spdx

type ArchiveManifest struct {
	ConfigFilename string   `json:"Config"`
	RepoTags       []string `json:"RepoTags"`
	LayerFiles     []string `json:"Layers"`
}

type ContainerLayerAnalyzer interface {
	ReadPackageData(layerPath string, pkg *Package) error
	CanHandle(layerPath string) (bool, error)
}

type ContainerLayerAnalyzerOptions struct {
	LicenseCacheDir string
}

type DocBuilder struct {
	// contains filtered or unexported fields
}

type DocBuilderImplementation interface {
	WriteDoc(*Document, string) error
	ReadYamlConfiguration(string, *DocGenerateOptions) error
	CreateSPDXClient(*DocGenerateOptions, *DocBuilderOptions) (*SPDX, error)
	ValidateOptions(*DocGenerateOptions) error

	// Document generation functions
	CreateDocument(*DocGenerateOptions, *SPDX) (*Document, error)
	ScanDirectories(*DocGenerateOptions, *SPDX, *Document) error
	ScanImages(*DocGenerateOptions, *SPDX, *Document) error
	ScanImageArchives(*DocGenerateOptions, *SPDX, *Document) error
	ScanArchives(*DocGenerateOptions, *SPDX, *Document) error
	ScanFiles(*DocGenerateOptions, *SPDX, *Document) error
}

type DocBuilderOptions struct {
	WorkDir string // Working directory (defaults to a tmp dir)
}

type DocGenerateOptions struct {
	AnalyseLayers       bool                  // A flag that controls if deep layer analysis should be performed
	NoGitignore         bool                  // Do not read exclusions from gitignore file
	ProcessGoModules    bool                  // Analyze go.mod to include data about packages
	OnlyDirectDeps      bool                  // Only include direct dependencies from go.mod
	ScanLicenses        bool                  // Try to look into files to determine their license
	ScanImages          bool                  // When true, scan images for OS information
	ConfigFile          string                // Path to SBOM configuration file
	Format              string                // Output format
	OutputFile          string                // Output location
	Name                string                // Name to use in the resulting document
	Namespace           string                // Namespace for the document (a unique URI)
	CreatorPerson       string                // Document creator information
	License             string                // Main license of the document
	LicenseListVersion  string                // Version of the SPDX list to use
	Tarballs            []string              // A slice of docker archives (tar)
	Archives            []string              // A list of archive files to add as packages
	Files               []string              // A slice of naked files to include in the bom
	Images              []string              // A slice of docker images
	Directories         []string              // A slice of directories to convert into packages
	IgnorePatterns      []string              // A slice of regexp patterns to ignore when scanning dirs
	ExternalDocumentRef []ExternalDocumentRef // List of external documents related to the bom
}

type Document struct {
	Version     string // SPDX-2.2
	DataLicense string // CC0-1.0
	ID          string // SPDXRef-DOCUMENT
	Name        string // hello-go-src
	Namespace   string // https://swinslow.net/spdx-examples/example6/hello-go-src-v1
	Creator     struct {
		Person       string // Steve Winslow (steve@swinslow.net)
		Organization string
		Tool         []string // github.com/spdx/tools-golang/builder
	}
	Created            time.Time // 2020-11-24T01:12:27Z
	LicenseListVersion string
	Packages           map[string]*Package
	Files              map[string]*File      // List of files
	ExternalDocRefs    []ExternalDocumentRef // List of related external documents
}

type DrawingOptions struct {
	Width       int
	Height      int
	Recursion   int
	DisableTerm bool
	LastItem    bool
	SkipName    bool
	OnlyIDs     bool
	ASCIIOnly   bool
	Purls       bool
	Version     bool
}

type Entity struct {
	ID               string            // Identifier string  for the object in the doc
	SourceFile       string            // Local file to read for information
	Name             string            // Name of the package
	DownloadLocation string            // Download point for the entity
	CopyrightText    string            // NOASSERTION
	FileName         string            // Name of the file
	LicenseConcluded string            // LicenseID o NOASSERTION
	LicenseComments  string            // record any relevant background information or analysis that went in to arriving at the Concluded License
	Opts             *ObjectOptions    // Entity options
	Relationships    []*Relationship   // List of objects that have a relationship woth this package
	Checksum         map[string]string // Colection of source file checksums
}

type ExternalDocumentRef struct {
	ID        string            `yaml:"id"`        // Identifier for the external doc (eg "external-source-bom")
	URI       string            `yaml:"uri"`       // URI where the doc can be retrieved
	Checksums map[string]string `yaml:"checksums"` // Document checksums
}

type ExternalRef struct {
	Category string // SECURITY | PACKAGE-MANAGER | PERSISTENT-ID | OTHER
	Type     string // cpe22Type | cpe23Type | maven-central | npm | nuget | bower | purl | swh | other
	Locator  string // unique string with no spaces
}

type File struct {
	Entity
	FileType          []string
	LicenseInfoInFile string // GPL-3.0-or-later
}

