Documentation
¶
Overview ¶
Package postprocess applies a scan's bill-of-materials rules to its results: what the user says about the components the scan found, once the scan has found them.
It is deliberately apart from the scan SDK. Nothing here talks to the API, holds a client or takes a context — these are local transformations over a result the caller already has, which is also why a result parsed from a file can go through them just as one straight off a scan can.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type EvidenceKey ¶ added in v0.8.1
EvidenceKey identifies one match: the scanned file, and the component it matched.
type Option ¶ added in v0.8.1
type Option func(*options)
Option tunes what Apply does beyond the BOM rules the settings file carries.
func WithRankingThreshold ¶ added in v0.8.1
WithRankingThreshold drops matches whose component ranks worse than threshold. Rank is the scanner's own ordering of how well a component explains a match, lowest is strongest; ranks seen in practice run 1..9.
A threshold at or below 0 disables the filter, which is how the engine reads it too. Matches a bom.identify rule claims are never dropped by it.
It is an option rather than a field on settings.BOM because it is not a statement about any component: it is a quality bar over whatever the scan found, and it reaches this package from a flag as readily as from a settings file.
type Report ¶ added in v0.8.1
type Report struct {
// Identified holds the url_hash of every component a bom.identify rule claimed, for at
// least one file. A path-scoped rule that claimed one of a component's files puts it here:
// the user declared that component present, whatever the scope of the rule that said so.
Identified map[string]bool
// Evidence records the claim per file, keyed by the scanned path and the matched
// component's url_hash. It is the finer answer Identified summarises, and the one a
// per-file report needs: a rule scoped to "vendor/" claims a component in the files under
// it and not in the ones outside, which a component-level flag cannot say.
Evidence map[EvidenceKey]bool
}
Report is what the selection rules concluded, for consumers that need more than the rewritten result. The scan result itself cannot carry it: its types come from the API SDK, which has no field for a client-side verdict.
func Apply ¶ added in v0.5.0
func Apply(result *scanossapi.ScanResult, bom *settings.BOM, opts ...Option) Report
Apply runs the BOM rules over a scan result in place, and returns what the selection rules concluded (see Report).
The order is the point of this function, and the reason the individual rules are not exported:
- The match-level rules — bom.ignore, bom.identify and the ranking threshold — settle which of the candidates the scanner returned for each file survive, and which of them leads. They run first so the file-level rules below see the candidate list the user actually meant, rather than dismissing a file over a component that was about to be dropped anyway. The three share one pass; how they interact is internal to applySelect, which documents it.
- bom.remove neutralizes whole files.
- bom.replace re-points what survived. Reversed with remove, a replacement rewrites the PURL a remove rule was written against, the remove rule then matches nothing, and a component the user dismissed is reported under its new name — silently, since neither rule has failed.
Making the order the caller's problem would be handing them that trap.
A nil result, with nothing to apply, is a no-op returning an empty Report.
func (Report) IsIdentified ¶ added in v0.8.1
IsIdentified reports whether a bom.identify rule claimed the component matched at this path. It is nil-safe, so a caller holding a zero Report can ask without checking first — which is what lets it be passed as a function to consumers that must not depend on this package.
Source Files