Documentation ¶
Index ¶
- Constants
- Variables
- type Application
- type ArtifactDetail
- type ArtifactInfo
- type ArtifactReference
- type ArtifactType
- type BlobInfo
- type BuildInfo
- type CauseMetadata
- type Code
- type Component
- type ComponentType
- type CustomResource
- type CycloneDX
- type DockerOption
- type File
- type HandlerType
- type Image
- type ImageExtension
- type ImageMetadata
- type Layer
- type LicenseCategory
- type LicenseFile
- type LicenseFinding
- type LicenseFindings
- type LicenseType
- type Line
- type Location
- type Metadata
- type MisconfResult
- type MisconfResults
- type Misconfiguration
- type OS
- type Package
- type PackageInfo
- type Packages
- type PolicyInputOption
- type PolicyInputSelector
- type PolicyMetadata
- type Repository
- type Secret
- type SecretFinding
- type SecretRuleCategory
- type SrcPackage
Constants ¶
const ( ArtifactJSONSchemaVersion = 1 BlobJSONSchemaVersion = 2 )
const ( // Programming language dependencies Bundler = "bundler" GemSpec = "gemspec" Cargo = "cargo" Composer = "composer" Npm = "npm" NuGet = "nuget" DotNetCore = "dotnet-core" Pip = "pip" Pipenv = "pipenv" Poetry = "poetry" PythonPkg = "python-pkg" NodePkg = "node-pkg" Yarn = "yarn" Pnpm = "pnpm" Jar = "jar" Pom = "pom" Gradle = "gradle" GoBinary = "gobinary" GoModule = "gomod" JavaScript = "javascript" RustBinary = "rustbinary" Conan = "conan" Cocoapods = "cocoapods" Hex = "hex" // Config files YAML = "yaml" JSON = "json" Dockerfile = "dockerfile" Terraform = "terraform" CloudFormation = "cloudformation" Kubernetes = "kubernetes" Ansible = "ansible" Helm = "helm" Rbac = "rbac" Cloud = "cloud" AzureARM = "azure-arm" // Licensing License = "license" // Language-specific file names NuGetPkgsLock = "packages.lock.json" NuGetPkgsConfig = "packages.config" GoMod = "go.mod" GoSum = "go.sum" MavenPom = "pom.xml" NpmPkgLock = "package-lock.json" YarnLock = "yarn.lock" PnpmLock = "pnpm-lock.yaml" ComposerLock = "composer.lock" PipRequirements = "requirements.txt" PipfileLock = "Pipfile.lock" PoetryLock = "poetry.lock" GemfileLock = "Gemfile.lock" CargoLock = "Cargo.lock" ConanLock = "conan.lock" CocoaPodsLock = "Podfile.lock" MixLock = "mix.lock" )
const ( SystemFileFilteringPostHandler HandlerType = "system-file-filter" GoModMergePostHandler HandlerType = "go-mod-merge" MisconfPostHandler HandlerType = "misconf" UnpackagedPostHandler HandlerType = "unpackaged" // SystemFileFilteringPostHandlerPriority should be higher than other handlers. // Otherwise, other handlers need to process unnecessary files. SystemFileFilteringPostHandlerPriority = 100 GoModMergePostHandlerPriority = 50 MisconfPostHandlerPriority = 50 UnpackagedPostHandlerPriority = 50 )
Variables ¶
var ( InvalidURLPattern = xerrors.New("invalid url pattern") ErrNoRpmCmd = xerrors.New("no rpm command") )
Functions ¶
This section is empty.
Types ¶
type Application ¶
type ArtifactDetail ¶
type ArtifactDetail struct { OS OS `json:",omitempty"` Repository *Repository `json:",omitempty"` Packages Packages `json:",omitempty"` Applications []Application `json:",omitempty"` Misconfigurations []Misconfiguration `json:",omitempty"` Secrets []Secret `json:",omitempty"` Licenses []LicenseFile `json:",omitempty"` // HistoryPackages are packages extracted from RUN instructions HistoryPackages []Package `json:",omitempty"` // CustomResources hold analysis results from custom analyzers. // It is for extensibility and not used in OSS. CustomResources []CustomResource `json:",omitempty"` }
ArtifactDetail is generated by applying blobs
func (*ArtifactDetail) ToBlobInfo ¶ added in v0.32.0
func (a *ArtifactDetail) ToBlobInfo() BlobInfo
ToBlobInfo is used to store a merged layer in cache.
