guacseam

package
v0.11.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 16, 2026 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func DrainContext added in v0.8.0

func DrainContext(intake context.Context, timeout time.Duration) (context.Context, context.CancelFunc)

DrainContext keeps accepted processing alive after intake cancellation, then cancels it after timeout. Callers must release it after their final flush. Processing callbacks must honor context cancellation.

Types

type DocumentFunc

type DocumentFunc func(ctx context.Context, p Parsed) error

DocumentFunc consumes one parsed document. An error it returns aborts the whole pass — a sink failure is not a document failure (§2.6).

type Expansion

type Expansion struct {
	Collected int
	Limit     int
	Exhausted bool
	Failed    []FailedDocument
}

Expansion reports one expansion pass: how many documents were collected (Collected), the budget it ran under (Limit), and whether the budget clamped collection (Exhausted).

func ExpandDepsDev

func ExpandDepsDev(ctx context.Context, purls []string, limit int, fn DocumentFunc) (Expansion, error)

ExpandDepsDev builds the imported deps.dev collector for purls and drives it directly (never via collector.Collect), processing/parsing/handing each emitted document to fn, bounded by limit. It is an I/O boundary (real deps.dev calls) — proven by the demo, not a unit test.

type FailedDocument

type FailedDocument struct {
	Source string
	Err    error
}

FailedDocument names a document that did not survive processing or parsing. Skipped-and-counted, never silent (§2.6, §6 inv. 9).

type FilesReceiver

type FilesReceiver struct {
	Path     string
	Poll     bool
	Interval time.Duration
}

FilesReceiver watches a directory of documents. Poll ⇒ re-scan at Interval; else one pass.

type GCSReceiver

type GCSReceiver struct {
	Bucket   string
	Poll     bool
	Interval time.Duration
}

GCSReceiver collects SBOMs from a GCS bucket. The storage client resolves GCP Application Default Credentials at construction (a real I/O boundary).

type OCIReceiver

type OCIReceiver struct {
	Refs     []string // image refs (image mode) or registry hosts (Registry mode)
	Registry bool     // true ⇒ collect whole registries (OciRegistryDataSources)
	Insecure bool     // plain-HTTP / skip-TLS, for local registries
	Poll     bool
	Interval time.Duration
}

OCIReceiver collects SBOMs attached to OCI artifacts. Refs are image refs in image mode, or registry hosts in Registry mode.

type Origin

type Origin int

Origin says where a collected document came from.

const (
	OriginReceiver  Origin = iota // came from a configured receiver
	OriginExpansion               // synthesized by deps.dev expansion
)

func (Origin) String

func (o Origin) String() string

String renders the origin for logs.

type Outcome

type Outcome struct {
	Documents int
	Failed    []FailedDocument
}

Outcome counts one collection pass.

func Collect

func Collect(ctx context.Context, src Sources, fn DocumentFunc) (Outcome, error)

Collect is the ONLY place GUAC behaviour is invoked (§3): it builds every present receiver's collector and drives the run-owned set directly.

type Parsed

type Parsed struct {
	Source     string // Doc.SourceInformation.Source
	Origin     Origin
	Doc        *processor.Document
	Preds      []assembler.IngestPredicates
	Purls      []string
	ScanFailed []ScanFailure
}

Parsed is one collected and parsed document: the raw GUAC document (bytes in Doc.Blob, plus type, format and provenance), the predicates the parser made from it, and the deduped purls it mentions (fed to expansion).

type S3Receiver

type S3Receiver struct {
	URL    string // custom endpoint (e.g. MinIO); "" ⇒ AWS SDK defaults
	Bucket string
	Path   string // folder prefix; list mode only
	Region string // "" ⇒ collector default
	Queues string // comma-separated; required when Poll (SQS message provider)
	Poll   bool
}

S3Receiver collects SBOMs from an S3 bucket (list mode) or an SQS message provider (poll mode). Queues is required when Poll is set.

type ScanFailure added in v0.8.0

type ScanFailure struct {
	Source string
	Err    error
}

ScanFailure records a scanner error without rejecting the base document.

type ScanFlags

type ScanFlags struct {
	Vulns    bool
	Licenses bool
	EOL      bool
	DepsDev  bool
}

ScanFlags gates the four ParseDocumentTree enrichment scanners.

type Sources

type Sources struct {
	Files  *FilesReceiver
	OCI    *OCIReceiver
	S3     *S3Receiver
	GCS    *GCSReceiver
	Scan   ScanFlags
	OnSkip func(FailedDocument)
	// ProcessingContext optionally shares a drain deadline with a caller's final flush.
	ProcessingContext context.Context
}

Sources is one collection pass's whole receiver set plus pass-level Scan and OnSkip (which apply to every collected document). A nil receiver pointer is absent; Collect requires at least one present.

Directories

Path Synopsis
Package cosignvuln parses the cosign vulnerability attestation, predicate https://cosign.sigstore.dev/attestation/vuln/v1, whose scanner.result is a whole Trivy JSON report rather than the flat {id, severity} list of the in-toto vulns/v0.1 predicate GUAC already parses.
Package cosignvuln parses the cosign vulnerability attestation, predicate https://cosign.sigstore.dev/attestation/vuln/v1, whose scanner.result is a whole Trivy JSON report rather than the flat {id, severity} list of the in-toto vulns/v0.1 predicate GUAC already parses.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL