// NewDocument returns a CycloneDX Document object populated with the SBOM and vulnerability findings.
NewDocument returns a CycloneDX Document object populated with the SBOM and vulnerability findings.
// NewDocument returns a CycloneDX Document object populated with the SBOM and vulnerability findings .
func NewDocument(packages []pkg.Package, matches match.Matches, srcMetadata *source.Metadata, provider vulnerability.MetadataProvider) (*cyclonedx.BOM, error) {
	versionInfo := version.FromBuild()
	doc := cyclonedx.NewBOM()
	doc.SerialNumber = uuid.New().URN()
	if srcMetadata != nil {
		doc.Metadata = NewBomMetadata(internal.ApplicationName, versionInfo.Version, srcMetadata)
	}
	components := []cyclonedx.Component{}
	vulnerabilities := []cyclonedx.Vulnerability{}
	for _, p := range packages {
		component := getComponent(p)
		pkgMatches := matches.GetByPkgID(p.ID)
		if len(pkgMatches) > 0 {
			for _, m := range pkgMatches {
				v, err := NewVulnerability(m, provider)
				if err != nil {
					return &cyclonedx.BOM{}, err
				}
				v.Affects = &[]cyclonedx.Affects{
					{
						Ref: component.BOMRef,
					},
				}
				vulnerabilities = append(vulnerabilities, v)
			}
		}
		components = append(components, component)
	}
	doc.Components = &components
	doc.Vulnerabilities = &vulnerabilities
	return doc, nil
}
func NewDocument ( packages [ ] pkg . Package , matches match . Matches , srcMetadata * source . Metadata , provider vulnerability . MetadataProvider ) ( * cyclonedx . BOM , error ) { versionInfo := version . FromBuild ( ) doc := cyclonedx . NewBOM ( ) doc . SerialNumber = uuid . New ( ) . URN ( ) if srcMetadata != nil { doc . Metadata = NewBomMetadata ( internal . ApplicationName , versionInfo . Version , srcMetadata ) } components := [ ] cyclonedx . Component { } vulnerabilities := [ ] cyclonedx . Vulnerability { } for _ , p := range packages { component := getComponent ( p ) pkgMatches := matches . GetByPkgID ( p . ID ) if len ( pkgMatches ) > 0 { for _ , m := range pkgMatches { v , err := NewVulnerability ( m , provider ) if err != nil { return & cyclonedx . BOM { } , err } v . Affects = & [ ] cyclonedx . Affects { { Ref : component . BOMRef , } , } vulnerabilities = append ( vulnerabilities , v ) } } components = append ( components , component ) } doc . Components = & components doc . Vulnerabilities = & vulnerabilities return doc , nil }
NewDocument returns a CycloneDX Document object populated with the SBOM and vulnerability findings.
NewDocument returns a CycloneDX Document object populated with the SBOM and vulnerability findings .
// attach matches // add a *copy* of the Component to the bom document