPackage) dtos.VulnInPackageDTO

func VulnInPackageToDependencyVulns 

func VulnInPackageToDependencyVulns(vuln models.VulnInPackage, forest normalize.MerkleForest, assetID uuid.UUID, assetVersionName string, artifactName string) []models.DependencyVuln

VulnInPackageToDependencyVulns converts a vulnerability to multiple DependencyVuln objects, one for each unique path through the dependency graph. This ensures that the same CVE appearing through different dependency paths (e.g., A -> trivy -> stdlib vs A -> cosign -> stdlib) creates separate vulnerability records.

func VulnInPackageToDependencyVulnsWithoutArtifact 

func VulnInPackageToDependencyVulnsWithoutArtifact(vuln models.VulnInPackage, forest normalize.MerkleForest, assetID uuid.UUID, assetVersionName string) []models.DependencyVuln

VulnInPackageToDependencyVulnsWithoutArtifact converts a vulnerability to multiple DependencyVuln objects based on all paths through the dependency graph.

Types

type MinimalTree added in v1.14.0 

type MinimalTree struct {
	Nodes        []string            `json:"nodes"`
	Dependencies map[string][]string `json:"dependencies"`
}

MinimalTree is the flattened shape the frontend renders: the components and which of them depend on which. The artifact itself is the empty string.

func MinimalTreeToPURL added in v1.14.0 

func MinimalTreeToPURL(f normalize.MerkleForest, purl string, maxDepth int) MinimalTree

MinimalTreeToPURL returns only the part of the forest leading to purl: every ancestor, without enumerating individual paths, so a component reachable many ways does not blow up combinatorially. maxDepth of 0 is unlimited.

func ToMinimalTree added in v1.14.0 

func ToMinimalTree(f normalize.MerkleForest) MinimalTree

ToMinimalTree flattens the forest for display. Components are keyed by purl, so where two SBOMs report different children for one component the display shows the union - a rendering choice, not how it is stored.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.