kanonarion

module
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 7, 2026 License: Apache-2.0

README

Kanonarion

Dependency assurance software for Go.

Kanonarion is a deterministic, local source of truth about your dependencies — what's in them, how they're licensed, how to call them, and which known vulnerabilities your code actually reaches. Developers query it from the CLI with human-readable output; AI coding agents get JSON. Both get the same answer, computed from your real dependency tree - not a model's best guess. The questions you would answer by hand, burn through tokens, or skip are answered quickly and correctly.

It surfaces evidence, not verdicts. Where the answer is uncertain, it says so, and in what way it is uncertain — never collapsing uncertainty into "safe."

A single binary. SQLite-backed local store. No SaaS, no account, no proprietary scanner deciding for you. The facts are public; the judgment is local and yours.

Why Kanonarion?

Modern AI coding agents (Claude, Copilot, Cursor, Junie) should be asking questions about dependencies constantly - what's the API, is this CVE reachable, can I use this licence commercially, how do I call this function. Without a local fact store, the agent usually doesn't ask at all - it guesses. That's what I found writing Kanonarion. When you force the agent to find the answers you pay in tokens and latency.

Kanonarion solves this by running a walk → extract → query pipeline once per dependency set, then serving all facts locally at query time. The agent asks Kanonarion instead of guessing. The answers are deterministic and reproducible.

How it works

walk  →  extract  →  query commands
  1. walk <module@version> - resolves the full transitive dependency graph and persists a WalkRecord to the local SQLite store.
  2. extract [walk-id] - runs all extraction stages (licence, interface, call graph, examples, vulnerabilities) for every module in the walk.
  3. Query commands - fast, offline reads from the local store. No network required.

The store lives at ~/.kanonarion by default. All metadata is in a single SQLite database; module ZIPs are content-addressed blobs. Every fetch is verified against the Go checksum database.

Uncertainty is a first-class state

Kanonarion never silently renders uncertainty as certainty.

Vulnerabilities are reachable, not reachable, or unknown - the last for advisories where symbol-level reachability data isn't available. Licences are Detected, Unclassified, or None - a resolved SPDX identity, licence text that could not be classified, or no licence evidence found - never silently rendered as "allowed". If kanonarion can't determine something, it says so. Policy can be configured to treat unknowns as hard failures so a CI gate fails loudly rather than passing on a blind spot.

Quick start

# Install (puts `kanonarion` on your PATH)
go install github.com/eitanity/kanonarion/cmd/kanonarion@latest

# Analyse a single module end to end (walk → extract → vuln-scan → context).
# One module = a result you can read and sanity-check on one screen.
kanonarion inspect github.com/spf13/cobra@v1.8.1

# --- Query the store (offline, no network) ---

# Show a module's public API
kanonarion interface-show github.com/spf13/cobra@v1.8.1

# Find usage examples for a symbol
kanonarion examples-find GenManTree

# List vulnerability scan runs
kanonarion vuln-scan-list

# Check licences
kanonarion license-list

Analyse your own project. Run kanonarion from your project root and it defaults to your go.mod's dependency set:

cd ~/my-project
kanonarion inspect          # same as --gomod ./go.mod (your code-scope deps)
kanonarion audit            # one-line-per-module fetch + licence + vuln report

This walks the full transitive closure, so it can take anywhere from seconds to tens of minutes depending on how many dependencies you have - the vulnerability scan dominates, as govulncheck analyses the project. Narrow or widen the set with --tool / --project; see the CLI reference.

audit, inspect (no argument), and vuln-scan --gomod are project-rooted: they derive each module's vulnerability verdict from a single scan of your project's real build, so an in-build dependency reads Clean/Affected, never un-analysable merely for a build your project never produces. A single-module inspect <module@version> or vuln-scan --module <module@version> is the coordinate-keyed view: it scans that module in isolation as its own main module, which is the intended "look at it on its own" analysis and is unchanged.

