sbom

type Document struct {
	CreatedTime time.Time
	Describes   *Package
	Packages    []Package

	// Relationships is a list of relationships between elements in the SBOM.
	//
	// We're using the SPDX relationship type for now out of convenience, but we can
	// decouple this from our internal SBOM types later if it becomes valuable.
	Relationships []spdx.Relationship

	// LicensingInfos is a map of instances of the `Copyright.License` field in the
	// described package's build configuration to the string content of the file
	// from its corresponding `Copyright.LicensePath` field. It should be set by the
	// consumer, using the value from calling `(config.Package).LicensingInfos` on
	// the package being set as this document's described package.
	LicensingInfos map[string]string
}

type Element interface {
	// ID returns the unique identifier for this element.
	ID() string
}

type Package struct {
	// IDComponents lets the consumer specify additional bits of data that should be
	// included in the generation of the eventual SBOM package ID. By default, this
	// slice has a length of zero, in which case only the package's name and version
	// will be used. But sometimes it's necessary to include more bits of data to
	// ensure package IDs remain unique. If this slice's length is non-zero, only
	// these values will be used when producing the ID (via calling the ID method)
	// (i.e. name and version would need to be added explicitly to this slice).
	IDComponents []string

	// The name of the origin package, a subpackage, or any other kind of (e.g.
	// non-APK) package for inclusion in the SBOM.
	Name string

	// The version of the package. For APK packages, this should be the "full
	// version" (including the epoch).
	Version string

	// This is the copyright text in the SPDX package. It's usually left blank.
	Copyright string

	// SPDX license expression. Leaving this empty will result in NOASSERTION being
	// used as its value.
	LicenseDeclared string

	// Name of the distro/organization that produced the package. E.g. "wolfi".
	//
	// TODO: consider renaming this to avoid confusion from our other uses of
	//  "namespace", perhaps to "supplier" or "originator" (or have both), and signal
	//  that it's safe to leave this blank.
	Namespace string

	// The architecture of the package. E.g. "aarch64". This field isn't always
	// relevant, especially when describing material upstream of the built APK
	// package (e.g. source code or language ecosystem dependencies).
	Arch string

	// Checksums of the package. The keys are the checksum algorithms (e.g. "SHA-256"),
	// and the values are the checksums.
	Checksums map[string]string

	// The Package URL for this package, if any. If set, it will be added as the
	// only ExternalRef of type "purl" to the SPDX package. (A package
	// should have only one PURL external ref.)
	PURL *purl.PackageURL

	// The Download Location for this package, if any; It set this is generated
	// alongside the PackageURL from fetch/git-checkout pipelines for upstream
	// source locations; Leaving this empty will result in NOASSERTION being
	// used as its value.
	DownloadLocation string
}