sbom

Documentation

Overview

Package sbom produces deterministic, typed CycloneDX inventories for service-agent Builder.SBOM implementations.

Index

• Constants
• Variables
• func MarshalCycloneDXJSON(bom *agentv0.Bom) ([]byte, error)
• type Artifact
• type GolangOptions
• type Result
  • func AttachArtifact(base *Result, artifact Artifact) (*Result, error)
  • func Container(ctx context.Context, image string) (*Result, error)
  • func Golang(ctx context.Context, dir string) (*Result, error)
  • func GolangWithOptions(ctx context.Context, dir string, options GolangOptions) (*Result, error)
  • func Node(_ context.Context, dir string, includeDev bool) (*Result, error)
  • func Python(ctx context.Context, dir string, includeDev bool) (*Result, error)
  • func Rust(ctx context.Context, dir string, includeDev bool) (*Result, error)
  • func Swift(ctx context.Context, dir string) (*Result, error)

Constants

const (
	// SyftVersion and SyftImage pin the managed container generator used when
	// an operator-managed syft binary is not available.
	SyftVersion = "v1.48.0"
	SyftImage   = "anchore/syft@sha256:b4f1df79f97b817682d8b5ff941eb6bfe74f6172553a5e312c75bbc2eabc405c"
	// SyftScratchSize bounds temporary layer extraction. 64 MiB is too small
	// for normal service images such as Redis once their layers are expanded.
	SyftScratchSize = "512m"
)

Variables

var ErrUnsupported = errors.New("authoritative SBOM generation is unsupported")

ErrUnsupported means the ecosystem has no authoritative lockfile or resolver available. Callers must surface this as UNSUPPORTED, never CLEAN.

Functions

func MarshalCycloneDXJSON

func MarshalCycloneDXJSON(bom *agentv0.Bom) ([]byte, error)

MarshalCycloneDXJSON emits standards-shaped CycloneDX 1.5 JSON. It uses structs rather than maps so the byte stream and digest remain deterministic.

Types

type Artifact

type Artifact struct {
	Publisher string
	Name      string
	Version   string
	Target    string
	SHA256    string
}

Artifact identifies one compiled agent binary to wrap around a source-module inventory. SHA256 is the digest of the exact installed bytes.

type GolangOptions

type GolangOptions struct {
	// UseWorkspace keeps the active go.work graph. It must be true when the
	// package/build operation also used that Codefly-managed workspace.
	UseWorkspace bool
}

GolangOptions selects the same dependency context used by the owning plugin.

type Result

type Result struct {
	Bom      *agentv0.Bom
	Tool     string
	Language string
	SHA256   string
}

Result is the common output returned by ecosystem-specific generators.

func AttachArtifact

func AttachArtifact(base *Result, artifact Artifact) (*Result, error)

AttachArtifact makes the compiled binary the SBOM subject while retaining the source module and its dependency graph beneath it.

func Container

func Container(ctx context.Context, image string) (*Result, error)

Container generates a package-level inventory for a registry image. The managed fallback is digest pinned, runs read-only, and does not mount the Docker socket or workspace into the scanner container.

func Golang

func Golang(ctx context.Context, dir string) (*Result, error)

Golang inventories the exact isolated module graph selected by go.mod/go.sum without mutating either file. Ambient go.work files are disabled by default.

func GolangWithOptions

func GolangWithOptions(ctx context.Context, dir string, options GolangOptions) (*Result, error)

GolangWithOptions inventories the module graph in the dependency context explicitly selected by the language plugin.

func Node

func Node(_ context.Context, dir string, includeDev bool) (*Result, error)

Node inventories package-lock.json without executing lifecycle scripts or consulting the network. Lockfile v2+ is required because older files do not carry an authoritative physical package graph.

func Python

func Python(ctx context.Context, dir string, includeDev bool) (*Result, error)

Python delegates lock interpretation to uv's pinned/frozen CycloneDX 1.5 exporter. The command is read-only and fails when no authoritative uv.lock exists instead of inventorying an unrelated ambient Python environment.

func Rust

func Rust(ctx context.Context, dir string, includeDev bool) (*Result, error)

Rust inventories Cargo's locked, fully resolved package graph. --locked prevents metadata collection from changing Cargo.lock. Dev-only edges and components are removed when includeDev is false.

func Swift

func Swift(ctx context.Context, dir string) (*Result, error)

Swift inventories the concrete SwiftPM graph while forcing versions from Package.resolved. SwiftPM may fetch missing checkouts, but it cannot relock or silently select newer versions.