core

package
v1.0.36 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 18, 2026 License: MIT Imports: 12 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func FileContext added in v0.1.42 

func FileContext(path string, lineNum, radius int) string

FileContext returns up to radius lines on each side of lineNum, with line numbers.

func FileContextSafe added in v0.1.45 

func FileContextSafe(path string, startLine, endLine, radius int) string

FileContextSafe returns up to radius lines on each side of startLine, redacting all lines from startLine through endLine inclusive (covers multiline secrets like PEM blocks).

func PackageGroupBaselineMatchKey added in v1.0.30 

func PackageGroupBaselineMatchKey(f Finding) string

PackageGroupBaselineMatchKey is a RuleID-free baseline key for collapsed SCA/container package rows. Advisory churn (new worst CVE) must not break repo-local dismissals of the package group.

func Progressf added in v1.0.13 

func Progressf(quiet bool, format string, args ...any)

func Warnf added in v1.0.13 

func Warnf(format string, args ...any)

func WithSuppressedStdlog added in v1.0.13 

func WithSuppressedStdlog(fn func())

Types

type Config 

type Config struct {
	Targets        []string `yaml:"targets" json:"targets"`
	EnableSAST     bool     `yaml:"enable_sast" json:"enable_sast"`
	EnableSCA      bool     `yaml:"enable_sca" json:"enable_sca"`
	EnableSecrets  bool     `yaml:"enable_secrets" json:"enable_secrets"`
	EnableWorkflow bool     `yaml:"enable_workflow" json:"enable_workflow"`
	EnableIaC      bool     `yaml:"enable_iac" json:"enable_iac"`

	Workers     int   `yaml:"workers" json:"workers"`
	MaxFileSize int64 `yaml:"max_file_size" json:"max_file_size"`

	OutputFormat string `yaml:"output_format" json:"output_format"`
	OutputFile   string `yaml:"output_file" json:"output_file"`

	MinSeverity    Severity `yaml:"min_severity" json:"min_severity"`
	ExcludePaths   []string `yaml:"exclude_paths" json:"exclude_paths"`
	IncludeRuleIDs []string `yaml:"include_rule_ids" json:"include_rule_ids"`
	ExcludeRuleIDs []string `yaml:"exclude_rule_ids" json:"exclude_rule_ids"`

	SecretsRulesDir  string `yaml:"secrets_rules_dir" json:"secrets_rules_dir"`
	DisableRedaction bool   `yaml:"disable_redaction" json:"disable_redaction"`
	ValidateSecrets  bool   `yaml:"validate_secrets" json:"validate_secrets"`

	Offline                bool     `yaml:"offline" json:"offline"`
	Languages              []string `yaml:"languages" json:"languages"`
	AIModel                string   `yaml:"ai_model" json:"ai_model"`
	PackageIntelligence    bool     `yaml:"package_intelligence" json:"package_intelligence"`
	PackageRegistryMode    string   `yaml:"package_registry_mode" json:"package_registry_mode"`
	NPMRegistryURL         string   `yaml:"npm_registry_url" json:"npm_registry_url"`
	PyPIRegistryURL        string   `yaml:"pypi_registry_url" json:"pypi_registry_url"`
	CratesRegistryURL      string   `yaml:"crates_registry_url" json:"crates_registry_url"`
	AIFilterSecrets        bool     `yaml:"ai_filter_secrets" json:"ai_filter_secrets"`
	AISCAReachability      bool     `yaml:"ai_sca_reachability" json:"ai_sca_reachability"`
	AITriage               bool     `yaml:"ai_triage" json:"ai_triage"`
	Adversarial            bool     `yaml:"adversarial" json:"adversarial"`
	ExploitChains          bool     `yaml:"exploit_chains" json:"exploit_chains"`
	SupplyChain            bool     `yaml:"supply_chain" json:"supply_chain"`
	Explain                bool     `yaml:"explain" json:"explain"`
	BaselineFile           string   `yaml:"baseline_file" json:"baseline_file"`
	AdditionalSuppressions []string `yaml:"additional_suppressions" json:"additional_suppressions"`
	PathStripPrefix        string   `yaml:"path_strip_prefix" json:"path_strip_prefix"`
	Incremental            bool     `yaml:"incremental" json:"incremental"`
	CachePath              string   `yaml:"cache_path" json:"cache_path"`
	Quiet                  bool     `yaml:"quiet" json:"quiet"`
	ContainerImage         string   `yaml:"container_image" json:"container_image"`
	SASTSliceFiles         int      `yaml:"sast_slice_files" json:"sast_slice_files"`
	AllowedLicenses        []string `yaml:"allowed_licenses" json:"allowed_licenses"`
	DeniedLicenses         []string `yaml:"denied_licenses" json:"denied_licenses"`
}