Drive the pipeline stage by stage. walk, extract, and vuln-scan all key off a walk id. walk prints it, and you can always resolve the most recent successful walk:

# Walk a module and its full transitive closure (prints a walk id)
kanonarion walk github.com/spf13/cobra@v1.8.1

# Resolve the latest successful walk id (needs jq)
WALK_ID=$(kanonarion walk-list --latest-success --json | jq -r '.id')

# Extract all facts for that walk (interfaces, licences, call graphs, examples)
kanonarion extract "$WALK_ID"

# Scan that walk for vulnerabilities (add --reachability to triage by reachability)
kanonarion vuln-scan "$WALK_ID"

Agentic coding workflow

Kanonarion is designed to be called directly from agent tool-use. The recommended pattern in agent guidelines:

Situation Command
User adds or upgrades a dependency walk <module@version> then extract
Onboard a new module end-to-end inspect <module@version> (walk + extract + vuln-scan + context)
Load everything known about a module into the agent's context context <module@version> --json
"What's the API for X?" interface-show <module@version> --json
Inspect a specific type or function interface-show <module@version> --symbol <Name>
Everything about a symbol (signature, docs, examples) symbol-context <Name> --json
"How do I use X?" examples-find <symbol> then examples-show
"Which library should I use for X?" symbol-find <Name>
"Is this library safe?" vuln-scan --module <module@version> --reachability
"Can I use this commercially?" license <module@version>
"Is my dependency closure licence-compatible?" license-compat <module@version>
Generate a third-party attribution / NOTICE file notice --package ./cmd/<binary>
"What does function F call?" callees '<fully.qualified.Symbol>'
"What calls function F?" / impact analysis callers '<fully.qualified.Symbol>'
Make callers/callees resolve my own project's symbols local <dir>
Dependency upgraded - what changed? walk-diff <old-id> <new-id>
"Is there a newer version of X?" latest <module>
Audit this project's supply-chain hygiene directives / godebug / vendor / fips

All query commands support --json for machine-readable output, making them easy to parse in agent tool implementations.

Key features

  • Offline-first. After the initial walk and extract, all queries are local SQLite reads. No network calls, no rate limits, no flaky CI.
  • Deterministic. Pinned versions, checksum-verified ZIPs, sorted JSON output. The same query returns the same result today and a year from now.
  • No SaaS, no phone home. A single binary that runs where you run it. No account, no telemetry, no vendor in the loop after install.
  • Reachability-aware vulnerability scanning. Integrates govulncheck with optional --reachability filtering. CVEs your code can't actually reach are triaged down, not paged on at 2am.
  • Licence compliance with provenance. Per-module SPDX licence detection with a full transitive summary, classified as Detected, Unclassified, or None.
  • Interface extraction. Full public API surface - types, functions, methods, constants - in structured JSON the agent can consume directly.
  • Call graph. Intra-module call graph for impact analysis and reachability queries.
  • Usage examples. Verified code snippets extracted from module test files, so the agent codes against patterns that actually work.
  • Policy gates. Walk-traversal rules in YAML - max depth, and whether replace directives and indirect requirements are followed - validated with policy validate.
  • SBOM generation. CycloneDX-compatible software bill of materials from any walk.
  • Auditable evidence chain. Every fetch, every verification, every policy decision is recorded in an append-only audit.jsonl. Reproducible, time-stamped evidence of what kanonarion did and when - useful for CI investigation, compliance reporting, or understanding why a build failed.

Store layout

~/.kanonarion/
  mirror.db          # SQLite - all metadata (walks, interfaces, vulns, licences, …)
  blobs/             # Content-addressed module ZIPs
  audit.jsonl        # Append-only fetch audit log

Policy files

Place a .kanonarion/policy.yaml in your project root (Kanonarion searches upward from cwd). Policies control walk traversal - the maximum depth, whether replace directives are followed, and whether indirect requirements are traversed.

# Validate a single policy file
kanonarion policy validate .kanonarion/policy.yaml

# Validate all policy files in a directory
kanonarion policy validate docs/examples/policies

Example policies are in docs/examples/policies/.

Observability

By default, kanonarion emits progress information at the INFO level. For large-scale module analysis (e.g., Envoy), high-frequency memory telemetry can be enabled for troubleshooting via --log-level debug.

