using System.Collections.Immutable; using System.Text.Json.Serialization; namespace StellaOps.Scanner.Emit.Composition; /// /// Reference to a per-layer SBOM stored in CAS. /// public sealed record LayerSbomRef { /// /// The digest of the layer (e.g., "sha256:abc123..."). /// [JsonPropertyName("layerDigest")] public required string LayerDigest { get; init; } /// /// The order of the layer in the image (0-indexed). /// [JsonPropertyName("order")] public required int Order { get; init; } /// /// SHA256 digest of the layer fragment (component list). /// [JsonPropertyName("fragmentDigest")] public required string FragmentDigest { get; init; } /// /// SHA256 digest of the CycloneDX SBOM for this layer. /// [JsonPropertyName("cycloneDxDigest")] public required string CycloneDxDigest { get; init; } /// /// CAS URI of the CycloneDX SBOM. /// [JsonPropertyName("cycloneDxCasUri")] public required string CycloneDxCasUri { get; init; } /// /// SHA256 digest of the SPDX SBOM for this layer. /// [JsonPropertyName("spdxDigest")] public required string SpdxDigest { get; init; } /// /// CAS URI of the SPDX SBOM. /// [JsonPropertyName("spdxCasUri")] public required string SpdxCasUri { get; init; } /// /// Number of components in this layer. /// [JsonPropertyName("componentCount")] public required int ComponentCount { get; init; } } /// /// Result of generating per-layer SBOMs. /// public sealed record LayerSbomResult { /// /// References to all per-layer SBOMs, ordered by layer order. /// [JsonPropertyName("layerSboms")] public required ImmutableArray LayerSboms { get; init; } /// /// Merkle root computed from all layer SBOM digests. /// [JsonPropertyName("merkleRoot")] public required string MerkleRoot { get; init; } } /// /// Artifact bytes for a single layer's SBOM. /// public sealed record LayerSbomArtifact { /// /// The layer digest this SBOM represents. /// public required string LayerDigest { get; init; } /// /// CycloneDX JSON bytes. /// public required byte[] CycloneDxJsonBytes { get; init; } /// /// SHA256 of CycloneDX JSON. /// public required string CycloneDxDigest { get; init; } /// /// SPDX JSON bytes. /// public required byte[] SpdxJsonBytes { get; init; } /// /// SHA256 of SPDX JSON. /// public required string SpdxDigest { get; init; } /// /// Number of components in this layer. /// public required int ComponentCount { get; init; } }