model

Documentation

Index

• func PackageEqual(p1, p2 *Package) bool
• type Artifact
• type Build
• type ChecksumAlgorithm
• type CreationInfo
• type Creator
• type File
• type FileChecksum
• type FileFingerprint
• type FileType
• type Fingerprint
• type FingerprintValue
• type FingerprintVendor
• type Language
• type Metadata
• type Package
  • func (p *Package) MarshalLogObject(enc zapcore.ObjectEncoder) error
• type PkgType
• type RelationType
• type Relationship
  • func (r *Relationship) MarshalLogObject(enc zapcore.ObjectEncoder) error
• type SBOM
• type SnippetFingerprint
• type Source

Functions

func PackageEqual

func PackageEqual(p1, p2 *Package) bool

PackageEqual returns true if p1 and p2 are equal

Types

type Artifact

type Artifact struct {
	ID string `json:"id"`
	Package
	Build Build  `json:"build"`
	Files []File `json:"files"`
}

Artifact represents the distribution artifact of the sbom

type Build

type Build struct {
	OS       string `json:"os"`
	Arch     string `json:"arch"`
	Kernel   string `json:"kernel"`
	Builder  string `json:"builder"`
	Compiler string `json:"compiler"`
}

Build represents the build information of the artifact

type ChecksumAlgorithm

type ChecksumAlgorithm string

const (
	ChecksumMD5    ChecksumAlgorithm = "MD5"
	ChecksumSHA1   ChecksumAlgorithm = "SHA1"
	ChecksumSHA256 ChecksumAlgorithm = "SHA256"
)

type CreationInfo

type CreationInfo struct {
	Creators       []Creator `json:"creators"`
	Created        string    `json:"created"`
	CreatorComment string    `json:"creatorComment"`
}

CreationInfo represents the creation info of the SBOM

type Creator

type Creator struct {
	Creator     string `json:"creator"`     // name, email, domain
	CreatorType string `json:"creatorType"` // Person, Organization, Tool
}

Creator represents the creator of the SBOM

type File

type File struct {
	Name      string         `json:"name"`
	Type      FileType       `json:"type"`
	Checksums []FileChecksum `json:"checksums"`
}

File represents the file in the artifact

type FileChecksum

type FileChecksum struct {
	Algorithm ChecksumAlgorithm `json:"algorithm"`
	Value     string            `json:"value"`
}

FileChecksum represents the checksum of the file

type FileFingerprint

type FileFingerprint struct {
	File        string           `json:"file,omitempty"`
	Size        int64            `json:"size,omitempty"`
	Lines       int64            `json:"lines,omitempty"`
	Count       int64            `json:"count,omitempty"`
	License     string           `json:"license,omitempty"`
	Copyright   []string         `json:"copyright,omitempty"`
	Language    string           `json:"language,omitempty"`
	Checksums   []FileChecksum   `json:"checksums,omitempty"`
	Fingerprint FingerprintValue `json:"fingerprint,omitempty"`
}

type FileType

type FileType string

FileType is the type of the file

const (
	FileTypeSource        FileType = "SOURCE"        // if the file is human-readable source code (.c, .html, etc.);
	FileTypeBinary        FileType = "BINARY"        //  if the file is a compiled object, target image or binary executable (.o, .a, etc.);
	FileTypeArchive       FileType = "ARCHIVE"       //  if the file represents an archive (.tar, .jar, etc.);
	FileTypeApplication   FileType = "APPLICATION"   //  if the file is associated with a specific application type (MIME type of application/*);
	FileTypeAudio         FileType = "AUDIO"         //  if the file is associated with an audio file (MIME type of audio/* , e.g. .mp3);
	FileTypeImage         FileType = "IMAGE"         //  if the file is associated with a picture image file (MIME type of image/*, e.g., .jpg, .gif);
	FileTypeText          FileType = "TEXT"          //  if the file is human-readable text file (MIME type of text/*);
	FileTypeVideo         FileType = "VIDEO"         //  if the file is associated with a video file type (MIME type of video/*);
	FileTypeDocumentation FileType = "DOCUMENTATION" //  if the file serves as documentation;
	FileTypeSPDX          FileType = "SPDX"          //  if the file is an SPDX document;
	FileTypeOther         FileType = "OTHER"         //  if the file doesn't fit into the above categories (generated artifacts, data files, etc.)
)

type Fingerprint

type Fingerprint struct {
	TotalCount  int64             `json:"totalCount,omitempty"`
	Created     string            `json:"created,omitempty"`
	Checksum    string            `json:"checksum,omitempty"`
	OutputMode  string            `json:"outputMode,omitempty"`
	ExternalRef string            `json:"externalRef,omitempty"`
	Vendor      FingerprintVendor `json:"vendor,omitempty"`
	Files       []FileFingerprint `json:"files,omitempty"`
}

type FingerprintValue

type FingerprintValue struct {
	File    string               `json:"file,omitempty"`
	Snippet []SnippetFingerprint `json:"snippet,omitempty"`
}