Documentation

Requirements

Kanonarion is a single binary, but it shells out to a handful of external tools. Have these on PATH:

Tool When it's needed Install
Go 1.26+ Install and runtime - kanonarion drives the go toolchain (go list, go mod download, go test -c, go tool nm) to resolve build lists and analyse binaries. go.dev/dl
git Runtime - VCS cross-verification (the fetch stage compares the proxy zip against the upstream source repository). Optional: without git, fetches still verify against the Go checksum database but record an unverified VCS status; pass --skip-vcs-verify to skip explicitly. system package manager
govulncheck Runtime - required by vuln-scan / inspect. The scan fails fast with an actionable error if it's missing. go install golang.org/x/vuln/cmd/govulncheck@latest
jq Optional - only the shell snippets in this README use it to pull a walk id out of --json output. system package manager

Network access is needed for the first run of a given module set only (module downloads, checksum database, VCS cross-verification, vulnerability database snapshot). Every query afterwards is served from the local store at ~/.kanonarion.

Building from source

Contributors build from a checkout instead of go install:

make build     # compile binary to ./kanonarion
make test      # run all tests with race detector
make coverage  # generate coverage report
make lint      # run golangci-lint

Status

Kanonarion is open source under Apache-2.0 and is in active development. If your organisation is using AI coding tools against Go codebases under regulatory scrutiny - DORA, CRA, NIS2, EU AI Act, the Australian ISM - and you'd like to shape the roadmap, get in touch.

