v1

Documentation

Index

• type Decomposer
• type DecomposerOptions
  • func (so *DecomposerOptions) GetDriverOptions(dec Decomposer) any
  • func (so *DecomposerOptions) SetDriverOptions(dec Decomposer, opts any)
• type NetworkLevel
• type Requirement
• type SourceDecomposer

Types

type Decomposer

type Decomposer interface {
	Extract(*DecomposerOptions) (*sbom.NodeList, error)
	Requirements(*DecomposerOptions) []Requirement
	DefaultOptions() any
}

Decomposer is an interface that abstracts the logic of dependency extraction from a codebase.

type DecomposerOptions

type DecomposerOptions struct {
	WorkDir string

	// Version is the version to use on the resulting root nodes after decomposing
	Version string

	// CommitHash captures the hash of the last commit when running in a repository
	CommitHash string

	// Networking controls how much network access decomposers are allowed.
	// Defaults to NetworkEssential.
	Networking NetworkLevel

	// IncludeDev includes development/test dependencies in the output.
	// Maps to: Maven test scope, npm devDependencies, Rust dev-dependencies.
	IncludeDev bool

	// IncludeBuild includes build tool dependencies in the output.
	// Maps to: Maven build plugins, Rust build-dependencies.
	IncludeBuild bool

	// IncludeOptional includes optional dependencies in the output.
	// Maps to: Maven optional deps, npm optionalDependencies.
	IncludeOptional bool
	// contains filtered or unexported fields
}

DecomposerOptions is the options set that goes into an Extract() run in a decomposer. They are meant to be ephimeral, for the invocation only, and derived from the Unpacker configuration whe invoked from there.

func (*DecomposerOptions) GetDriverOptions

func (so *DecomposerOptions) GetDriverOptions(dec Decomposer) any

func (*DecomposerOptions) SetDriverOptions

func (so *DecomposerOptions) SetDriverOptions(dec Decomposer, opts any)

type NetworkLevel

type NetworkLevel int

NetworkLevel controls how much network access the decomposers are allowed to use.

const (
	// NetworkEssential is the default (zero value). Enables network calls
	// that are essential for building the dependency tree plus lightweight
	// metadata requests (e.g., deps.dev, checksum files, crates.io API).
	NetworkEssential NetworkLevel = iota

	// NetworkFull enables all network calls including downloading full
	// artifacts for hash computation and zip archives for license
	// classification. Prioritizes data completeness over bandwidth.
	NetworkFull

	// NetworkDisabled disables all network calls. Only local data is used.
	// Some decomposers may produce incomplete results or fail entirely.
	NetworkDisabled NetworkLevel = -1
)

type Requirement

type Requirement interface {
	Description() string
	Check(context.Context) bool
}

Requirement

type SourceDecomposer

type SourceDecomposer interface {
	// FindCodeBases reads a path index and locates any directories that
	// contain a codebase that a decomposer understands. Typically this
	// will be the root directory, but there may be cases where a directory
	// contains many, for example in a monorepo structure.
	FindCodeBases(*code.PathIndex) ([]string, error)
}

SourceDecomposer is a decomposer that reads data from a codebase.