cdx

type Advisory ¶

type Advisory = cyclonedx.Advisory

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type Affect ¶

type Affect = cyclonedx.Affect

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type Analysis ¶

type Analysis = cyclonedx.Analysis

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

func AnalysisForStateChange(status, detail string) *Analysis

type Approach ¶ added in v3.35.0

type Approach = cyclonedx.Approach

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type Authorship ¶ added in v3.99.0

type Authorship = cyclonedx.Authorship

Authorship, LifecyclePhase and the phase constants are re-exported so callers in this repository work in one vocabulary rather than importing the library alongside this package for a single enum.

func Authoring(toolName string, manufacturer *OrganizationalEntity, phases ...LifecyclePhase) Authorship

type BOM ¶

type BOM = cyclonedx.Document

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

func BuildFromLocalScan(results []LocalScanResult, specVersion string, scanCtx *ScanContext, seed *BOM) *BOM

func MergeBOMs(existing, incoming *BOM) *BOM

func MergeUpstream(local *BOM, upstream map[string]any) (*BOM, error)

type CDXDependency ¶

type CDXDependency = cyclonedx.Dependency

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

func BuildDependencies(groups []scan.ManifestGroup, compRefs map[string]string) []CDXDependency

type Component ¶

type Component = cyclonedx.Component

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

func Participating(toolName string) Component

type DeploymentContext ¶ added in v3.97.0

type DeploymentContext struct {
	Project     string            `json:"project,omitempty"`
	Cluster     string            `json:"cluster,omitempty"`
	Namespace   string            `json:"namespace,omitempty"`
	Environment string            `json:"environment,omitempty"`
	Tags        map[string]string `json:"tags,omitempty"`
}

DeploymentContext is the set of deployment labels for one run.

Every field is optional, and an unset field stays empty rather than being guessed at: a scan that does not know its cluster must not claim one.

func DeploymentContextFromBOM(bom *BOM) DeploymentContext

func (d DeploymentContext) Empty() bool

func (d DeploymentContext) String() string

type ExternalReference ¶

type ExternalReference = cyclonedx.ExternalReference

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type Hash ¶ added in v3.15.0

type Hash = cyclonedx.Hash

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type LicenseChoice ¶

type LicenseChoice = cyclonedx.LicenseChoice

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type LicenseData ¶

type LicenseData = cyclonedx.LicenseData

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type Lifecycle ¶

type Lifecycle = cyclonedx.Lifecycle

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type LifecyclePhase ¶ added in v3.99.0

type LifecyclePhase = cyclonedx.LifecyclePhase

Authorship, LifecyclePhase and the phase constants are re-exported so callers in this repository work in one vocabulary rather than importing the library alongside this package for a single enum.

func DerivePhases(src LifecycleSources) []LifecyclePhase

func ParseLifecyclePhases(csv string) ([]LifecyclePhase, error)

type LifecycleSources ¶ added in v3.99.0

type LifecycleSources struct {
	// Manifests is true when declared dependencies were read from manifests or
	// lockfiles.
	Manifests bool
	// InstalledTree is true when a resolved, installed dependency tree was
	// walked — node_modules, site-packages, vendor/ and the like.
	InstalledTree bool
	// ContainerImage is true when a built image or its package databases were
	// read, and CompiledArtifacts when package metadata was recovered out of
	// compiled binaries.
	ContainerImage    bool
	CompiledArtifacts bool
	// Discovery is true for a pass that identifies assets by observation rather
	// than by resolving a declared set — the AI and crypto inventories.
	Discovery bool
	// Deployed is true when the run was given deployment context, which is a
	// statement that this inventory describes something running.
	Deployed bool
}

LifecycleSources describes what a pass actually read, which is what decides the phases it may claim.

type LocalScanResult ¶

type LocalScanResult struct {
	File          scan.DetectedFile
	Packages      []scan.ScopedPackage
	Vulns         []scan.VulnFinding
	EnrichedVulns []scan.EnrichedVuln // populated after enrichment; used for full ratings
}

LocalScanResult holds the parsed packages and found vulnerabilities for one manifest file.

