-
Notifications
You must be signed in to change notification settings - Fork 2.3k
/
sbom.go
78 lines (62 loc) · 1.78 KB
/
sbom.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
package sbom
import (
"encoding/json"
"encoding/xml"
"io"
"strings"
"github.com/in-toto/in-toto-golang/in_toto"
"golang.org/x/xerrors"
"github.com/aquasecurity/trivy/pkg/attestation"
"github.com/aquasecurity/trivy/pkg/fanal/types"
)
type SBOM struct {
OS *types.OS
Packages []types.PackageInfo
Applications []types.Application
CycloneDX *types.CycloneDX
}
type Format string
const (
FormatCycloneDXJSON Format = "cyclonedx-json"
FormatCycloneDXXML Format = "cyclonedx-xml"
FormatSPDXJSON Format = "spdx-json"
FormatSPDXXML Format = "spdx-xml"
FormatAttestCycloneDXJSON Format = "attest-cyclonedx-json"
FormatUnknown Format = "unknown"
)
func DetectFormat(r io.ReadSeeker) (Format, error) {
type cyclonedx struct {
// XML specific field
XMLNS string `json:"-" xml:"xmlns,attr"`
// JSON specific field
BOMFormat string `json:"bomFormat" xml:"-"`
}
// Try CycloneDX JSON
var cdxBom cyclonedx
if err := json.NewDecoder(r).Decode(&cdxBom); err == nil {
if cdxBom.BOMFormat == "CycloneDX" {
return FormatCycloneDXJSON, nil
}
}
if _, err := r.Seek(0, io.SeekStart); err != nil {
return FormatUnknown, xerrors.Errorf("seek error: %w", err)
}
// Try CycloneDX XML
if err := xml.NewDecoder(r).Decode(&cdxBom); err == nil {
if strings.HasPrefix(cdxBom.XMLNS, "http://cyclonedx.org") {
return FormatCycloneDXXML, nil
}
}
if _, err := r.Seek(0, io.SeekStart); err != nil {
return FormatUnknown, xerrors.Errorf("seek error: %w", err)
}
// TODO: implement SPDX
// Try in-toto attestation
var s attestation.Statement
if err := json.NewDecoder(r).Decode(&s); err == nil {
if s.PredicateType == in_toto.PredicateCycloneDX {
return FormatAttestCycloneDXJSON, nil
}
}
return FormatUnknown, nil
}