type ExploitChain added in v1.0.24 

type ExploitChain struct {
	ID           string   `json:"id"`
	Title        string   `json:"title"`
	Fingerprints []string `json:"fingerprints"`
	Steps        []string `json:"steps"`
	Narrative    string   `json:"narrative"`
	Severity     Severity `json:"severity"`
	Derived      bool     `json:"derived_severity"`
}

type Finding 

type Finding struct {
	ID            string   `json:"id"`
	Type          ScanType `json:"type"`
	RuleID        string   `json:"rule_id"`
	RuleName      string   `json:"rule_name"`
	Severity      Severity `json:"severity"`
	PriorityScore int      `json:"priority_score,omitempty"`
	Confidence    string   `json:"confidence,omitempty"`
	Title         string   `json:"title"`
	Description   string   `json:"description"`

	FilePath     string `json:"file_path"`
	ArtifactPath string `json:"artifact_path,omitempty"`
	StartLine    int    `json:"start_line"`
	EndLine      int    `json:"end_line"`
	StartColumn  int    `json:"start_column,omitempty"`
	EndColumn    int    `json:"end_column,omitempty"`
	Snippet      string `json:"snippet,omitempty"`

	PackageName    string  `json:"package_name,omitempty"`
	PackageVersion string  `json:"package_version,omitempty"`
	Ecosystem      string  `json:"ecosystem,omitempty"`
	FixedVersion   string  `json:"fixed_version,omitempty"`
	CVE            string  `json:"cve,omitempty"`
	CVSSScore      float64 `json:"cvss_score,omitempty"`

	Redacted string  `json:"redacted,omitempty"`
	Entropy  float64 `json:"entropy,omitempty"`

	ImageDigest string `json:"image_digest,omitempty"`
	LayerDigest string `json:"layer_digest,omitempty"`
	LayerIndex  int    `json:"layer_index,omitempty"`
	BaseImage   string `json:"base_image,omitempty"`

	CWE              []string  `json:"cwe,omitempty"`
	References       []string  `json:"references,omitempty"`
	Tags             []string  `json:"tags,omitempty"`
	Fingerprint      string    `json:"fingerprint"`
	OrgMatchKey      string    `json:"org_match_key,omitempty"`
	BaselineMatchKey string    `json:"baseline_match_key,omitempty"`
	UsageDeltaKey    string    `json:"usage_delta_key,omitempty"`
	Timestamp        time.Time `json:"timestamp"`

	Verdict       string `json:"verdict,omitempty"`        // TRUE_POSITIVE, FALSE_POSITIVE, (empty = not triaged)
	VerdictReason string `json:"verdict_reason,omitempty"` // one-sentence explanation
	FixSuggestion string `json:"fix_suggestion,omitempty"` // minimal targeted remediation guidance
	FixCode       string `json:"fix_code,omitempty"`       // concrete code fix snippet from LLM
	Explanation   string `json:"explanation,omitempty"`

	AdversarialVerdict string `json:"adversarial_verdict,omitempty"` // CONFIRMED, DISPUTED, FALSIFIED
	AdversarialReason  string `json:"adversarial_reason,omitempty"`

	ChainID     string   `json:"chain_id,omitempty"`
	ChainedFrom []string `json:"chained_from,omitempty"`
}

func (Finding) BaselineSuppressible added in v1.0.30 

func (f Finding) BaselineSuppressible() bool

func (*Finding) ComputeBaselineMatchKey added in v1.0.16 

func (f *Finding) ComputeBaselineMatchKey()

ComputeBaselineMatchKey sets a scanner-specific key for repo posture reconciliation across scans. It is intentionally separate from Fingerprint, which remains repo-local and path/line sensitive for suppressions.

func (*Finding) ComputeFingerprint 

func (f *Finding) ComputeFingerprint()

