Packages

lowendinsight

0.9.1
0.9.1 0.9.0 0.8.1 0.8.0 0.7.3 0.7.2 0.7.1 0.7.0 0.6.6 0.6.5 0.6.4 0.6.3 0.6.2 0.6.1 0.6.0 0.5.0 0.4.3 0.4.2 0.4.1 0.4.0 0.3.3 0.3.2 0.3.1 0.3.0 0.2.3 0.2.2 0.2.1

LowEndInsight is a simple 'bus-factor' risk analysis library for Open Source Software which is managed within a Git repository. Provide the git URL and the library will respond with a basic Elixir Map structure report.

HexDocs

Current section

Files

Jump to
Readme
27 Versions
13 Dependencies
Dependants
Files
Activity
lowendinsight lib sbom_module.ex
Raw

lib/sbom_module.ex 

# Copyright (C) 2020 by the Georgia Tech Research Institute (GTRI)

# This software may be modified and distributed under the terms of

# the BSD 3-Clause license. See the LICENSE file for details.



defmodule SbomModule do

  @moduledoc """

  Scan for a SBOM and validate.

  """



  def has_sbom?(repo) do

    path = repo.path

    File.exists?(path <> "/bom.xml") or has_spdx?(repo)

  end



  def has_spdx?(repo) do

    # Look for actual SPDX document files, not source code files containing "spdx"

    spdx_patterns = [

      "/**/*.spdx.json",

      "/**/*.spdx.xml",

      "/**/*.spdx.rdf",

      "/**/*.spdx.yaml",

      "/**/*.spdx.yml",

      "/**/*.spdx"

    ]



    Enum.any?(spdx_patterns, fn pattern ->

      !Enum.empty?(Path.wildcard(repo.path <> pattern))

    end)

  end



end