msi

Documentation

Overview

Package msi parses a Windows Installer (.msi) file — a pure-Go, dependency-free reader for the OLE2 Compound File Binary Format (MS-CFB) container plus the MSI table layout on top of it — to recover the installed product's identity (name, version, manufacturer, product code) for cataloging. It resolves no external resources and never executes the installer; it only reads bytes, with hard bounds throughout so a crafted/corrupt file degrades to an error rather than exhausting memory or looping.

Index

• type Cataloger
  • func New() *Cataloger
  • func (c *Cataloger) CatalogArtifacts(ctx context.Context, dir string) ([]sbom.Component, error)
• type Info
  • func Parse(data []byte) (Info, error)

Types

type Cataloger

type Cataloger struct{}

Cataloger discovers Windows Installer (.msi) artifacts under a workspace directory and recovers each installer's product identity from its Property table, emitting one SBOM component per .msi. It never executes an installer — it only reads compound-file bytes. Best-effort: an unreadable/corrupt .msi is skipped, never fatal to the scan.

func New

func New() *Cataloger

New returns a Cataloger.

func (*Cataloger) CatalogArtifacts

func (c *Cataloger) CatalogArtifacts(ctx context.Context, dir string) ([]sbom.Component, error)

CatalogArtifacts walks dir for *.msi files and returns a component for each one whose Property table yields a product name. Directory-walk and per-file errors are swallowed (best-effort inventory); a canceled context stops the walk.

type Info

type Info struct {
	ProductName    string
	ProductVersion string
	Manufacturer   string
	ProductCode    string // {GUID}
	UpgradeCode    string // {GUID}
}

Info is the identity recovered from an MSI's Property table (the authoritative source). Fields are empty when the installer does not set the corresponding property.

func Parse

func Parse(data []byte) (Info, error)

Parse reads an MSI (.msi) file and returns the product Info from its Property table. It never resolves or executes anything — it only decodes the compound-file bytes. A non-MSI / corrupt input returns an error.