sbom

type Component struct {
	Purl             string            `json:"purl"`                        // canonical PURL (identity), e.g. "pkg:github/scanoss/engine"
	Scope            ComponentScope    `json:"scope,omitempty"`             // detected (from the scan) | declared (from a manifest); "" == detected
	AliasPurls       []string          `json:"alias_purls,omitempty"`       // additional PURLs identifying the same component (beyond Purl)
	Vendor           string            `json:"vendor,omitempty"`            // supplier / namespace
	Name             string            `json:"name,omitempty"`              // component name
	Version          string            `json:"version,omitempty"`           // resolved version; "" renders as "NOASSERTION"
	URL              string            `json:"url,omitempty"`               // homepage / source URL ("" => no externalReference)
	URLHash          string            `json:"url_hash,omitempty"`          // SCANOSS url_hash (SPDX package checksum)
	Rank             int               `json:"rank,omitempty"`              // engine match ordering; lower is a stronger match
	ReleaseDate      string            `json:"release_date,omitempty"`      // release date of Version (YYYY-MM-DD)
	ArtifactName     string            `json:"artifact_name,omitempty"`     // release artifact holding this version, e.g. "v0.38.0.zip"
	Licenses         []License         `json:"licenses,omitempty"`          // declared and/or concluded licenses (licenses layer)
	Cryptography     []CryptoAlgorithm `json:"cryptography,omitempty"`      // cryptographic algorithms detected (crypto layer)
	Geoprovenance    []GeoLocation     `json:"geoprovenance,omitempty"`     // contributor geographic origin (geo layer)
	DownloadLocation string            `json:"download_location,omitempty"` // download location (defaults to URL)
	Evidence         []FileEvidence    `json:"evidence,omitempty"`          // where the component came from: scanned files that matched, or the manifest that declared it
}

type ComponentScope string

type CryptoAlgorithm struct {
	Algorithm string `json:"algorithm"`
	Strength  string `json:"strength,omitempty"`
}

type FileEvidence struct {
	Path            string      `json:"path"`                        // occurrence location: scanned file path, or the manifest path for a declared dependency
	SourceHash      string      `json:"source_hash,omitempty"`       // hash of the scanned input file (from the WFP)
	FileHash        string      `json:"file_hash,omitempty"`         // hash of the matched file (== source_hash for a file match; the OSS file's for a snippet)
	MatchType       string      `json:"match_type,omitempty"`        // "file" (whole file) | "snippet" | "declared" (from a manifest)
	MatchPercentage int         `json:"match_percentage,omitempty"`  // match confidence (snippet only)
	OssFilePath     string      `json:"oss_file_path,omitempty"`     // matched file path inside the OSS component
	InputLineRanges []LineRange `json:"input_line_ranges,omitempty"` // matched line ranges in the scanned file (snippet only)
	OssLineRanges   []LineRange `json:"oss_line_ranges,omitempty"`   // matched line ranges in the OSS component (snippet only)
}

type Format string

type GeoLocation struct {
	Name       string  `json:"name"`
	Percentage float64 `json:"percentage,omitempty"`
}

type Inventory struct {
	Components      []Component     `json:"components"`
	Vulnerabilities []Vulnerability `json:"vulnerabilities,omitempty"`
}

type License struct {
	ID              string                 `json:"id"`                        // SPDX id or "LicenseRef-*", e.g. "GPL-2.0-only"
	Acknowledgement LicenseAcknowledgement `json:"acknowledgement,omitempty"` // declared (default) | concluded
}

type LicenseAcknowledgement string

type LineRange struct {
	StartLine int `json:"start_line"` // first line of the matched range
	EndLine   int `json:"end_line"`   // last line of the matched range
}

type Option func(*options)

type RawDocument struct {
	SchemaVersion string      `json:"schema_version"`
	Metadata      RawMetadata `json:"metadata"`
	Inventory
}

type RawMetadata struct {
	Tool        string `json:"tool,omitempty"`
	ToolVersion string `json:"tool_version,omitempty"`
	Project     string `json:"project,omitempty"`
}

type Vulnerability struct {
	ID       string   `json:"id"`                 // advisory/CVE id, e.g. "CVE-2021-1234"
	Severity string   `json:"severity,omitempty"` // critical|high|medium|low|none|"" (case-insensitive)
	Source   string   `json:"source,omitempty"`   // advisory source name, e.g. "NVD"
	URL      string   `json:"url,omitempty"`      // advisory URL (optional)
	Summary  string   `json:"summary,omitempty"`  // short description (optional)
	Purls    []string `json:"purls,omitempty"`    // PURLs of the affected components, versioned when the source says which version

	// Optional quantitative scoring. All fields are optional: when unset they are not
	// rendered, and the output is identical to a severity-only vulnerability.
	CVSSScore  *float64 `json:"cvss_score,omitempty"`  // CVSS base score 0.0–10.0
	CVSSVector string   `json:"cvss_vector,omitempty"` // CVSS vector string, e.g. "CVSS:3.1/AV:N/..."
	CVSSMethod string   `json:"cvss_method,omitempty"` // CVSS scoring method, e.g. "CVSSv31"
	CWEs       []int    `json:"cwes,omitempty"`        // CWE ids, e.g. [77]
	EPSSScore  *float64 `json:"epss_score,omitempty"`  // EPSS probability 0.0–1.0 (no native CycloneDX field; emitted as a property)
}