type ArtifactInfo ¶
type ArtifactInfo struct { SchemaVersion int Architecture string Created time.Time DockerVersion string OS string // HistoryPackages are packages extracted from RUN instructions HistoryPackages []Package `json:",omitempty"` }
ArtifactInfo is stored in cache
type ArtifactReference ¶
type ArtifactReference struct { Name string // image name, tar file name, directory or repository name Type ArtifactType ID string BlobIDs []string ImageMetadata ImageMetadata // SBOM CycloneDX *CycloneDX }
ArtifactReference represents a reference of container image, local filesystem and repository
type ArtifactType ¶
type ArtifactType string
ArtifactType represents a type of artifact
const ( ArtifactContainerImage ArtifactType = "container_image" ArtifactFilesystem ArtifactType = "filesystem" ArtifactRemoteRepository ArtifactType = "repository" ArtifactCycloneDX ArtifactType = "cyclonedx" ArtifactSPDX ArtifactType = "spdx" ArtifactAWSAccount ArtifactType = "aws_account" ArtifactVM ArtifactType = "vm" )
type BlobInfo ¶
type BlobInfo struct { SchemaVersion int // Layer information Digest string `json:",omitempty"` DiffID string `json:",omitempty"` CreatedBy string `json:",omitempty"` OpaqueDirs []string `json:",omitempty"` WhiteoutFiles []string `json:",omitempty"` // Analysis result OS OS `json:",omitempty"` Repository *Repository `json:",omitempty"` PackageInfos []PackageInfo `json:",omitempty"` Applications []Application `json:",omitempty"` Misconfigurations []Misconfiguration `json:",omitempty"` Secrets []Secret `json:",omitempty"` Licenses []LicenseFile `json:",omitempty"` // Red Hat distributions have build info per layer. // This information will be embedded into packages when applying layers. // ref. https://redhat-connect.gitbook.io/partner-guide-for-adopting-red-hat-oval-v2/determining-common-platform-enumeration-cpe BuildInfo *BuildInfo `json:",omitempty"` // CustomResources hold analysis results from custom analyzers. // It is for extensibility and not used in OSS. CustomResources []CustomResource `json:",omitempty"` }
BlobInfo is stored in cache
type BuildInfo ¶
type BuildInfo struct { ContentSets []string `json:",omitempty"` Nvr string `json:",omitempty"` Arch string `json:",omitempty"` }
BuildInfo represents information under /root/buildinfo in RHEL
type CauseMetadata ¶
type Component ¶ added in v0.30.0
type Component struct { BOMRef string `json:"bom-ref,omitempty" xml:"bom-ref,attr,omitempty"` MIMEType string `json:"mime-type,omitempty" xml:"mime-type,attr,omitempty"` Type ComponentType `json:"type" xml:"type,attr"` Name string `json:"name" xml:"name"` Version string `json:"version,omitempty" xml:"version,omitempty"` PackageURL string `json:"purl,omitempty" xml:"purl,omitempty"` }
type ComponentType ¶ added in v0.30.0
type ComponentType string
type CustomResource ¶
CustomResource holds the analysis result from a custom analyzer. It is for extensibility and not used in OSS.
type CycloneDX ¶ added in v0.30.0
type CycloneDX struct { // JSON specific fields BOMFormat string `json:"bomFormat" xml:"-"` SpecVersion string `json:"specVersion" xml:"-"` SerialNumber string `json:"serialNumber,omitempty" xml:"serialNumber,attr,omitempty"` Version int `json:"version" xml:"version,attr"` Metadata Metadata `json:"metadata,omitempty" xml:"metadata,omitempty"` Components []Component `json:"components,omitempty" xml:"components>component,omitempty"` }
CycloneDX re-defines only necessary fields from cyclondx/cyclonedx-go cf. https://github.com/CycloneDX/cyclonedx-go/blob/de6bc07025d148badc8f6699ccb556744a5f4070/cyclonedx.go#L58-L77
The encoding/xml package that cyclondx-go depends on cannot be imported due to some limitations in TinyGo. cf. https://tinygo.org/docs/reference/lang-support/stdlib/
type DockerOption ¶
type DockerOption struct { // Auth UserName string Password string // RegistryToken is a bearer token to be sent to a registry RegistryToken string // ECR AwsAccessKey string AwsSecretKey string AwsSessionToken string AwsRegion string // GCP GcpCredPath string // SSL/TLS InsecureSkipTLSVerify bool NonSSL bool // Architecture Platform string }
type HandlerType ¶
type HandlerType string
type Image ¶
type Image interface { v1.Image ImageExtension }
type ImageExtension ¶
type ImageMetadata ¶
type LicenseCategory ¶ added in v0.30.0
type LicenseCategory string
