pkg/

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Path	Synopsis
assembler
graphdb
certifier
attestation
certify
components/root_package
osv
osv/internal/osv_query
collectsub
client
collectsub/input input defines collectsub structs that can be used for human/application inputs that do not necessarily find it convenient to use protobuf (e.g.	input defines collectsub structs that can be used for human/application inputs that do not necessarily find it convenient to use protobuf (e.g.
server
server/db
server/db/simpledb
server/db/types
emitter
handler
collector
collector/file
collector/gcs
collector/git
collector/oci
processor
processor/cyclonedx
processor/dsse
processor/guesser
processor/ite6
processor/jsonlines
processor/process
processor/scorecard
processor/spdx
ingestor
key
key/inmemory
parser
parser/common
parser/cyclonedx
parser/dsse
parser/scorecard
parser/slsa
parser/spdx
parser/vuln The Vulnerability attestation parser parses the attestation defined by by the certifier using the predicate type"https://in-toto.io/attestation/vuln/v0.1" Based on the information contained, a package node is generated with just purl and digest (if found).	The Vulnerability attestation parser parses the attestation defined by by the certifier using the predicate type"https://in-toto.io/attestation/vuln/v0.1" Based on the information contained, a package node is generated with just purl and digest (if found).
verifier
verifier/sigstore_verifier
logging