ctl

Documentation

Index

• Constants
• type Implementation
• type MergeOptions
• type Options
• type VexCtl
  • func New() *VexCtl
  • func (vexctl *VexCtl) Apply(r *sarif.Report, vexDocs []*vex.VEX) (finalReport *sarif.Report, err error)
  • func (vexctl *VexCtl) ApplyFiles(r *sarif.Report, files []string) (*sarif.Report, error)
  • func (vexctl *VexCtl) Attach(ctx context.Context, att *attestation.Attestation, imageRefs []string) (err error)
  • func (vexctl *VexCtl) Attest(vexDataPath string, imageRefs []string) (*attestation.Attestation, error)
  • func (vexctl *VexCtl) Merge(ctx context.Context, opts *MergeOptions, vexes []*vex.VEX) (*vex.VEX, error)
  • func (vexctl *VexCtl) MergeFiles(ctx context.Context, opts *MergeOptions, filePaths []string) (*vex.VEX, error)
  • func (vexctl *VexCtl) VexFromURI(ctx context.Context, uri string) (vexData *vex.VEX, err error)

Constants

const IntotoPayloadType = "application/vnd.in-toto+json"

Types

type Implementation

type Implementation interface {
	ApplySingleVEX(*sarif.Report, *vex.VEX) (*sarif.Report, error)
	SortDocuments([]*vex.VEX) []*vex.VEX
	OpenVexData(Options, []string) ([]*vex.VEX, error)
	Sort(docs []*vex.VEX) []*vex.VEX
	AttestationBytes(*attestation.Attestation) ([]byte, error)
	Attach(context.Context, *attestation.Attestation, string) error
	SourceType(uri string) (string, error)
	ReadImageAttestations(context.Context, Options, string) ([]*vex.VEX, error)
	Merge(context.Context, *MergeOptions, []*vex.VEX) (*vex.VEX, error)
	LoadFiles(context.Context, []string) ([]*vex.VEX, error)
}

type MergeOptions

type MergeOptions struct {
	DocumentID      string   // ID to use in the new document
	Author          string   // Author to use in the new document
	AuthorRole      string   // Role of the document author
	Products        []string // Product IDs to consider
	Vulnerabilities []string // IDs of vulnerabilities to merge
}

type Options

type Options struct {
	Products []string // List of products to match in CSAF docs
	Format   string   // Firmat of the vex documents
	Sign     bool     // When true, attestations will be signed before attaching
}

type VexCtl

type VexCtl struct {
	Options Options
	// contains filtered or unexported fields
}

func New

func New() *VexCtl

func (*VexCtl) Apply

func (vexctl *VexCtl) Apply(r *sarif.Report, vexDocs []*vex.VEX) (finalReport *sarif.Report, err error)

Apply takes a sarif report and applies one or more vex documents

func (*VexCtl) ApplyFiles

func (vexctl *VexCtl) ApplyFiles(r *sarif.Report, files []string) (*sarif.Report, error)

ApplyFiles takes a list of paths to vex files and applies them to a report

func (*VexCtl) Attach

func (vexctl *VexCtl) Attach(ctx context.Context, att *attestation.Attestation, imageRefs []string) (err error)

Attach attaches an attestation to a list of images

func (*VexCtl) Attest

func (vexctl *VexCtl) Attest(vexDataPath string, imageRefs []string) (*attestation.Attestation, error)

Generate an attestation from a VEX

func (*VexCtl) Merge

func (vexctl *VexCtl) Merge(ctx context.Context, opts *MergeOptions, vexes []*vex.VEX) (*vex.VEX, error)

Merge combines several documents into one

func (*VexCtl) MergeFiles

func (vexctl *VexCtl) MergeFiles(ctx context.Context, opts *MergeOptions, filePaths []string) (*vex.VEX, error)

MergeFiles is like Merge but takes filepaths instead of actual VEX documents

func (*VexCtl) VexFromURI

func (vexctl *VexCtl) VexFromURI(ctx context.Context, uri string) (vexData *vex.VEX, err error)

VexFromURI return a vex doc from a path, image ref or URI