const ( CategoryForbidden LicenseCategory = "forbidden" CategoryRestricted LicenseCategory = "restricted" CategoryReciprocal LicenseCategory = "reciprocal" CategoryNotice LicenseCategory = "notice" CategoryPermissive LicenseCategory = "permissive" CategoryUnencumbered LicenseCategory = "unencumbered" CategoryUnknown LicenseCategory = "unknown" )
type LicenseFile ¶ added in v0.30.0
type LicenseFile struct { Type LicenseType FilePath string PkgName string Findings LicenseFindings Layer Layer `json:",omitempty"` }
type LicenseFinding ¶ added in v0.30.0
type LicenseFinding struct { Category LicenseCategory // such as "forbidden" Name string Confidence float64 Link string }
type LicenseFindings ¶ added in v0.36.0
type LicenseFindings []LicenseFinding
func (LicenseFindings) Len ¶ added in v0.36.0
func (findings LicenseFindings) Len() int
func (LicenseFindings) Less ¶ added in v0.36.0
func (findings LicenseFindings) Less(i, j int) bool
func (LicenseFindings) Swap ¶ added in v0.36.0
func (findings LicenseFindings) Swap(i, j int)
type LicenseType ¶ added in v0.30.0
type LicenseType string
const ( LicenseTypeDpkg LicenseType = "dpkg" // From /usr/share/doc/*/copyright LicenseTypeHeader LicenseType = "header" // From file headers LicenseTypeFile LicenseType = "license-file" // From LICENSE, COPYRIGHT, etc. )
type Line ¶
type Line struct { Number int `json:"Number"` Content string `json:"Content"` IsCause bool `json:"IsCause"` Annotation string `json:"Annotation"` Truncated bool `json:"Truncated"` Highlighted string `json:"Highlighted,omitempty"` FirstCause bool `json:"FirstCause"` LastCause bool `json:"LastCause"` }
type MisconfResult ¶
type MisconfResult struct { Namespace string `json:",omitempty"` Query string `json:",omitempty"` Message string `json:",omitempty"` PolicyMetadata `json:",omitempty"` CauseMetadata `json:",omitempty"` // For debugging Traces []string `json:",omitempty"` }
type MisconfResults ¶
type MisconfResults []MisconfResult
func (MisconfResults) Len ¶
func (r MisconfResults) Len() int
func (MisconfResults) Less ¶
func (r MisconfResults) Less(i, j int) bool
func (MisconfResults) Swap ¶
func (r MisconfResults) Swap(i, j int)
type Misconfiguration ¶
type Misconfiguration struct { FileType string `json:",omitempty"` FilePath string `json:",omitempty"` Successes MisconfResults `json:",omitempty"` Warnings MisconfResults `json:",omitempty"` Failures MisconfResults `json:",omitempty"` Exceptions MisconfResults `json:",omitempty"` Layer Layer `json:",omitempty"` }
func ToMisconfigurations ¶
func ToMisconfigurations(misconfs map[string]Misconfiguration) []Misconfiguration
type OS ¶
type Package ¶
type Package struct { ID string `json:",omitempty"` Name string `json:",omitempty"` Version string `json:",omitempty"` Release string `json:",omitempty"` Epoch int `json:",omitempty"` Arch string `json:",omitempty"` SrcName string `json:",omitempty"` SrcVersion string `json:",omitempty"` SrcRelease string `json:",omitempty"` SrcEpoch int `json:",omitempty"` Licenses []string `json:",omitempty"` Maintainer string `json:",omitempty"` Modularitylabel string `json:",omitempty"` // only for Red Hat based distributions BuildInfo *BuildInfo `json:",omitempty"` // only for Red Hat Ref string `json:",omitempty"` // identifier which can be used to reference the component elsewhere Indirect bool `json:",omitempty"` // this package is direct dependency of the project or not // Dependencies of this package // Note: it may have interdependencies, which may lead to infinite loops. DependsOn []string `json:",omitempty"` Layer Layer `json:",omitempty"` // Each package metadata have the file path, while the package from lock files does not have. FilePath string `json:",omitempty"` // lines from the lock file where the dependency is written Locations []Location `json:",omitempty"` }
type PackageInfo ¶
type PolicyInputOption ¶
type PolicyInputOption struct { Combine bool `mapstructure:"combine"` Selectors []PolicyInputSelector `mapstructure:"selector"` }
type PolicyInputSelector ¶
type PolicyInputSelector struct {
Type string `mapstructure:"type"`
}
type PolicyMetadata ¶
type PolicyMetadata struct { ID string `json:",omitempty"` AVDID string `json:",omitempty"` Type string `json:",omitempty"` Title string `json:",omitempty"` Description string `json:",omitempty"` Severity string `json:",omitempty"` RecommendedActions string `json:",omitempty" mapstructure:"recommended_actions"` References []string `json:",omitempty"` }
type Repository ¶
type Secret ¶
type Secret struct { FilePath string Findings []SecretFinding }
type SecretFinding ¶
type SecretRuleCategory ¶
type SecretRuleCategory string