sbom

Documentation

Overview

Package sbom captures the internal data model of the SBOMs melange produces into a private, generalized bill of materials model (with relationship data) designed to be transcoded to specific formats.

Index

• func GenerateAndWrite(ctx context.Context, apkFSPath string, spec *Spec) error
• func GenerateSPDX(ctx context.Context, spec *Spec) (*spdx.Document, error)
• type Spec

Functions

func GenerateAndWrite

func GenerateAndWrite(ctx context.Context, apkFSPath string, spec *Spec) error

GenerateAndWrite creates an SBOM for the APK package described by the given Spec and writes the SBOM to the APK's filesystem.

func GenerateSPDX

func GenerateSPDX(ctx context.Context, spec *Spec) (*spdx.Document, error)

GenerateSPDX creates an SPDX 2.3 document from the given Spec.

Types

type Spec

type Spec struct {
	PackageName     string
	PackageVersion  string
	License         string // Full SPDX license expression
	LicensingInfos  map[string]string
	ExternalRefs    []purl.PackageURL
	Copyright       string
	Namespace       string
	Arch            string
	SourceDateEpoch time.Time
}

Spec describes the metadata of an APK package for which an SBOM should be created.