Documentation
¶
Overview ¶
Copyright (C) 2025 l3montree GmbH
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
Copyright (C) 2025 l3montree GmbH ¶
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
Copyright (C) 2025 l3montree GmbH ¶
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
Copyright (C) 2025 l3montree GmbH ¶
This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.
Index ¶
- func AddAssetRefFlags(cmd *cobra.Command)
- func AddDefaultFlags(cmd *cobra.Command)
- func AddDependencyVulnsScanFlags(cmd *cobra.Command)
- func AddFirstPartyVulnsScanFlags(cmd *cobra.Command)
- func AddGenerateTagFlags(cmd *cobra.Command)
- func AddSupplementarySBOMFlags(cmd *cobra.Command)
- func BomFromBytes(bomStr []byte) (*cdx.BOM, error)
- func DiscoverAttestations(image string, predicateType string) ([]map[string]any, error)
- func DiscoverSupplementarySBOMsInDir(dir string) ([]*cyclonedx.BOM, error)
- func DiscoverSupplementarySBOMsInImage(img v1.Image, sbomPath string) ([]*cyclonedx.BOM, error)
- func EvaluatePolicyAgainstAttestations(image string, policyPath string, attestations []map[string]any) (*sarif.SarifSchema210Json, []compliance.PolicyEvaluation, error)
- func LoadImageFromTarball(path string) (img v1.Image, cleanup func(), err error)
- func LoadRemoteImage(ctx context.Context, image string) (v1.Image, error)
- func Login(ctx context.Context, username, password, registryURL string) error
- func MaybeLoginIntoOciRegistry(ctx context.Context) error
- func ObfuscateSecretAndAddFingerprint(sarifScan *sarif.SarifSchema210Json)
- func ObfuscateString(str string) string
- func PrintCycloneDXVexResults(bom cdx.BOM, failOnRisk, failOnCVSS, assetName, webUI, ref string) error
- func PrintSarifResults(report sarif.SarifSchema210Json, ...) error
- func TokenToKey(token string) (string, string, error)
- func UploadAttestation(ctx context.Context, predicate string) error
- func UploadBOM(bom io.Reader) (*http.Response, context.CancelFunc, error)
- func UploadPublicKey(ctx context.Context, token, apiURL, publicKeyPath, assetName string) error
- func UploadVEX(vex io.Reader) (*http.Response, error)
- func WarnIfUnauthenticated()
- type AttestationFileLine
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AddAssetRefFlags ¶
func AddDefaultFlags ¶
func AddGenerateTagFlags ¶ added in v1.0.0
func AddSupplementarySBOMFlags ¶ added in v1.9.0
AddSupplementarySBOMFlags adds flags shared by sca/container-scanning for discovering and saving supplementary SBOMs. sbomPath controls where to look for supplementary SBOMs to merge in (a directory when scanning a path, an absolute in-image path when scanning a container image); sbomOutputPath is unrelated - it optionally saves the final, merged SBOM to a local file.
func DiscoverAttestations ¶
DiscoverAttestations fetches and decodes attestations for a container image without relying on the cosign CLI binary.
func DiscoverSupplementarySBOMsInDir ¶ added in v1.9.0
DiscoverSupplementarySBOMsInDir walks dir looking for *.json files and decodes each one as a CycloneDX SBOM. dir that does not exist is not an error - it simply yields no SBOMs.
func DiscoverSupplementarySBOMsInImage ¶ added in v1.9.0
DiscoverSupplementarySBOMsInImage flattens img's filesystem and looks for *.json files under sbomPath (an absolute path inside the image, e.g. "/sboms"), decoding each one as a CycloneDX SBOM.
Image builders commonly merge such paths in as symlinks into a content- addressed store rather than as regular files (e.g. Nix's dockerTools, which symlinks /sboms/foo.json -> /nix/store/<hash>-foo/sboms/foo.json), so this makes two passes over the flattened filesystem: the first resolves any symlinks found under sbomPath to their target path, the second reads the regular files at the direct and resolved paths.
func EvaluatePolicyAgainstAttestations ¶ added in v1.0.0
func EvaluatePolicyAgainstAttestations(image string, policyPath string, attestations []map[string]any) (*sarif.SarifSchema210Json, []compliance.PolicyEvaluation, error)
func LoadImageFromTarball ¶ added in v1.9.0
LoadImageFromTarball opens a local OCI image tarball (as produced by `docker save` / `trivy image --input`) for filesystem inspection. The tarball may optionally be gzip-compressed (e.g. images built by Nix's dockerTools are typically shipped as a .tar.gz) - since gzip streams aren't seekable and tarball.Image's opener gets invoked repeatedly (once per layer plus manifest/config lookups), decompressing on every call would re-read and re-inflate the entire archive each time. Instead, gzipped input is decompressed once into a temp file up front, and that temp file (cheap to reopen) is used for the actual image loading. The returned cleanup func removes the temp file, if one was created, and must be called once the caller is done with the image.
func LoadRemoteImage ¶ added in v1.9.0
LoadRemoteImage pulls an image reference from a registry for filesystem inspection, using the default keychain (assumes MaybeLoginIntoOciRegistry has already been called if credentials are needed).
func ObfuscateSecretAndAddFingerprint ¶
func ObfuscateSecretAndAddFingerprint(sarifScan *sarif.SarifSchema210Json)
add obfuscation function for snippet
func ObfuscateString ¶
func PrintCycloneDXVexResults ¶ added in v1.6.0
func PrintCycloneDXVexResults(bom cdx.BOM, failOnRisk, failOnCVSS, assetName, webUI, ref string) error
PrintCycloneDXVexResults prints a table from a CycloneDX BOM VEX response. Columns match PrintScaResults but without the Path column.
func PrintSarifResults ¶ added in v1.6.0
func PrintSarifResults(report sarif.SarifSchema210Json, scannerID, assetName, webUI, assetVersionName string) error
func UploadPublicKey ¶
func WarnIfUnauthenticated ¶ added in v1.0.1
func WarnIfUnauthenticated()
WarnIfUnauthenticated prints a warning to stderr when no token and no assetName are provided. It should be called after config has been parsed for commands that support unauthenticated scanning (results will not be saved to DevGuard).
Source Files