Documentation
¶
Overview ¶
Package scansource adapts SCANOSS SDK values (a v3 scan result and a vulnerabilities decoration response) into the neutral sbom.Inventory consumed by the sbom package. It is the only SBOM code that depends on the scan SDK; the sbom package itself stays SDK-free.
Index ¶
- func CryptographyFrom(resp *scanossapi.CryptoAlgorithmsResponse) map[string][]sbom.CryptoAlgorithm
- func FromScanResult(result *scanossapi.ScanResult) sbom.Inventory
- func GeoprovenanceFrom(resp *scanossapi.GeoOriginResponse) map[string][]sbom.GeoLocation
- func LicenseKey(purl, version string) string
- func LicensesFrom(resp *scanossapi.ComponentsLicenseResponse) map[string][]sbom.License
- func VulnerabilitiesFrom(resp *scanossapi.VulnerabilitiesResponse) []sbom.Vulnerability
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CryptographyFrom ¶
func CryptographyFrom(resp *scanossapi.CryptoAlgorithmsResponse) map[string][]sbom.CryptoAlgorithm
CryptographyFrom maps a cryptography-algorithms decoration response into algorithms keyed by LicenseKey(purl, requirement).
func FromScanResult ¶
func FromScanResult(result *scanossapi.ScanResult) sbom.Inventory
FromScanResult builds an Inventory from a v3 scan result. The deduplicated component catalog becomes the components; each component's matched files (joined by url_hash) become its file evidence. The version is taken from the component entry. Licenses and vulnerabilities are not populated here — they come from decoration services (LicensesFrom, VulnerabilitiesFrom).
func GeoprovenanceFrom ¶
func GeoprovenanceFrom(resp *scanossapi.GeoOriginResponse) map[string][]sbom.GeoLocation
GeoprovenanceFrom maps a geoprovenance-origin decoration response into contributor locations keyed by PURL (the response carries no requirement to join on).
func LicenseKey ¶
LicenseKey is the join key matching a decoration response entry to a component: its PURL plus the queried version (the decoration echoes the queried version back as `requirement`).
func LicensesFrom ¶
func LicensesFrom(resp *scanossapi.ComponentsLicenseResponse) map[string][]sbom.License
LicensesFrom maps a licenses decoration response into declared licenses keyed by LicenseKey(purl, requirement). Duplicate ids per key are dropped. (The decoration service has no declared/concluded distinction — its licenses are declared.)
func VulnerabilitiesFrom ¶
func VulnerabilitiesFrom(resp *scanossapi.VulnerabilitiesResponse) []sbom.Vulnerability
VulnerabilitiesFrom maps a vulnerabilities decoration response into neutral vulnerabilities, deduplicated by id (falling back to the CVE), accumulating the affected component PURLs.
Types ¶
This section is empty.
Source Files