sbom

package

v4.2.0 Latest Latest Go to latest Published: Jul 5, 2026 License: MIT Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/monstercameron/GoWebComponents

Links

Open Source Insights

Documentation ¶

Overview ¶

Package sbom generates a CycloneDX software bill of materials for the module's dependency graph, so a release can attach an SBOM whose package list matches go.mod. It shells out to `go list -m -json all` (the authoritative module list) rather than parsing go.mod directly, so it captures the full resolved graph including transitive dependencies.

Index ¶

func WriteFile(parseRepoRoot string, parsePath string) error
type Component
type Document
- func BuildDocument(parseListJSON []byte) (Document, error)
- func Generate(parseRepoRoot string) (Document, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func WriteFile ¶

func WriteFile(parseRepoRoot string, parsePath string) error

WriteFile generates the BOM for parseRepoRoot and writes it as indented JSON.

Types ¶

type Component ¶

type Component struct {
	Type    string `json:"type"`
	BOMRef  string `json:"bom-ref"`
	Name    string `json:"name"`
	Version string `json:"version"`
	PURL    string `json:"purl"`
}

Component is one CycloneDX component (a Go module dependency).

type Document ¶

type Document struct {
	BOMFormat   string      `json:"bomFormat"`
	SpecVersion string      `json:"specVersion"`
	Version     int         `json:"version"`
	Components  []Component `json:"components"`
}

Document is the minimal CycloneDX 1.5 BOM shape needed to enumerate the dependency components.

func BuildDocument ¶

func BuildDocument(parseListJSON []byte) (Document, error)

BuildDocument decodes the `go list -m -json all` stream into a CycloneDX BOM. The main module is excluded (it is the subject, not a dependency), as are modules without a resolved version.

func Generate ¶

func Generate(parseRepoRoot string) (Document, error)

Generate runs the module list in parseRepoRoot and returns a CycloneDX BOM.

Source Files ¶

View all Source files

sbom.go

Directories ¶

Path	Synopsis
cmd
sbom command Command sbom writes a CycloneDX SBOM for the module to the given path.	Command sbom writes a CycloneDX SBOM for the module to the given path.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL