Split the sbom.Format interface by encode and decode use cases (#2186)

* split up sbom.Format into encode and decode ops Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * update cmd pkg to inject format configs Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * bump cyclonedx schema to 1.5 Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * redact image metadata from github encoder tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add more testing around format decoder identify Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add test case for format version options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix CLI test Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * [wip] - review comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep encoder creation out of post load function Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep decider and identify functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add a few more doc comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove format encoder default function helpers Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * address PR feedback Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * move back to streaming based decode functions Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * with common convention for encoder constructors Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix tests and allow for encoders to be created from cli options Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix cli tests Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix linting Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * buffer reads from stdin to support seeking Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-10-30 22:12:28 +01:00 · 2023-10-25 13:43:06 +00:00
parent 7315f83f9d
commit 7392d607b6
254 changed files with 10450 additions and 2714 deletions
@@ -0,0 +1,78 @@
+package model
+
+// Derived from: https://gist.github.com/reiddraper/fdab2883db0f372c146d1a750fc1c43f
+
+type DependencySnapshot struct {
+	Version   int              `json:"version"`
+	Job       Job              `json:"job,omitempty"` // !omitempty
+	Sha       string           `json:"sha,omitempty"` // !omitempty sha of the Git commit
+	Ref       string           `json:"ref,omitempty"` // !omitempty ref of the Git commit example "refs/heads/main"
+	Detector  DetectorMetadata `json:"detector,omitempty"`
+	Metadata  Metadata         `json:"metadata,omitempty"`
+	Manifests Manifests        `json:"manifests,omitempty"`
+	Scanned   ISO8601Date      `json:"scanned,omitempty"`
+}
+
+type Job struct {
+	Correlator string `json:"correlator,omitempty"` // !omitempty
+	ID         string `json:"id,omitempty"`         // !omitempty
+	HTMLURL    string `json:"html_url,omitempty"`
+}
+
+type DetectorMetadata struct {
+	Name    string `json:"name,omitempty"`
+	URL     string `json:"url,omitempty"`
+	Version string `json:"version,omitempty"`
+}
+
+type Manifests map[string]Manifest
+
+// Manifest A collection of related dependencies, either declared in a file,
+// or representing a logical group of dependencies.
+type Manifest struct {
+	Name     string          `json:"name"`
+	File     FileInfo        `json:"file"`
+	Metadata Metadata        `json:"metadata,omitempty"`
+	Resolved DependencyGraph `json:"resolved,omitempty"`
+}
+
+type FileInfo struct {
+	SourceLocation string `json:"source_location,omitempty"`
+}
+
+// DependencyRelationship A notation of whether a dependency is requested directly
+// by this manifest, or is a dependency of another dependency.
+type DependencyRelationship string
+
+const (
+	DependencyRelationshipDirect   DependencyRelationship = "direct"
+	DependencyRelationshipIndirect DependencyRelationship = "indirect"
+)
+
+// DependencyScope A notation of whether the dependency is required for the primary
+// build artifact (runtime), or is only used for development.
+// Future versions of this specification may allow for more granular
+// scopes, like `runtimeserver`, `runtimeshipped`,
+// `developmenttest`, `developmentbenchmark`.
+type DependencyScope string
+
+const (
+	DependencyScopeRuntime     DependencyScope = "runtime"
+	DependencyScopeDevelopment DependencyScope = "development"
+)
+
+type DependencyNode struct {
+	PackageURL   string                 `json:"package_url,omitempty"`
+	Metadata     Metadata               `json:"metadata,omitempty"`
+	Relationship DependencyRelationship `json:"relationship,omitempty"`
+	Scope        DependencyScope        `json:"scope,omitempty"`
+	Dependencies []string               `json:"dependencies,omitempty"`
+}
+
+type DependencyGraph map[string]DependencyNode
+
+type ISO8601Date = string
+
+type Scalar interface{} // should be: null | boolean | string | number
+
+type Metadata map[string]Scalar