type ManufacturerSources ¶ added in v3.99.0

type ManufacturerSources struct {
	// Override is an explicit --bom-manufacturer value.
	Override string
	// Env is VULNETIX_BOM_MANUFACTURER.
	Env string
	// CIOwner is the repository owner the CI provider states. Populated for
	// GitHub, GitLab, Azure DevOps, Bitbucket and Jenkins by internal/config.
	CIOwner string
	// Git is the repository itself, used when nothing above answered.
	Git *gitctx.GitContext
	// OrgID is the Vulnetix organisation this run authenticated as. It names the
	// document's manufacturer by identifier when no human-readable name resolves
	// well enough to print, and rides along as bom-ref when one does.
	OrgID string
}

ManufacturerSources are the places a run can learn which organization it is running on behalf of, most direct first.

type Metadata ¶

type Metadata = cyclonedx.Metadata

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type ModelCard ¶ added in v3.35.0

type ModelCard = cyclonedx.ModelCard

CycloneDX modelCard (spec 1.5+). modelCard / modelParameters / approach all set additionalProperties:false, so every field is a recognised schema key — per-detection evidence belongs in the owning component's properties array, never inside the model card. A modelCard may only be attached to a component of type "machine-learning-model".

type ModelParameters ¶ added in v3.35.0

type ModelParameters = cyclonedx.ModelParameters

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type OrganizationalContact ¶

type OrganizationalContact = cyclonedx.OrganizationalContact

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type OrganizationalEntity ¶ added in v3.99.0

type OrganizationalEntity = cyclonedx.OrganizationalEntity

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

func ResolveManufacturer(src ManufacturerSources) *OrganizationalEntity

type Property ¶

type Property = cyclonedx.Property

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type Rating ¶

type Rating = cyclonedx.Rating

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type ScanContext ¶

type ScanContext struct {
	// Git is the git repository context collected from the scanned directory.
	Git *gitctx.GitContext
	// System is the host/process environment at scan time.
	System *gitctx.SystemInfo
	// ToolVersion is the version string injected at build time (e.g. "1.2.3").
	ToolVersion string
	// ToolName is the CycloneDX metadata tool component name. Defaults to
	// vulnetix-sca for backward compatibility.
	ToolName string
	// Manufacturer is the organization that created the BOM — the one running
	// this scan, resolved by ResolveManufacturer. Nil when nothing resolved it,
	// which leaves metadata.manufacturer absent rather than guessed.
	Manufacturer *OrganizationalEntity
	// Phases are the lifecycle stages at which this pass captured its data,
	// derived by DerivePhases from what the pass actually read.
	Phases []LifecyclePhase
}

ScanContext carries optional environment-enrichment data passed to BOM builders. All fields are optional; nil pointers are silently ignored.

type Source ¶

type Source = cyclonedx.VulnSource

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type Tools ¶

type Tools = cyclonedx.Tools

The CycloneDX document model is owned by vdb-cyclonedx.

These are aliases, not wrappers: cdx.BOM and cyclonedx.Document are the same type, so every composite literal in this repository compiles unchanged, and a document handed to the shared builders is not narrowed on the way through.

This package used to declare the model itself. Two declarations of one shape is two sets of omissions, and they did not match: the local one had no metadata.manufacturer and no metadata.supplier, which is most of what CycloneDX uses to say who produced a document. Worse, it was lossy — decoding a third-party BOM into it dropped every member it did not declare — and that lossiness is why internal/scanopts carried a second, map-based implementation of deployment labelling rather than reuse ApplyDeploymentContext. The shared model round-trips unmodelled members, so one implementation suffices.

What stays in this package is what is genuinely this CLI's: which lifecycle phase a scan captured, how git and host context become metadata, how two documents merge, and the vulnetix:* property vocabulary.

type Vulnerability ¶

type Vulnerability = cyclonedx.Vulnerability

Vulnerability and its parts. Rating.Score is a *float64 here where this package used to declare a float64: an unscored rating is common, and a value type emitted "score": 0 next to "severity": "high", which asserts a score of zero rather than the absence of one.