bin

Documentation

Overview

Package bin provides the functionality to generate SBOMs for binaries.

Please refer to the CLI documentation for further details about this mode.

Index

• func NewGenerator(binaryPath string, opts ...Option) (generate.Generator, error)
• type Option
  • func WithIncludeStdlib(enable bool) Option
  • func WithLicenseDetector(detector licensedetect.Detector) Option
  • func WithLogger(logger zerolog.Logger) Option
  • func WithVersionOverride(version string) Option

Functions

func NewGenerator

func NewGenerator(binaryPath string, opts ...Option) (generate.Generator, error)

NewGenerator returns a generator that is capable of generating BOMs from Go module binaries.

Types

type Option

type Option func(g *generator) error

Option allows for customization of the generator using the functional options pattern.

func WithIncludeStdlib

func WithIncludeStdlib(enable bool) Option

WithIncludeStdlib toggles the inclusion of a std component representing the Go standard library in the generated BOM.

When enabled, the std component will be represented as a direct dependency of the main module.

func WithLicenseDetector

func WithLicenseDetector(detector licensedetect.Detector) Option

WithLicenseDetector sets the license detector.

Because Go does not embed license information in binaries, performing license detection requires downloading of source code. This is done by `go mod download`ing all modules (including main) to the module cache.

When nil, no license detection will be performed. Default is nil.

func WithLogger

func WithLogger(logger zerolog.Logger) Option

WithLogger overrides the default logger of the generator.

func WithVersionOverride

func WithVersionOverride(version string) Option

WithVersionOverride overrides the version of the main component.

This is useful in cases where a BOM is generated from development- or snapshot-builds, in which case Go will set the version of the main module to "(devel)". Because "(devel)" is very generic and not a valid semver, overriding it may be useful.

For analyzing release builds, this option should be avoided.