image

type Advisories struct {
	Advisory []string `xml:"v:advisory"`
}

type BdComponent struct {
	XMLName xml.Name `xml:"component"`
	Component
}

type BdTool struct {
	XMLName xml.Name `xml:"tool"`
	Vendor  string   `xml:"vendor,omitempty"` // The vendor of the tool used to create the BOM.
	Name    string   `xml:"name,omitempty"`   // The name of the tool used to create the BOM.
	Version string   `xml:"version"`          // The version of the tool used to create the BOM.
}

type BomDescriptor struct {
	XMLName   xml.Name     `xml:"metadata"`
	Timestamp string       `xml:"timestamp,omitempty"` // The date and time (timestamp) when the document was created
	Tools     []BdTool     `xml:"tools>tool"`          // The tool used to create the BOM.
	Component *BdComponent `xml:"component"`           // The Component that the BOM describes.
}

type Component struct {
	XMLName xml.Name `xml:"component"`
	// Required; Describes if the Component is a library, framework, application, container, operating system, firmware,
	// hardware device, or file
	Type string `xml:"type,attr"`
	// The organization that supplied the Component.
	// The supplier may often be the manufacture, but may also be a distributor or repackager.
	Supplier string `xml:"supplier,omitempty"`
	// The person(s) or organization(s) that authored the Component
	Author string `xml:"author,omitempty"`
	// The person(s) or organization(s) that published the Component
	Publisher string `xml:"publisher,omitempty"`
	// The high-level classification that a project self-describes as. This will often be a shortened,
	// single name of the company or project that produced the Component, or the source package or domain name.
	Group string `xml:"group,omitempty"`
	// Required; The name of the Component as defined by the project
	Name string `xml:"name"`
	// Required; The version of the Component as defined by the project
	Version string `xml:"version"`
	// A description of the Component
	Description string `xml:"description,omitempty"`
	// A node describing zero or more License names, SPDX License IDs or expressions
	Licenses *[]License `xml:"licenses>License"`
	// Specifies the package-url (PackageURL). The purl,
	// if specified, must be valid and conform to the specification defined at: https://github.com/package-url/purl-spec
	PackageURL      string                 `xml:"purl,omitempty"`
	Vulnerabilities *[]VulnerabilityCyclon `xml:"v:vulnerabilities>v:vulnerability,omitempty"`
}

type CvssItem struct {
	V2 float32 `json:"v2"`
	V3 float32 `json:"v3"`
}

type Document struct {
	XMLName       xml.Name       `xml:"bom"`
	XMLNs         string         `xml:"xmlns,attr"`
	XMLNsV        string         `xml:"xmlns:v,attr"`
	Version       int            `xml:"version,attr"`
	SerialNumber  string         `xml:"serialNumber,attr"`
	BomDescriptor *BomDescriptor `xml:"metadata"`
	Components    []Component    `xml:"components>component"`
}

type Identifier struct {
	FullTag        string   `json:"full_tag"`
	Registry       string   `json:"registry"`
	Repo           string   `json:"repo"`
	Tag            string   `json:"tag"`
	ManifestDigest string   `json:"manifest_digest"`
	RepoDigests    []string `json:"repo_digests"`
}

type License struct {
	XMLName xml.Name `xml:"license"`
	// A valid SPDX License ID
	ID string `xml:"id,omitempty"`
	// If SPDX does not define the License used, this field may be used to provide the License name.
	Name string `xml:"name,omitempty"`
}

type Metadata struct {
	Distro        string `json:"distro"`
	DistroVersion string `json:"distro_version"`
	ImageSize     uint   `json:"image_size"`
	LayerCount    uint   `json:"layer_count"`
}

type PolicyViolation struct {
	Policy    string     `json:"policy"`
	Rule      string     `json:"rule"`
	Risk      string     `json:"risk"`
	Violation Violations `json:"violation"`
}

type Rating struct {
	Score    *Score `xml:"v:score,omitempty"`
	Severity string `xml:"v:severity,omitempty"`
	Method   string `xml:"v:method,omitempty"`
	Vector   string `xml:"v:vector,omitempty"`
}

type SBOM struct {
	// FullTag is the full tag of the bom
	FullTag string
	// ManifestDigest is the sha256 of this image manifest json
	ManifestDigest string
	// Packages enumerates the packages in the bill of materials
	Packages bom.JSONDocument
}

type ScannedImage struct {
	Identifier       `json:",inline"`
	ImageMetadata    Metadata          `json:"image_metadata"`
	Account          string            `json:"account"`
	ScanStatus       string            `json:"scan_status"`
	Vulnerabilities  []Vulnerability   `json:"vulnerabilities"`
	PolicyViolations []PolicyViolation `json:"policy_violations,omitempty"`
	Packages         bom.JSONDocument  `json:"packages"`
}

type Score struct {
	Base           float64 `xml:"v:base"`
	Impact         float64 `xml:"v:impact"`
	Exploitability float64 `xml:"v:exploitability"`
}

type Source struct {
	Name string `xml:"name,attr"`
	URL  string `xml:"v:url"`
}

type ValidatedImage struct {
	Identifier       `json:",inline"`
	PolicyViolations []PolicyViolation `json:"policy_violations"`
}

type ValidatedImageOption struct {
	tabletool.Option
}

type Violation struct {
	Image           string          `json:"image"`
	Vulnerabilities []Vulnerability `json:"vulnerabilities"`
}

type Violations struct {
	ViolatedImages []Violation `json:"scanned"`
}

type Vulnerability struct {
	ID           string   `json:"id" ,xml:"id"`
	Package      string   `json:"package" ,xml:"package"`
	Name         string   `json:"package_name" ,xml:"package_name"`
	Version      string   `json:"package_version" ,xml:"package_version"`
	Type         string   `json:"package_type" ,xml:"package_type"`
	Severity     string   `json:"severity" ,xml:"severity"`
	Link         string   `json:"link,omitempty" ,xml:"link,omitempty"`
	Description  string   `json:"description,omitempty" ,xml:"description,omitempty"`
	FixAvailable string   `json:"fix_available" ,xml:"fix_available"`
	Cvss         CvssItem `json:"cvss" ,xml:"cvss"`
}

type VulnerabilityCyclon struct {
	Ref         string      `xml:"ref,attr"`
	ID          string      `xml:"v:id"`
	Source      Source      `xml:"v:source"`
	Ratings     []Rating    `xml:"v:ratings>v:rating"`
	Description string      `xml:"v:description,omitempty"`
	Advisories  *Advisories `xml:"v:advisories,omitempty"`
}