report

Documentation

Index

• Constants
• func WriteHTMLReport(data ReportData, path string) error
• func WriteTextReport(bom *sbom.BOM, findings []vuln.Finding, ...) error
• type ReportData
• type SASTMetadata

Constants

const HTML_TEMPLATE_NAME = "cra-report"

HTML_TEMPLATE_NAME is the internal name of the parsed HTML template.

const TEXT_LINE_WIDTH = 80

TEXT_LINE_WIDTH is the width of the text report page in characters.

Functions

func WriteHTMLReport

func WriteHTMLReport(data ReportData, path string) error

WriteHTMLReport renders the CRA compliance HTML report and writes it to path. It populates the report with SBOM data, vulnerability findings, and signature metadata. Returns an error if template rendering or file write fails.

func WriteTextReport

func WriteTextReport(
	bom *sbom.BOM,
	findings []vuln.Finding,
	projectName, projectVersion, toolVersion string,
	signed bool,
	snapshot *vuln.EuvdSnapshot,
	path string,
) error

WriteTextReport generates a structured plain-text compliance report and writes it to path. The report includes SBOM summary, dependency inventory, vulnerability findings, and CRA/eIDAS compliance checklists. Returns an error if file write fails.

Types

type ReportData

type ReportData struct {
	// GeneratedAt is the ISO 8601 UTC generation timestamp.
	GeneratedAt string
	// ProjectName is the top-level component name.
	ProjectName string
	// ProjectVersion is the top-level component version.
	ProjectVersion string
	// ToolVersion is the EUProvGuard tool version string.
	ToolVersion string
	// BOM is the CycloneDX BOM document.
	BOM *sbom.BOM
	// Findings are the CVE findings from vulnerability matching.
	Findings []vuln.Finding
	// SeverityCounts maps severity string to count (string keys for template compatibility).
	SeverityCounts map[string]int
	// Signed indicates whether the BOM has been signed.
	Signed bool
	// SignedAt is the signing timestamp (if signed).
	SignedAt string
	// TSAPresent indicates whether a TSA timestamp is present.
	TSAPresent bool
	// EuvdSnapshot holds EUVD database state metadata for audit attestation (live mode only).
	EuvdSnapshot *vuln.EuvdSnapshot
	// LiveMode indicates that vulnerability data was sourced from the EUVD live API.
	LiveMode bool
	// SASTFindings holds code security findings from static analysis.
	SASTFindings interface{} // []scanner.Finding
	// SASTMetadata describes which SAST rules were executed.
	SASTMetadata SASTMetadata
}

ReportData holds all data needed to render the HTML compliance report.

type SASTMetadata

type SASTMetadata struct {
	// Enabled indicates whether SAST was performed.
	Enabled bool
	// RulesCount is the total number of SAST rules evaluated.
	RulesCount int
	// CatalogVersion identifies the CWE/SAST catalog version used (e.g., "CWE-1.4.1").
	CatalogVersion string
	// SeverityFilter shows which severities were reported (e.g., "CRITICAL, HIGH").
	SeverityFilter string
	// FindingsCount is the number of issues found after filtering.
	FindingsCount int
}

SASTMetadata documents the static analysis configuration.