Documentation
¶
Overview ¶
Package sbom turns the top-level elements of an SBOM into attestation subjects. The SBOM is located and fetched with the carabiner collector (so it can live on a filesystem, a release, an OCI registry, etc — anywhere a collector driver reaches) and parsed with protobom, so both SPDX and CycloneDX documents work, bare or wrapped in an attestation.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CollectSubjects ¶
func CollectSubjects(ctx context.Context, init string, filter []string) ([]*intoto.ResourceDescriptor, error)
CollectSubjects fetches the SBOM(s) reachable through the collector init string (eg "fs:sboms/", "release:owner/repo@v1.0.0", "jsonl:atts.jsonl") and returns their top-level elements as attestation subjects. The filter globs, when given, are matched against the top-level node names. Because the subjects go into an attestation, every collected node must carry at least one digest in an algorithm in-toto recognizes.
Types ¶
This section is empty.
Source Files