Directories

Path Synopsis
cmd
kanonarion command
internal
adapters/blobcodec
Package blobcodec provides transparent zstd compression for SQLite BLOB columns.
 Package blobcodec provides transparent zstd compression for SQLite BLOB columns.
adapters/blobstore/localfs
Package localfs implements ports.BlobStore using the local filesystem.
 Package localfs implements ports.BlobStore using the local filesystem.
adapters/clock
Package clock provides ports.Clock implementations for production and tests.
 Package clock provides ports.Clock implementations for production and tests.
adapters/factstore/sqlite
Package sqlite implements ports.FactStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
 Package sqlite implements ports.FactStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
adapters/modcache
adapters/proxy/direct
Package direct implements ports.ModuleProxy against a Go module proxy (default: proxy.golang.org).
 Package direct implements ports.ModuleProxy against a Go module proxy (default: proxy.golang.org).
adapters/signer/noop
Package noop provides the OSS default ports.Signer: an unconfigured signer that yields no attestation.
 Package noop provides the OSS default ports.Signer: an unconfigured signer that yields no attestation.
adapters/sumdb/gosum
Package gosum implements ports.SumDBClient using golang.org/x/mod/sumdb.
 Package gosum implements ports.SumDBClient using golang.org/x/mod/sumdb.
adapters/vcs/gitexec
Package gitexec implements ports.VCSClient by shelling out to the git binary.
 Package gitexec implements ports.VCSClient by shelling out to the git binary.
adapters/ziparchive
Package ziparchive is the shared-kernel adapter for reading ZIP archives.
 Package ziparchive is the shared-kernel adapter for reading ZIP archives.
audit
Package audit defines the context-neutral audit-event vocabulary.
 Package audit defines the context-neutral audit-event vocabulary.
callgraph/adapters/analyser/staticcha
Package staticcha implements ports.CallGraphAnalyser using Class Hierarchy Analysis (CHA) via golang.org/x/tools/go/callgraph/cha.
 Package staticcha implements ports.CallGraphAnalyser using Class Hierarchy Analysis (CHA) via golang.org/x/tools/go/callgraph/cha.
callgraph/adapters/store/sqlite
Package sqlite implements ports.CallGraphStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
 Package sqlite implements ports.CallGraphStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
callgraph/application
Package application contains the callgraph use cases.
 Package application contains the callgraph use cases.
callgraph/domain
Package domain defines the types and invariants for call graph extraction.
 Package domain defines the types and invariants for call graph extraction.
callgraph/ports
Package ports defines the interfaces the callgraph application layer requires from the outside world.
 Package ports defines the interfaces the callgraph application layer requires from the outside world.
cli
cli/testfakes
Package testfakes provides in-memory fakes for all CLI use-case interfaces.
 Package testfakes provides in-memory fakes for all CLI use-case interfaces.
composition
Package composition is the neutral composition root shared by the CLI and the public façade (pkg/kanonarion).
 Package composition is the neutral composition root shared by the CLI and the public façade (pkg/kanonarion).
config
Package config provides the ConfigSpec registration mechanism used by modules to declare their configuration schema and built-in defaults.
 Package config provides the ConfigSpec registration mechanism used by modules to declare their configuration schema and built-in defaults.
config/adapters/store/yaml
Package yaml implements ConfigStore by reading a YAML config file from disk.
 Package yaml implements ConfigStore by reading a YAML config file from disk.
config/domain
Package domain contains the core types for the config bounded context.
 Package domain contains the core types for the config bounded context.
config/ports
Package ports defines the interfaces the config bounded context exposes.
 Package ports defines the interfaces the config bounded context exposes.
directive/adapters/parser/xmod
Package xmod implements ports.DirectiveParser using golang.org/x/mod/modfile.
 Package xmod implements ports.DirectiveParser using golang.org/x/mod/modfile.
directive/adapters/store/sqlite
Package sqlite implements ports.DirectiveStore using the shared SQLite database.
 Package sqlite implements ports.DirectiveStore using the shared SQLite database.
directive/application
Package application orchestrates directive detection: load via ports, delegate classification to the domain, evaluate governance via the config policy, persist the record and emit audit facts.
 Package application orchestrates directive detection: load via ports, delegate classification to the domain, evaluate governance via the config policy, persist the record and emit audit facts.
directive/domain
Package domain holds the pure business rules for the directive bounded context: detection, risk classification and deterministic ordering of go.mod / go.work `replace` and `exclude` directives.
 Package domain holds the pure business rules for the directive bounded context: detection, risk classification and deterministic ordering of go.mod / go.work `replace` and `exclude` directives.
directive/ports
Package ports declares the interfaces the directive application depends on.
 Package ports declares the interfaces the directive application depends on.
driver
Package driver holds the narrow write/serving driver use cases the public façade graduates: composition-root entrypoints that orchestrate existing per-context use cases into a single high-level operation, without exposing the bulk pipeline.
 Package driver holds the narrow write/serving driver use cases the public façade graduates: composition-root entrypoints that orchestrate existing per-context use cases into a single high-level operation, without exposing the bulk pipeline.
example/adapters/parser/goast
Package goast implements ports.ExampleParser using go/parser, go/ast and go/format over the _test.go entries of a module zip.