type FingerprintVendor

type FingerprintVendor struct {
	Name      string `json:"name,omitempty"`
	Tool      string `json:"tool,omitempty"`
	Algorithm string `json:"algorithm,omitempty"`
}

type Language

type Language string

Language is the language of source code

const (
	LanguageUnknown    Language = ""
	LanguageCPP        Language = "c++"
	LanguageDart       Language = "dart"
	LanguageDotnet     Language = "dotnet"
	LanguageElixir     Language = "elixir"
	LanguageErlang     Language = "erlang"
	LanguageGo         Language = "go"
	LanguageHaskell    Language = "haskell"
	LanguageJava       Language = "maven"
	LanguageJavaScript Language = "javascript"
	LanguagePHP        Language = "php"
	LanguagePython     Language = "python"
	LanguageRuby       Language = "ruby"
	LanguageRust       Language = "rust"
	LanguageSwift      Language = "swift"
)

type Metadata

type Metadata map[string]string

type Package

type Package struct {
	Name             string   `json:"name"` // required
	Version          string   `json:"version"`
	Type             PkgType  `json:"type"` // required
	PURL             string   `json:"purl"` // required, the Package URL (see https://github.com/package-url/purl-spec)
	Supplier         string   `json:"supplier"`
	FilesAnalyzed    bool     `json:"filesAnalyzed"`
	VerificationCode string   `json:"verificationCode"`
	LicenseConcluded []string `json:"licenseConcluded"`
	LicenseDeclared  []string `json:"licenseDeclared"`
	Dependencies     []string `json:"dependencies"` // purl of dependencies
	SourceLocation   string   `json:"sourceLocation"`
}

Package is the info of a package

func (*Package) MarshalLogObject

func (p *Package) MarshalLogObject(enc zapcore.ObjectEncoder) error

type PkgType

type PkgType = string

PkgType is the type of package

var (
	PkgTypeGeneric   PkgType = packageurl.TypeGeneric
	PkgTypeCargo     PkgType = packageurl.TypeCargo
	PkgTypeCocoapods PkgType = packageurl.TypeCocoapods
	PkgTypeComposer  PkgType = packageurl.TypeComposer
	PkgTypeConan     PkgType = packageurl.TypeConan
	PkgTypeConda     PkgType = packageurl.TypeConda
	PkgTypeGem       PkgType = packageurl.TypeGem
	PkgTypeGolang    PkgType = packageurl.TypeGolang
	PkgTypeMaven     PkgType = packageurl.TypeMaven
	PkgTypeNPM       PkgType = packageurl.TypeNPM
	PkgTypeNuget     PkgType = packageurl.TypeNuget
	PkgTypePub       PkgType = packageurl.TypePub
	PkgTypePyPi      PkgType = packageurl.TypePyPi
	PkgTypeRPM       PkgType = packageurl.TypeRPM
	PkgTypeDEB       PkgType = packageurl.TypeDebian
	PkgTypeSwift     PkgType = packageurl.TypeSwift
	PkgTypeDylib     PkgType = "dylib"
	PkgTypeCarthage  PkgType = "carthage"
	PkgTypeBower     PkgType = "bower"
	PkgTypeLua       PkgType = "lua"
)

type RelationType

type RelationType string

RelationType is the type of relation

const (
	DependencyOf RelationType = "DependencyOf" // Is to be used when SPDXRef-A is dependency of SPDXRef-B.	A is explicitly stated as a dependency of B in a machine-readable file. Use when a package manager does not define scopes.
)

type Relationship

type Relationship struct {
	Type    RelationType `json:"type"` // see sbom.RelationType
	FromID  string       `json:"from"`
	ToID    string       `json:"to"`
	Comment string       `json:"comment,omitempty"`
}

A Relationship is a relationship between two elements of sbom.

func (*Relationship) MarshalLogObject

func (r *Relationship) MarshalLogObject(enc zapcore.ObjectEncoder) error

type SBOM

type SBOM struct {
	NamespaceURI  string
	Source        Source         `json:"source"`
	Artifact      Artifact       `json:"artifact"`
	Packages      []Package      `json:"packages"`
	Relationships []Relationship `json:"relationships"`
	CreationInfo  CreationInfo   `json:"creationInfo"`
}

SBOM represents the software bill of materials

type SnippetFingerprint

type SnippetFingerprint struct {
	Range string `json:"range,omitempty"`
	Value string `json:"value,omitempty"`
}

type Source

type Source struct {
	Repository  string      `json:"repository,omitempty"`
	Branch      string      `json:"branch,omitempty"`
	Revision    string      `json:"revision,omitempty"`
	TotalSize   int64       `json:"totalSize,omitempty"`
	TotalFile   int64       `json:"totalFile,omitempty"`
	TotalLine   int64       `json:"totalLine,omitempty"`
	Language    []string    `json:"language,omitempty"`
	Fingerprint Fingerprint `json:"fingerprint,omitempty"`
}