Documentation
¶
Overview ¶
Package scansource adapts SCANOSS SDK values — a v3 scan result and the licenses, vulnerabilities, cryptography and geoprovenance decoration responses — into the neutral sbom.Inventory consumed by the sbom package. It is the only SBOM code that depends on the scan SDK; the sbom package itself stays SDK-free.
Index ¶
- func Cryptography(resp *scanossapi.CryptoAlgorithmsResponse) map[string][]sbom.CryptoAlgorithm
- func Geoprovenance(resp *scanossapi.GeoOriginResponse) map[string][]sbom.GeoLocation
- func Inventory(result *scanossapi.ScanResult) sbom.Inventory
- func Key(purl, version string) string
- func Licenses(resp *scanossapi.ComponentsLicenseResponse) map[string][]sbom.License
- func Vulnerabilities(resp *scanossapi.VulnerabilitiesResponse) []sbom.Vulnerability
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Cryptography ¶ added in v0.7.0
func Cryptography(resp *scanossapi.CryptoAlgorithmsResponse) map[string][]sbom.CryptoAlgorithm
Cryptography maps a cryptography-algorithms decoration response into algorithms keyed by Key(purl, requirement).
func Geoprovenance ¶ added in v0.7.0
func Geoprovenance(resp *scanossapi.GeoOriginResponse) map[string][]sbom.GeoLocation
Geoprovenance maps a geoprovenance-origin decoration response into contributor locations keyed by PURL (the response carries no requirement to join on).
func Inventory ¶ added in v0.7.0
func Inventory(result *scanossapi.ScanResult) sbom.Inventory
Inventory builds one from a v3 scan result. The deduplicated component catalog becomes the components; each component's matched files (joined by url_hash) become its file evidence. The version is taken from the component entry. Licenses and vulnerabilities are not populated here — they come from the decoration services (see Licenses, Vulnerabilities).
func Key ¶ added in v0.7.0
Key is the join key matching a decoration response entry to a component: its PURL plus the queried version (the decoration echoes the queried version back as `requirement`). It identifies a component at a version, so every per-component layer shares it — licenses and cryptography today — which is why it is named after none of them.
func Licenses ¶ added in v0.7.0
func Licenses(resp *scanossapi.ComponentsLicenseResponse) map[string][]sbom.License
Licenses maps a licenses decoration response into declared licenses keyed by Key(purl, requirement). Duplicate ids per key are dropped. (The decoration service has no declared/concluded distinction — its licenses are declared.)
func Vulnerabilities ¶ added in v0.7.0
func Vulnerabilities(resp *scanossapi.VulnerabilitiesResponse) []sbom.Vulnerability
Vulnerabilities maps a vulnerabilities decoration response into neutral vulnerabilities, deduplicated by id (falling back to the CVE), accumulating the affected component PURLs.
Types ¶
This section is empty.
Source Files