 Package goast implements ports.ExampleParser using go/parser, go/ast and go/format over the _test.go entries of a module zip.
example/adapters/store/sqlite
Package sqlite implements ports.ExampleStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
 Package sqlite implements ports.ExampleStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
example/application
Package application contains the example-function harvesting use case: reading a module's zip from the blob store, scanning _test.go files for Example* functions, extracting their bodies and output comments via the Go AST, and persisting an ExampleRecord.
 Package application contains the example-function harvesting use case: reading a module's zip from the blob store, scanning _test.go files for Example* functions, extracting their bodies and output comments via the Go AST, and persisting an ExampleRecord.
example/domain
Package domain defines the types and invariants for example-function harvesting.
 Package domain defines the types and invariants for example-function harvesting.
example/ports
Package ports defines the interfaces the example application layer requires from the outside world.
 Package ports defines the interfaces the example application layer requires from the outside world.
extract/adapters/extractor/local
Package local implements ports.Extractor by routing each named stage to its corresponding local use case.
 Package local implements ports.Extractor by routing each named stage to its corresponding local use case.
extract/adapters/stages/local
Package local implements ports.StageRegistry with the built-in extraction stages (license, interface, callgraph, example) in canonical execution order.
 Package local implements ports.StageRegistry with the built-in extraction stages (license, interface, callgraph, example) in canonical execution order.
extract/adapters/store/sqlite
Package sqlite implements ports.ExtractionStore on SQLite.
 Package sqlite implements ports.ExtractionStore on SQLite.
extract/application
Package application contains the extraction orchestration use case.
 Package application contains the extraction orchestration use case.
extract/domain
Package domain defines the types and invariants for a coordinated extraction operation.
 Package domain defines the types and invariants for a coordinated extraction operation.
extract/ports
Package ports defines the interfaces the extract application layer requires from the outside world.
 Package ports defines the interfaces the extract application layer requires from the outside world.
fetch/application
Package application contains the fetch use cases.
 Package application contains the fetch use cases.
fetch/domain
Package domain contains the core model for the fetch bounded context.
 Package domain contains the core model for the fetch bounded context.
fetch/ports
Package ports defines the interfaces the fetch application layer requires from the outside world.
 Package ports defines the interfaces the fetch application layer requires from the outside world.
fips/adapters/scanner/gosrc
Package gosrc implements ports.FIPSScanner by reading a project's go.mod toolchain directive and walking its source tree for FIPS-relevant import paths.
 Package gosrc implements ports.FIPSScanner by reading a project's go.mod toolchain directive and walking its source tree for FIPS-relevant import paths.
fips/adapters/store/sqlite
Package sqlite implements ports.FIPSStore using the shared SQLite database.
 Package sqlite implements ports.FIPSStore using the shared SQLite database.
fips/application
Package application orchestrates FIPS assessment: load via ports, delegate classification to the domain catalogue, evaluate governance via the config policy, persist the record and emit audit facts.
 Package application orchestrates FIPS assessment: load via ports, delegate classification to the domain catalogue, evaluate governance via the config policy, persist the record and emit audit facts.
fips/domain
Package domain holds the pure business rules for the fips bounded context assessment modelling, toolchain & algorithm catalogues, and the deterministic ordering of FIPS findings.
 Package domain holds the pure business rules for the fips bounded context assessment modelling, toolchain & algorithm catalogues, and the deterministic ordering of FIPS findings.
fips/ports
Package ports declares the interfaces the fips application depends on.
 Package ports declares the interfaces the fips application depends on.
godebug/adapters/scanner/gosrc
Package gosrc implements ports.GoDebugScanner by scanning a project's Go source tree for `//go:debug name=value` directives.
 Package gosrc implements ports.GoDebugScanner by scanning a project's Go source tree for `//go:debug name=value` directives.
godebug/adapters/store/sqlite
Package sqlite implements ports.GoDebugStore using the shared SQLite database.
 Package sqlite implements ports.GoDebugStore using the shared SQLite database.
godebug/application
Package application orchestrates godebug detection: load via ports, delegate classification to the domain taxonomy, evaluate governance via the config policy, persist the record and emit audit facts.
 Package application orchestrates godebug detection: load via ports, delegate classification to the domain taxonomy, evaluate governance via the config policy, persist the record and emit audit facts.
godebug/domain
Package domain holds the pure business rules for the godebug bounded context: detection-result modelling, versioned taxonomy classification and deterministic ordering of GODEBUG / //go:debug settings.
 Package domain holds the pure business rules for the godebug bounded context: detection-result modelling, versioned taxonomy classification and deterministic ordering of GODEBUG / //go:debug settings.
godebug/ports
Package ports declares the interfaces the godebug application depends on.
 Package ports declares the interfaces the godebug application depends on.
iface/adapters/extractor/godoc
Package godoc implements ports.InterfaceExtractor using go/parser and go/doc.
 Package godoc implements ports.InterfaceExtractor using go/parser and go/doc.