ComputeFingerprint sets a deduplication hash. Changes when file path or line changes. For secrets findings, always uses the redacted value so fingerprints are stable regardless of whether --no-redact is set.

func (*Finding) ComputeIdentityKeys added in v1.0.16 

func (f *Finding) ComputeIdentityKeys()

ComputeIdentityKeys populates all currently supported finding identities.

func (*Finding) ComputeOrgMatchKey added in v1.0.16 

func (f *Finding) ComputeOrgMatchKey()

ComputeOrgMatchKey sets a path-independent hash for cross-repo policy decisions. Unsupported finding types keep an empty OrgMatchKey in v1.

func (*Finding) ComputePriorityScore added in v0.1.91 

func (f *Finding) ComputePriorityScore()

ComputePriorityScore sets a weighted priority score based on sec-context research. Formula: (Frequency × 2) + (Severity × 2) + Detectability Higher score = higher priority to fix.

func (*Finding) ComputeUsageDeltaKey added in v1.0.16 

func (f *Finding) ComputeUsageDeltaKey()

ComputeUsageDeltaKey sets a PR-time exposure key used to answer whether a PR made a baseline-known dependency risk more real. It is distinct from BaselineMatchKey so inventory and usage semantics can diverge.

func (Finding) IsMaliciousPackage added in v1.0.24 

func (f Finding) IsMaliciousPackage() bool

type SBOMArtifactRef added in v1.0.16 

type SBOMArtifactRef struct {
	ComponentCount int    `json:"component_count"`
	Format         string `json:"format"`
	CycloneDXKey   string `json:"cyclonedx_key,omitempty"`
}

type ScanMetrics 

type ScanMetrics struct {
	FindingsCount    int                      `json:"findings_count"`
	ScannerDurations map[string]time.Duration `json:"scanner_durations_ns,omitempty"`
}

type ScanResult 

type ScanResult struct {
	Findings        []Finding        `json:"findings"`
	ExploitChains   []ExploitChain   `json:"exploit_chains,omitempty"`
	Metrics         ScanMetrics      `json:"metrics"`
	Duration        time.Duration    `json:"duration_ns"`
	ScanTypes       []ScanType       `json:"scan_types"`
	SuppressedCount int              `json:"suppressed_count,omitempty"`
	MissingRequired []string         `json:"missing_required,omitempty"`
	SBOM            *SBOMArtifactRef `json:"sbom,omitempty"`
	SBOMCycloneDX   []byte           `json:"-"`
}

type ScanType 

type ScanType string
const (
	ScanTypeSAST       ScanType = "sast"
	ScanTypeSCA        ScanType = "sca"
	ScanTypeSecrets    ScanType = "secrets"
	ScanTypeDockerfile ScanType = "dockerfile"
	ScanTypeContainer  ScanType = "container"
	ScanTypeLicense    ScanType = "license"
	ScanTypeWorkflow   ScanType = "workflow"
	ScanTypeIaC        ScanType = "iac"
)

func (ScanType) Label added in v1.0.16 

func (t ScanType) Label() string

type Scanner 

type Scanner interface {
	Name() string
	Type() ScanType
	Init(cfg *Config) error
	Scan(ctx context.Context, paths []string, findings chan<- Finding) error
	Close() error
}

type Severity 

type Severity int
const (
	SeverityInfo Severity = iota
	SeverityLow
	SeverityMedium
	SeverityHigh
	SeverityCritical
)

func ParseSeverity 

func ParseSeverity(s string) Severity

func ParseSeverityStrict added in v0.1.60 

func ParseSeverityStrict(s string) (Severity, bool)

func SeverityFromCVSS 

func SeverityFromCVSS(score float64) Severity

func SeverityFromCVSSVector added in v0.1.73 

func SeverityFromCVSSVector(vector string) (Severity, float64, bool)

SeverityFromCVSSVector parses a CVSS v3 vector string and returns a severity + approximate score.

func (Severity) MarshalJSON added in v0.1.43 

func (s Severity) MarshalJSON() ([]byte, error)

func (Severity) String 

func (s Severity) String() string

func (*Severity) UnmarshalJSON added in v0.1.43 

func (s *Severity) UnmarshalJSON(data []byte) error

func (*Severity) UnmarshalYAML added in v0.1.45 

func (s *Severity) UnmarshalYAML(value *yaml.Node) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.