depsource

func Graph ¶

func Graph(g resolve.Graph) sbom.Inventory

Graph projects a resolved graph into an inventory: one declared component per member of each root that is not dev, and one DependencyRoot per root. A node shared by several roots is one component carrying one evidence per root, "declared" where that root's manifest declares it and "transitive" where its lockfile pulls it in. Dev members never appear, and neither does an edge that touches one, so a root's edges only ever join components that are in the inventory. An unknown root is kept, with no members and no edges, so the output says the lockfile was there and could not be read.

func Inventory ¶

func Inventory(root string, files []string) (sbom.Inventory, map[string]error)

Inventory reads the dependency files of the project at root. Each supported lockfile is resolved into a graph and the graphs are merged; every root covers its manifest and its lockfile, so neither is parsed flat again. An unknown root covers them too: it says the lockfile was there and could not be read, and a flat parse would bring back the range entries and dev dependencies the graph exists to replace. Every other selected manifest is parsed flat.

failed is keyed by path and holds the lockfiles that could not be read and the manifests that could not be parsed. It is nil when nothing failed. Unknown roots are not failures: they are reported on the root itself.

func Manifests ¶

func Manifests(parsed *parsers.LocalDependencies, root string) sbom.Inventory

Manifests builds declared components from flat-parsed manifests, with no round trip to any service: each PURL is split into its base and version (the manifest's requirement when the PURL carries none), tagged declared, and given the manifest as evidence, relative to root in slash form so it matches a root's manifest path. Exact duplicates fold into one component with one evidence per manifest; distinct versions of a package are kept, including a declared range (package.json "^1.5.5") alongside its resolved pin (package-lock.json "1.14.3").

func Select ¶

func Select(files []string) []string

Select keeps the files Inventory reads: the lockfiles the resolver supports and the manifests the flat parsers handle. A caller collecting a tree hands it everything and gets back what the dependency stage will open, which is also the count worth reporting as that stage's total.