cyclonedx

Documentation

Index

• func NewBomDescriptor() *syftCDX.BomDescriptor
• type Advisories
• type Component
• type Document
  • func NewDocument() Document
  • func NewDocumentFromCatalog(catalog *pkg.Catalog, matches match.Matches, ...) (Document, error)
• type Presenter
  • func NewPresenter(results match.Matches, catalog *pkg.Catalog, theScope scope.Scope, ...) *Presenter
  • func (pres *Presenter) Present(output io.Writer) error
• type Rating
• type Score
• type Source
• type Vulnerability
  • func NewVulnerability(m match.Match, p vulnerability.MetadataProvider) (Vulnerability, error)

Functions

func NewBomDescriptor

func NewBomDescriptor() *syftCDX.BomDescriptor

NewBomDescriptor returns a new BomDescriptor tailored for the current time and "syft" tool details.

Types

type Advisories

type Advisories struct {
	Advisory []string `xml:"v:advisory"`
}

Advisories holds all the links for a vulnerability

type Component

type Component struct {
	syftCDX.Component
	Vulnerabilities *[]Vulnerability `xml:"v:vulnerabilities>v:vulnerability,omitempty"`
}

Component represents the a single software/package that has vulnerabilities.

type Document

type Document struct {
	XMLName       xml.Name               `xml:"bom"`
	XMLNs         string                 `xml:"xmlns,attr"`
	XMLNsBd       string                 `xml:"xmlns:bd,attr"`
	XMLNsV        string                 `xml:"xmlns:v,attr"`
	Version       int                    `xml:"version,attr"`
	SerialNumber  string                 `xml:"serialNumber,attr"`
	Components    []Component            `xml:"components>component"`
	BomDescriptor *syftCDX.BomDescriptor `xml:"bd:metadata"` // The BOM descriptor extension
}

Document represents a CycloneDX Vulnerability Document.

func NewDocument

func NewDocument() Document

NewDocument returns an empty CycloneDX Document object.

func NewDocumentFromCatalog

func NewDocumentFromCatalog(catalog *pkg.Catalog, matches match.Matches, provider vulnerability.MetadataProvider) (Document, error)

NewDocumentFromCatalog returns a CycloneDX Document object populated with the vulnerability contents.

type Presenter

type Presenter struct {
	// contains filtered or unexported fields
}

Presenter writes a CycloneDX report from the given Catalog and Scope contents

func NewPresenter

func NewPresenter(results match.Matches, catalog *pkg.Catalog, theScope scope.Scope, metadataProvider vulnerability.MetadataProvider) *Presenter

NewPresenter is a *Presenter constructor

func (*Presenter) Present

func (pres *Presenter) Present(output io.Writer) error

Present creates a CycloneDX-based reporting

type Rating

type Rating struct {
	Score    Score  `xml:"v:score"`
	Severity string `xml:"v:severity,omitempty"`
	Method   string `xml:"v:method,omitempty"`
	Vector   string `xml:"v:vector,omitempty"`
}

Rating has information about the intensity of a vulnerability

type Score

type Score struct {
	Base           float64 `xml:"v:base"`
	Impact         float64 `xml:"v:impact"`
	Exploitability float64 `xml:"v:exploitability"`
}

Score provides the different ways to measure how serious a vulnerability is

type Source

type Source struct {
	Name string `xml:"name,attr"`
	URL  string `xml:"v:url"`
}

Source is the origin of the vulnerability, like Github Advisories or NVD, along with a URL constructed with the vulnerability ID

type Vulnerability

type Vulnerability struct {
	Ref     string   `xml:"ref,attr"`
	ID      string   `xml:"v:id"`
	Source  Source   `xml:"v:source"`
	Ratings []Rating `xml:"v:ratings>v:rating"`
	// We do not capture Common Weakness Enumeration
	//Cwes            Cwes             `xml:"v:cwes"`
	Description string `xml:"v:description,omitempty"`
	// We don't have recommendations (e.g. "upgrade")
	//Recommendations *Recommendations `xml:"v:recommendations"`
	Advisories *Advisories `xml:"v:advisories,omitempty"`
}

Vulnerability is the actual description of a vulnerable artifact

func NewVulnerability

func NewVulnerability(m match.Match, p vulnerability.MetadataProvider) (Vulnerability, error)

NewVulnerability creates a Vulnerability document from a match and the metadata provider