Documentation
¶
Overview ¶
Package sbom generates and describes container-image SBOMs for devradarctl.
Index ¶
- Constants
- func Digest(ctx context.Context, image string) (v1.Hash, error)
- func EnsureSyft(syftPath string) error
- func Generate(ctx context.Context, ref string, opts Options) ([]byte, error)
- func PinnedRef(ctx context.Context, image string) (string, error)
- func Repository(ref string) string
- func SplitRef(ref string) (repository, tag, digest string)
- func Tag(ref string) string
- type Options
Constants ¶
const DefaultScope = "all-layers"
DefaultScope is the syft cataloging scope. "all-layers" walks every image layer (not just the squashed filesystem), which surfaces packages that a later layer deletes or shadows — the safest default for inventory.
const DefaultSyftPath = "syft"
DefaultSyftPath is the syft binary looked up on PATH when none is configured.
Variables ¶
This section is empty.
Functions ¶
func Digest ¶
Digest resolves and returns just the manifest digest (e.g. "sha256:…") for image, without the repository prefix.
func EnsureSyft ¶
EnsureSyft verifies the configured syft binary is resolvable, returning an actionable error if it is not. Callers should invoke this before generation so a missing dependency fails fast with clear guidance.
func Generate ¶
Generate produces an all-layers CycloneDX-JSON SBOM for ref using syft. ref should be a digest-pinned reference (see PinnedRef) so the SBOM embeds the manifest digest. It returns the raw SBOM bytes.
func PinnedRef ¶
PinnedRef resolves image's manifest digest against its registry and returns a digest-pinned reference of the form "repo@sha256:…". Pinning by digest (not tag) is what makes the generated SBOM carry the manifest digest the DevRadar service needs to identify the image unambiguously.
If image already carries a digest, it is normalized and reused without a network call. Registry auth uses the ambient Docker keychain (respects docker login / credential helpers).
func Repository ¶
Repository returns just the repository component of an image reference — the grouping key for an image across its versions and digests.
func SplitRef ¶
SplitRef decomposes an image reference into its repository, tag, and digest. Any of tag/digest may be empty. The repository is the registry/path with no tag or digest — the stable identity DevRadar groups an image's SBOMs by (across versions and digests).
quay.io/jetstack/cainjector:v1.20.2@sha256:ab… -> repo=quay.io/jetstack/cainjector tag=v1.20.2 digest=sha256:ab… quay.io/jetstack/cainjector@sha256:ab… -> repo=quay.io/jetstack/cainjector tag="" digest=sha256:ab… registry:5000/app:1.2 -> repo=registry:5000/app tag=1.2 digest="" alpine -> repo=alpine tag="" digest=""
Source Files