iface/adapters/store/sqlite
Package sqlite implements ports.InterfaceStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
 Package sqlite implements ports.InterfaceStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
iface/application
Package application contains the ExtractInterfaceUseCase, which orchestrates blob retrieval, interface extraction, hashing, and persistence for a single module coordinate.
 Package application contains the ExtractInterfaceUseCase, which orchestrates blob retrieval, interface extraction, hashing, and persistence for a single module coordinate.
iface/domain
Package domain defines the types and invariants for public interface extraction.
 Package domain defines the types and invariants for public interface extraction.
iface/ports
Package ports defines the interfaces the iface application layer requires from the outside world.
 Package ports defines the interfaces the iface application layer requires from the outside world.
license/adapters/detector/licensecheck
Package licensecheck wraps github.com/google/licensecheck as a ports.LicenseDetector.
 Package licensecheck wraps github.com/google/licensecheck as a ports.LicenseDetector.
license/adapters/overrides/yaml
Package yaml implements license/ports.LicenseOverrideStore over the license_overrides section of config.yaml.
 Package yaml implements license/ports.LicenseOverrideStore over the license_overrides section of config.yaml.
license/adapters/store/sqlite
Package sqlite implements ports.LicenseStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
 Package sqlite implements ports.LicenseStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
license/application
Package application contains the license extraction use case: reading a module's zip from the blob store, scanning it for license files, classifying each with the configured detector, and persisting a LicenceRecord.
 Package application contains the license extraction use case: reading a module's zip from the blob store, scanning it for license files, classifying each with the configured detector, and persisting a LicenceRecord.
license/domain
Package domain defines the license bounded context's core model: the per-module license extraction record produced by scanning module zips for license files, classifying each against known SPDX identifiers, and deriving a primary license determination.
 Package domain defines the license bounded context's core model: the per-module license extraction record produced by scanning module zips for license files, classifying each against known SPDX identifiers, and deriving a primary license determination.
license/ports
Package ports defines the interfaces the license application layer requires from the outside world.
 Package ports defines the interfaces the license application layer requires from the outside world.
local/adapters/dependencies/store
Package store provides a DependencyLoader adapter backed by the global callgraph store.
 Package store provides a DependencyLoader adapter backed by the global callgraph store.
local/adapters/importer/golist
Package golist implements ports.ImportAnalyser by running go list -json -deps against the workspace directory and grouping imported packages by module.
 Package golist implements ports.ImportAnalyser by running go list -json -deps against the workspace directory and grouping imported packages by module.
local/adapters/probe/builder
Package builder implements ports.SymbolTableProber.
 Package builder implements ports.SymbolTableProber.
local/adapters/snapshot/walkdir
Package walkdir provides an fs.WalkDir-based SnapshotBuilder.
 Package walkdir provides an fs.WalkDir-based SnapshotBuilder.
local/adapters/symbols/gopackages
Package gopackages implements ports.SymbolAnalyser using go/packages type-checking to identify which exported symbols from dependency packages are referenced by the local workspace (~2-5s).
 Package gopackages implements ports.SymbolAnalyser using go/packages type-checking to identify which exported symbols from dependency packages are referenced by the local workspace (~2-5s).
local/adapters/vulnfindings/store
Package store provides a VulnFindingLoader adapter backed by the global vulnerability store.
 Package store provides a VulnFindingLoader adapter backed by the global vulnerability store.
local/adapters/workspace/goast
Package goast implements ports.WorkspaceAnalyser using go/parser to extract function declarations directly from Snapshot file contents without disk I/O.
 Package goast implements ports.WorkspaceAnalyser using go/parser to extract function declarations directly from Snapshot file contents without disk I/O.
local/application
Package application orchestrates local workspace analysis.
 Package application orchestrates local workspace analysis.
local/domain
Package domain defines the Snapshot type — a frozen, deterministic map of Go workspace files used as the shared foundation for local workspace analysis.
 Package domain defines the Snapshot type — a frozen, deterministic map of Go workspace files used as the shared foundation for local workspace analysis.
local/ports
Package ports defines the interfaces for local workspace analysis.
 Package ports defines the interfaces for local workspace analysis.
sbom/adapters/generator/cyclonedx
Package cyclonedx implements ports.SBOMGenerator producing CycloneDX 1.5 JSON.
 Package cyclonedx implements ports.SBOMGenerator producing CycloneDX 1.5 JSON.
sbom/adapters/store/sqlite
Package sqlite implements ports.SBOMStore using a SQLite database.
 Package sqlite implements ports.SBOMStore using a SQLite database.
sbom/application
Package application contains the SBOM use cases.
 Package application contains the SBOM use cases.
sbom/domain
Package domain defines the types and policy for Software Bill of Materials generation.
 Package domain defines the types and policy for Software Bill of Materials generation.
sbom/ports
Package ports defines the interfaces the sbom application layer requires from the outside world.
 Package ports defines the interfaces the sbom application layer requires from the outside world.
