Documentation
¶
Index ¶
- func DrainContext(intake context.Context, timeout time.Duration) (context.Context, context.CancelFunc)
- type DocumentFunc
- type Expansion
- type FailedDocument
- type FilesReceiver
- type GCSReceiver
- type OCIReceiver
- type Origin
- type Outcome
- type Parsed
- type S3Receiver
- type ScanFailure
- type ScanFlags
- type Sources
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DrainContext ¶ added in v0.8.0
func DrainContext(intake context.Context, timeout time.Duration) (context.Context, context.CancelFunc)
DrainContext keeps accepted processing alive after intake cancellation, then cancels it after timeout. Callers must release it after their final flush. Processing callbacks must honor context cancellation.
Types ¶
type DocumentFunc ¶
DocumentFunc consumes one parsed document. An error it returns aborts the whole pass — a sink failure is not a document failure (§2.6).
type Expansion ¶
type Expansion struct {
Collected int
Limit int
Exhausted bool
Failed []FailedDocument
}
Expansion reports one expansion pass: how many documents were collected (Collected), the budget it ran under (Limit), and whether the budget clamped collection (Exhausted).
func ExpandDepsDev ¶
func ExpandDepsDev(ctx context.Context, purls []string, limit int, fn DocumentFunc) (Expansion, error)
ExpandDepsDev builds the imported deps.dev collector for purls and drives it directly (never via collector.Collect), processing/parsing/handing each emitted document to fn, bounded by limit. It is an I/O boundary (real deps.dev calls) — proven by the demo, not a unit test.
type FailedDocument ¶
FailedDocument names a document that did not survive processing or parsing. Skipped-and-counted, never silent (§2.6, §6 inv. 9).
type FilesReceiver ¶
FilesReceiver watches a directory of documents. Poll ⇒ re-scan at Interval; else one pass.
type GCSReceiver ¶
GCSReceiver collects SBOMs from a GCS bucket. The storage client resolves GCP Application Default Credentials at construction (a real I/O boundary).
type OCIReceiver ¶
type OCIReceiver struct {
Refs []string // image refs (image mode) or registry hosts (Registry mode)
Registry bool // true ⇒ collect whole registries (OciRegistryDataSources)
Insecure bool // plain-HTTP / skip-TLS, for local registries
Poll bool
Interval time.Duration
}
OCIReceiver collects SBOMs attached to OCI artifacts. Refs are image refs in image mode, or registry hosts in Registry mode.
type Outcome ¶
type Outcome struct {
Documents int
Failed []FailedDocument
}
Outcome counts one collection pass.
type Parsed ¶
type Parsed struct {
Source string // Doc.SourceInformation.Source
Origin Origin
Doc *processor.Document
Preds []assembler.IngestPredicates
Purls []string
ScanFailed []ScanFailure
}
Parsed is one collected and parsed document: the raw GUAC document (bytes in Doc.Blob, plus type, format and provenance), the predicates the parser made from it, and the deduped purls it mentions (fed to expansion).
type S3Receiver ¶
type S3Receiver struct {
URL string // custom endpoint (e.g. MinIO); "" ⇒ AWS SDK defaults
Bucket string
Path string // folder prefix; list mode only
Region string // "" ⇒ collector default
Queues string // comma-separated; required when Poll (SQS message provider)
Poll bool
}
S3Receiver collects SBOMs from an S3 bucket (list mode) or an SQS message provider (poll mode). Queues is required when Poll is set.
type ScanFailure ¶ added in v0.8.0
ScanFailure records a scanner error without rejecting the base document.
type Sources ¶
type Sources struct {
Files *FilesReceiver
OCI *OCIReceiver
S3 *S3Receiver
GCS *GCSReceiver
Scan ScanFlags
OnSkip func(FailedDocument)
// ProcessingContext optionally shares a drain deadline with a caller's final flush.
ProcessingContext context.Context
}
Sources is one collection pass's whole receiver set plus pass-level Scan and OnSkip (which apply to every collected document). A nil receiver pointer is absent; Collect requires at least one present.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package cosignvuln parses the cosign vulnerability attestation, predicate https://cosign.sigstore.dev/attestation/vuln/v1, whose scanner.result is a whole Trivy JSON report rather than the flat {id, severity} list of the in-toto vulns/v0.1 predicate GUAC already parses.
|
Package cosignvuln parses the cosign vulnerability attestation, predicate https://cosign.sigstore.dev/attestation/vuln/v1, whose scanner.result is a whole Trivy JSON report rather than the flat {id, severity} list of the in-toto vulns/v0.1 predicate GUAC already parses. |