Categorygithub.com/smithy-security/smithycomponentsproducers
package
0.59.2
Repository: https://github.com/smithy-security/smithy.git
Documentation: pkg.go.dev
Overview
Versions
1
Dependencies
22
Dependents
27
Files
259 SLOC

# README

Producers

A producer is a program that parses the output of a tool and converts it into Smithy compatible file that can be used by the enrichers and consumers.

Writing Producers

Producers can be written in any language that supports protobufs, we have examples in Golang and Python. They are all structured the same way:

  1. Parse program arguments:
    1. in: the raw tool results file location
    2. out: where to place the Smithy compatible output file location
  2. Parse the in file into Protobufs (LaunchToolResponse)
  3. Add metadata to Protobufs (e.g. git/source-code information)
  4. Write the protobuf bytes to the out file

Producer API

For convenience, there are helper functions in the ./producers pkg/module for Golang/Python.

The WriteSmithyOut/write_smithy_out method expects a list of issues to write as the LaunchToolResponse protobuf. Your producer should parse the output of a tool results into Issue protobufs which are then passed into this method.

# Packages

No description provided by the author
No description provided by the author
Package main of the cdxgen producer parses the CycloneDX output of cdxgen and create a singular Smithy issue from it.
No description provided by the author
No description provided by the author
Package main of the dependency track producer reads a dependency track export and translates it to smithy format.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
Package main implements the binary for parsing trufflehog results into the smithy format.
No description provided by the author
No description provided by the author
No description provided by the author

# Functions

EnsureValidFileTarget takes a file target string from an untrusted source, e.g.
EnsureValidPURLTarget takes a purl target string from an untrusted source, e.g.
GetFileTarget returns a file target string for a given file path.
GetPartsFromFileTarget takes a file target string and returns the parts.
GetPURLTarget returns a purl target string for a given package.
ParseFlags will parse the input flags for the producer and perform simple validation.
ParseMultiJSONMessages provides method to parse tool results in JSON format.
ReadInFile returns the contents of the file given by InResults.
TestEndToEnd is a helper function to test the end-to-end functionality of a producer.
WriteSmithyOut provides a generic method to write the resulting protobuf to the output file.

# Constants

No description provided by the author

# Variables

Append flag will append to the outfile instead of overwriting, useful when there's multiple inresults.
InResults represents incoming tool output.
OutFile points to the protobuf file where smithy results will be written.