type Format string

type GoModDefaultImpl struct {
	// contains filtered or unexported fields
}

type GoModImplementation interface {
	OpenModule(*GoModuleOptions) (*modfile.File, error)
	BuildPackageList(*modfile.File) ([]*GoPackage, error)
	DownloadPackage(*GoPackage, *GoModuleOptions, bool) error
	RemoveDownloads([]*GoPackage) error
	LicenseReader() (*license.Reader, error)
	ScanPackageLicense(*GoPackage, *license.Reader, *GoModuleOptions) error
}

type GoModule struct {
	GoMod *modfile.File

	Packages []*GoPackage // maps of package download locations
	// contains filtered or unexported fields
}

type GoModuleOptions struct {
	Path           string // Path to the dir where go.mod resides
	OnlyDirectDeps bool   // Only include direct dependencies from go.mod
	ScanLicenses   bool   // Scan licenses from everypossible place unless false
}

type GoPackage struct {
	TmpDir        bool
	ImportPath    string
	Revision      string
	LocalDir      string
	LocalInstall  string
	LicenseID     string
	CopyrightText string
}

type ImageAnalyzer struct {
	Analyzers map[string]ContainerLayerAnalyzer
}

type ImageReferenceInfo struct {
	Digest    string
	Reference string
	Archive   string
	Arch      string
	OS        string
	MediaType string
	Images    []ImageReferenceInfo
}

type NewDocBuilderOption func(*newDocBuilderSettings)

type Object interface {
	SPDXID() string
	SetSPDXID(string)
	ReadSourceFile(string) error
	Render() (string, error)
	BuildID(seeds ...string)
	SetEntity(*Entity)
	AddRelationship(*Relationship)
	GetRelationships() *[]*Relationship
	ToProvenanceSubject() *intoto.Subject

	GetElementByID(string) Object
	// contains filtered or unexported methods
}

type ObjectOptions struct {
	Prefix  string
	WorkDir string
}

type Options struct {
	AnalyzeLayers      bool
	NoGitignore        bool     // Do not read exclusions from gitignore file
	ProcessGoModules   bool     // If true, spdx will check if dirs are go modules and analize the packages
	OnlyDirectDeps     bool     // Only include direct dependencies from go.mod
	ScanLicenses       bool     // Scan licenses from everypossible place unless false
	AddTarFiles        bool     // Scan and add files inside of tarfiles
	ScanImages         bool     // When true, scan container images for OS information
	LicenseCacheDir    string   // Directory to cache SPDX license downloads
	LicenseData        string   // Directory to store the SPDX licenses
	LicenseListVersion string   // Version of the SPDX license list to use
	IgnorePatterns     []string // Patterns to ignore when scanning file
}

type Package struct {
	Entity
	sync.RWMutex
	FilesAnalyzed        bool     // true
	VerificationCode     string   // 6486e016b01e9ec8a76998cefd0705144d869234
	LicenseInfoFromFiles []string // GPL-3.0-or-later
	LicenseDeclared      string   // GPL-3.0-or-later
	Version              string   // Package version
	Comment              string   // a place for the SPDX document creator to record any general comments
	HomePage             string   // A web site that serves as the package home page
	PrimaryPurpose       string   // Estimate of the most likely package usage

	// Supplier: the actual distribution source for the package/directory
	Supplier struct {
		Person       string // person name and optional (<email>)
		Organization string // organization name and optional (<email>)
	}
	// Originator: For example, the SPDX file identifies the package glibc and Red Hat as the Package Supplier,
	// but the Free Software Foundation is the Package Originator.
	Originator struct {
		Person       string // person name and optional (<email>)
		Organization string // organization name and optional (<email>)
	}

	ExternalRefs []ExternalRef // List of external references
}

type ProvenanceOptions struct {
	Relationships map[string][]RelationshipType
}

type PurlSearchOption string

type Relationship struct {
	FullRender       bool             // Flag, then true the package will be rendered in the doc
	PeerReference    string           // SPDX Ref of the peer object. Will override the ID of provided package if set
	PeerExtReference string           // External doc reference if peer is a different doc
	Comment          string           // Relationship ship commnet
	Type             RelationshipType // Relationship of the specified package
	Peer             Object           // SPDX object that acts as peer
}

type RelationshipType string

type SPDX struct {
	// contains filtered or unexported fields
}

type TarballOptions struct {
	ExtractDir string // Directory where the docker tar archive will be extracted
	AddFiles   bool
}

type ValidationResults struct {
	Success          bool
	Message          string
	FileName         string
	FailedAlgorithms []string
}

type YamlBOMConfiguration struct {
	Namespace string `yaml:"namespace"`
	License   string `yaml:"license"` // Document wide license
	Name      string `yaml:"name"`
	Creator   struct {
		Person string `yaml:"person"`
		Tool   string `yaml:"tool"`
	} `yaml:"creator"`
	ExternalDocRefs []ExternalDocumentRef `yaml:"external-docs"`
	Artifacts       []*YamlBuildArtifact  `yaml:"artifacts"`
}

type YamlBuildArtifact struct {
	Type      string `yaml:"type"` //  directory
	Source    string `yaml:"source"`
	License   string `yaml:"license"`   // SPDX license ID Apache-2.0
	GoModules *bool  `yaml:"gomodules"` // Shoud we scan go modules
}