sbom

type Component struct {
	Purl             string            `json:"purl"`                        // canonical PURL (identity), e.g. "pkg:github/scanoss/engine"
	Scope            ComponentScope    `json:"scope,omitempty"`             // detected (from the scan) | declared (from a manifest); "" == detected
	Identified       bool              `json:"identified,omitempty"`        // a bom.identify rule claimed this component for at least one of its files (see FileEvidence.Identified for which)
	Local            bool              `json:"local,omitempty"`             // the project's own package (a workspace member, a path or link dependency), not a third-party one
	AliasPurls       []string          `json:"alias_purls,omitempty"`       // additional PURLs identifying the same component (beyond Purl)
	Vendor           string            `json:"vendor,omitempty"`            // supplier / namespace
	Name             string            `json:"name,omitempty"`              // component name
	Version          string            `json:"version,omitempty"`           // resolved version; "" renders as "NOASSERTION"
	URL              string            `json:"url,omitempty"`               // homepage / source URL ("" => no externalReference)
	URLHash          string            `json:"url_hash,omitempty"`          // SCANOSS url_hash (SPDX package checksum)
	Rank             int               `json:"rank,omitempty"`              // engine match ordering; lower is a stronger match
	ReleaseDate      string            `json:"release_date,omitempty"`      // release date of Version (YYYY-MM-DD)
	ArtifactName     string            `json:"artifact_name,omitempty"`     // release artifact holding this version, e.g. "v0.38.0.zip"
	Licenses         []License         `json:"licenses,omitempty"`          // declared and/or concluded licenses (licenses layer)
	Cryptography     []CryptoAlgorithm `json:"cryptography,omitempty"`      // cryptographic algorithms detected (crypto layer)
	Geoprovenance    []GeoLocation     `json:"geoprovenance,omitempty"`     // contributor geographic origin (geo layer)
	DownloadLocation string            `json:"download_location,omitempty"` // download location (defaults to URL)
	Evidence         []FileEvidence    `json:"evidence,omitempty"`          // where the component came from: scanned files that matched, or the manifest that declared it
}

type ComponentScope string

type CryptoAlgorithm struct {
	Algorithm string `json:"algorithm"`
	Strength  string `json:"strength,omitempty"`
}

type DependencyEdge struct {
	From string `json:"from"`
	To   string `json:"to"`
}

type DependencyRoot struct {
	Manifest  string           `json:"manifest"` // slash path of the manifest, relative to the project
	Lockfile  string           `json:"lockfile"` // slash path of the lockfile it was resolved from
	Ecosystem string           `json:"ecosystem"`
	Status    GraphStatus      `json:"status"`
	Reason    string           `json:"reason,omitempty"`
	Detail    string           `json:"detail,omitempty"`
	DevKnown  bool             `json:"dev_known"` // the manifests said which dependencies are dev; false means every member is kept as runtime
	Direct    []string         `json:"direct"`    // refs of the components the manifest declares, sorted
	Edges     []DependencyEdge `json:"edges"`     // From depends on To; both ends are component refs
}

type FileEvidence struct {
	Path            string      `json:"path"`                        // occurrence location: scanned file path, or the manifest path for a declared or transitive dependency
	SourceHash      string      `json:"source_hash,omitempty"`       // hash of the scanned input file (from the WFP)
	FileHash        string      `json:"file_hash,omitempty"`         // hash of the matched file (== source_hash for a file match; the OSS file's for a snippet)
	MatchType       string      `json:"match_type,omitempty"`        // "file" (whole file) | "snippet" | "declared" (the manifest declares it) | "transitive" (the manifest's lockfile pulls it in)
	Identified      bool        `json:"identified,omitempty"`        // a bom.identify rule claimed this component for this file
	MatchPercentage int         `json:"match_percentage,omitempty"`  // match confidence (snippet only)
	Confidence      string      `json:"confidence,omitempty"`        // attribution reliability grade: LOW, MEDIUM or HIGH
	OssFilePath     string      `json:"oss_file_path,omitempty"`     // matched file path inside the OSS component
	InputLineRanges []LineRange `json:"input_line_ranges,omitempty"` // matched line ranges in the scanned file (snippet only)
	OssLineRanges   []LineRange `json:"oss_line_ranges,omitempty"`   // matched line ranges in the OSS component (snippet only)

	// MatchIndex is where this component stood among the candidates the scan returned for this
	// file, after the BOM rules: 0 is the file's primary match — the component the file
	// originates from — and the ones after it redistribute it (forks, mirrors, packagings,
	// projects that vendor it). Nil when there is no candidate list to stand in: declared
	// evidence, or a document written before the field existed.
	//
	// It is the only place a file's candidate order survives. A component's evidence is sorted
	// by path and the components are not in any file's order, so a consumer rebuilding "the
	// candidates of this file" ranks them by this field, not by where it found them.
	MatchIndex *int `json:"match_index,omitempty"`
}

type Format string

type GeoLocation struct {
	Name       string  `json:"name"`
	Percentage float64 `json:"percentage,omitempty"`
}

type GraphStatus string

type Inventory struct {
	Components      []Component      `json:"components"`
	Vulnerabilities []Vulnerability  `json:"vulnerabilities,omitempty"`
	Dependencies    []DependencyRoot `json:"dependencies,omitempty"`
}

type License struct {
	ID              string                 `json:"id"`                        // SPDX id or "LicenseRef-*", e.g. "GPL-2.0-only"
	Acknowledgement LicenseAcknowledgement `json:"acknowledgement,omitempty"` // declared (default) | concluded
}

type LicenseAcknowledgement string

type LineRange struct {
	StartLine int `json:"start_line"` // first line of the matched range
	EndLine   int `json:"end_line"`   // last line of the matched range
}

type Option func(*options)

type RawDocument struct {
	SchemaVersion string      `json:"schema_version"`
	Metadata      RawMetadata `json:"metadata"`
	Inventory
}

type RawMetadata struct {
	Tool        string `json:"tool,omitempty"`
	ToolVersion string `json:"tool_version,omitempty"`
	Project     string `json:"project,omitempty"`
}

type Vulnerability struct {
	ID       string   `json:"id"`                 // advisory/CVE id, e.g. "CVE-2021-1234"
	Severity string   `json:"severity,omitempty"` // critical|high|medium|low|none|"" (case-insensitive)
	Source   string   `json:"source,omitempty"`   // advisory source name, e.g. "NVD"
	URL      string   `json:"url,omitempty"`      // advisory URL (optional)
	Summary  string   `json:"summary,omitempty"`  // short description (optional)
	Purls    []string `json:"purls,omitempty"`    // PURLs of the affected components, versioned when the source says which version

	// Optional quantitative scoring. All fields are optional: when unset they are not
	// rendered, and the output is identical to a severity-only vulnerability.
	CVSSScore  *float64 `json:"cvss_score,omitempty"`  // CVSS base score 0.0–10.0
	CVSSVector string   `json:"cvss_vector,omitempty"` // CVSS vector string, e.g. "CVSS:3.1/AV:N/..."
	CVSSMethod string   `json:"cvss_method,omitempty"` // CVSS scoring method, e.g. "CVSSv31"
	CWEs       []int    `json:"cwes,omitempty"`        // CWE ids, e.g. [77]
	EPSSScore  *float64 `json:"epss_score,omitempty"`  // EPSS probability 0.0–1.0 (no native CycloneDX field; emitted as a property)
}