sqlitestore
vendortree/adapters/scanner/localfs
Package localfs implements ports.VendorScanner against the local filesystem.
 Package localfs implements ports.VendorScanner against the local filesystem.
vendortree/adapters/store/sqlite
Package sqlite implements ports.VendorStore using the shared SQLite database.
 Package sqlite implements ports.VendorStore using the shared SQLite database.
vendortree/application
Package application orchestrates vendored-closure reconciliation: load via the scanner port, delegate finding aggregation to the domain, evaluate governance via the config policy, persist the record and emit an audit fact.
 Package application orchestrates vendored-closure reconciliation: load via the scanner port, delegate finding aggregation to the domain, evaluate governance via the config policy, persist the record and emit an audit fact.
vendortree/domain
Package domain holds the pure business rules for the vendor bounded context reconciling a project's vendor/ tree, vendor/modules.txt, go.mod require set and go.sum into a classified set of findings (drift / inconsistency / unverified) plus a deterministic record.
 Package domain holds the pure business rules for the vendor bounded context reconciling a project's vendor/ tree, vendor/modules.txt, go.mod require set and go.sum into a classified set of findings (drift / inconsistency / unverified) plus a deterministic record.
vendortree/ports
Package ports declares the interfaces the vendor application depends on.
 Package ports declares the interfaces the vendor application depends on.
vuln/adapters/callgraph
vuln/adapters/fetch
Package fetch adapts the fetch context's FetchModuleUseCase to the vuln context's ports.ModuleFetcher.
 Package fetch adapts the fetch context's FetchModuleUseCase to the vuln context's ports.ModuleFetcher.
vuln/adapters/reachability
Package reachability implements ports.ReachabilityAnalyser using static call-graph analysis.
 Package reachability implements ports.ReachabilityAnalyser using static call-graph analysis.
vuln/adapters/store/sqlite
Package sqlite implements ports.VulnerabilityStore on SQLite.
 Package sqlite implements ports.VulnerabilityStore on SQLite.
vuln/adapters/vuln/govulncheck
Package govulncheck implements ports.VulnerabilityScanner by driving the external govulncheck binary.
 Package govulncheck implements ports.VulnerabilityScanner by driving the external govulncheck binary.
vuln/adapters/vulndb/osv
Package osv implements ports.VulnerabilityDatabase against the Go vulnerability database at vuln.go.dev.
 Package osv implements ports.VulnerabilityDatabase against the Go vulnerability database at vuln.go.dev.
vuln/application
Package application orchestrates vulnerability scanning use cases.
 Package application orchestrates vulnerability scanning use cases.
vuln/domain
Package domain defines the types and invariants for vulnerability scanning.
 Package domain defines the types and invariants for vulnerability scanning.
vuln/ports
Package ports defines the interfaces the vuln application layer requires from the outside world.
 Package ports defines the interfaces the vuln application layer requires from the outside world.
walk/adapters/buildlist/gotoolchain
Package gotoolchain implements ports.BuildListResolver by delegating build-list computation to the Go toolchain.
 Package gotoolchain implements ports.BuildListResolver by delegating build-list computation to the Go toolchain.
walk/adapters/fetcher/local
Package local provides a ModuleFetcher adapter backed by the local FetchModuleUseCase.
 Package local provides a ModuleFetcher adapter backed by the local FetchModuleUseCase.
walk/adapters/gomod/xmod
Package xmod implements the GoModParser port using golang.org/x/mod/modfile.
 Package xmod implements the GoModParser port using golang.org/x/mod/modfile.
walk/adapters/localfs
Package localfs provides a walk adapter that implements walkports.LocalModuleFetcher by creating FactRecords from local filesystem source trees instead of fetching from a module proxy.
 Package localfs provides a walk adapter that implements walkports.LocalModuleFetcher by creating FactRecords from local filesystem source trees instead of fetching from a module proxy.
walk/adapters/policy/localfile
Package localfile implements PolicyStore by reading a YAML policy file from disk.
 Package localfile implements PolicyStore by reading a YAML policy file from disk.
walk/adapters/walks/sqlite
Package sqlite implements ports.WalkStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
 Package sqlite implements ports.WalkStore using a SQLite database via modernc.org/sqlite (pure Go, no CGO).
walk/application
Package application implements the GraphResolver: a service that takes a target module coordinate and produces a complete, deterministic dependency Graph representing the transitive closure under Go's minimum version selection (MVS).
 Package application implements the GraphResolver: a service that takes a target module coordinate and produces a complete, deterministic dependency Graph representing the transitive closure under Go's minimum version selection (MVS).
walk/domain
Package domain defines the walk bounded context's core model: the dependency graph produced by resolving a target module's complete transitive closure under Go's minimum version selection (MVS), and the WalkRecord aggregate root that persists a completed walk as a tamper-evident fact.
 Package domain defines the walk bounded context's core model: the dependency graph produced by resolving a target module's complete transitive closure under Go's minimum version selection (MVS), and the WalkRecord aggregate root that persists a completed walk as a tamper-evident fact.
walk/ports
Package ports defines the interfaces the walk application layer requires from the outside world.
 Package ports defines the interfaces the walk application layer requires from the outside world.
pkg
kanonarion
Package kanonarion is the public API façade for the kanonarion module.
 Package kanonarion is the public API façade for the kanonarion module.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.