Documentation
¶
Overview ¶
Package scansource adapts SCANOSS SDK values — a v3 scan result and the licenses, vulnerabilities, cryptography and geoprovenance decoration responses — into the neutral sbom.Inventory consumed by the sbom package. It is the only SBOM code that depends on the scan SDK; the sbom package itself stays SDK-free.
Index ¶
- func Cryptography(resp *scanossapi.CryptoAlgorithmsResponse) map[string][]sbom.CryptoAlgorithm
- func Geoprovenance(resp *scanossapi.GeoOriginResponse) map[string][]sbom.GeoLocation
- func Inventory(result *scanossapi.ScanResult, opts ...InventoryOption) sbom.Inventory
- func Key(purl, version string) string
- func Licenses(resp *scanossapi.ComponentsLicenseResponse) map[string][]sbom.License
- func Vulnerabilities(resp *scanossapi.VulnerabilitiesResponse) []sbom.Vulnerability
- type InventoryOption
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Cryptography ¶ added in v0.7.0
func Cryptography(resp *scanossapi.CryptoAlgorithmsResponse) map[string][]sbom.CryptoAlgorithm
Cryptography maps a cryptography-algorithms decoration response into algorithms keyed by Key(purl, requirement).
func Geoprovenance ¶ added in v0.7.0
func Geoprovenance(resp *scanossapi.GeoOriginResponse) map[string][]sbom.GeoLocation
Geoprovenance maps a geoprovenance-origin decoration response into contributor locations keyed by PURL (the response carries no requirement to join on).
func Inventory ¶ added in v0.7.0
func Inventory(result *scanossapi.ScanResult, opts ...InventoryOption) sbom.Inventory
Inventory builds one from a v3 scan result. The deduplicated component catalog becomes the components; each component's matched files (joined by url_hash) become its file evidence. The version is taken from the component entry. Licenses and vulnerabilities are not populated here — they come from the decoration services (see Licenses, Vulnerabilities).
func Key ¶ added in v0.7.0
Key is the join key matching a decoration response entry to a component: its PURL plus the queried version (the decoration echoes the queried version back as `requirement`). It identifies a component at a version, so every per-component layer shares it — licenses and cryptography today — which is why it is named after none of them.
func Licenses ¶ added in v0.7.0
func Licenses(resp *scanossapi.ComponentsLicenseResponse) map[string][]sbom.License
Licenses maps a licenses decoration response into declared licenses keyed by Key(purl, requirement). Duplicate ids per key are dropped. (The decoration service has no declared/concluded distinction — its licenses are declared.)
func Vulnerabilities ¶ added in v0.7.0
func Vulnerabilities(resp *scanossapi.VulnerabilitiesResponse) []sbom.Vulnerability
Vulnerabilities maps a vulnerabilities decoration response into neutral vulnerabilities, deduplicated by id (falling back to the CVE), accumulating the affected component PURLs.
Types ¶
type InventoryOption ¶ added in v0.8.1
type InventoryOption func(*inventoryOptions)
InventoryOption tunes how a scan result is adapted.
func WithIdentified ¶ added in v0.8.1
func WithIdentified(fn func(path, urlHash string) bool) InventoryOption
WithIdentified supplies the verdict the BOM identify rules reached: given a scanned path and the url_hash of a component matched there, whether the user declared that component present. postprocess.Report.IsIdentified has exactly this shape.
It is passed in rather than read off the result because the result's types come from the API SDK: they carry what the server said, and have nowhere to record a conclusion the client reached on its own. A function rather than a map so this package needs no type in common with whatever produced the verdict.
Source Files