From fbab711cb3d684436da081830134450e0e1fc1a4 Mon Sep 17 00:00:00 2001 From: Maxim Stykow Date: Fri, 24 Jul 2026 09:19:46 +0200 Subject: [PATCH 1/4] feat(output): version resolved-dependency SBOM purls and join vendored licenses Resolve each SBOM dependency edge to its versioned coordinate before promotion and graph-edge resolution. SbomInventory now builds a version index (version-less purl identity -> the single versioned purl that shares it, drawn from detected packages, dependency purls, and resolved-package purls) and upgrades an unversioned requirement edge to that sibling. Identities with zero or multiple versioned siblings stay unversioned (honest-unknowns). This closes issue #1320's two static, no-network gaps in one join: - Resolved-dependency components carry the resolved, versioned purl (pkg:npm/leftpad@1.0.0), the join key for downstream enrichment. - A vendored dependency (source/metadata on disk) dedups against the unversioned requirement edge into ONE licensed, versioned component instead of two. Both CycloneDX and SPDX consume the shared inventory, so both benefit; the native ScanCode-compatible JSON is untouched. Graph stays closed (edges canonicalize through the same resolver) and bom-refs stay unique. Regenerated the four examples/sbom documents (ripgrep 114->91, flask 54->47, tokio 51->46 components; express unchanged, no lockfile) and the dependency goldens; all validate against cyclonedx-python-lib and pyspdxtools. Updated ADR 0012 with the amendment. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Maxim Stykow --- ...012-sbom-resolved-dependency-components.md | 43 ++ examples/sbom/README.md | 2 +- examples/sbom/express/sbom.cdx.json | 4 +- examples/sbom/express/sbom.spdx | 2 +- examples/sbom/flask/README.md | 4 +- examples/sbom/flask/sbom.cdx.json | 107 +--- examples/sbom/flask/sbom.spdx | 193 +++---- examples/sbom/ripgrep/README.md | 4 +- examples/sbom/ripgrep/sbom.cdx.json | 370 ++----------- examples/sbom/ripgrep/sbom.spdx | 519 ++++++------------ examples/sbom/tokio/README.md | 2 +- examples/sbom/tokio/sbom.cdx.json | 116 +--- examples/sbom/tokio/sbom.spdx | 104 ++-- src/output/sbom.rs | 233 +++++++- .../cyclonedx-dependencies-expected.json | 32 +- .../cyclonedx-dependencies-expected.xml | 20 +- .../spdx-dependencies-expected.tv | 11 +- tests/output_format_golden.rs | 112 +++- 18 files changed, 794 insertions(+), 1084 deletions(-) diff --git a/docs/adr/0012-sbom-resolved-dependency-components.md b/docs/adr/0012-sbom-resolved-dependency-components.md index ad6e9b9e9..aa66440dc 100644 --- a/docs/adr/0012-sbom-resolved-dependency-components.md +++ b/docs/adr/0012-sbom-resolved-dependency-components.md @@ -104,6 +104,48 @@ determine it statically**: - No other dependency-intent flag (`is_runtime`, `is_direct`, `is_pinned`) is invented for a component when it is not proven. +## Amendment (issue #1320): versioned purls and the vendored-license join + +The original decision keyed promotion and graph edges on the dependency's +*declared* purl. For an ecosystem that resolves versions in a lockfile that is a +separate datasource from the manifest (npm, Cargo, PyPI, …), that produced two +shortcomings visible in a real scan: + +- A dependency promoted from a manifest requirement carried the **unversioned** + purl (`pkg:npm/leftpad`) even when the lockfile had already resolved it to a + version — the versioned coordinate that makes the purl a usable join key for + downstream license enrichment (deps.dev, ClearlyDefined, an SCA tool). +- When the dependency's source or metadata was on disk (`node_modules//`, + `*.dist-info/METADATA`, vendored source), Provenant detected and licensed it + as a package at its **versioned** purl, but the manifest requirement was + promoted as a **separate, unversioned, unlicensed** component. The same + dependency appeared twice, and the licensed copy was not the purl-keyed one. + +### Decision + +Resolve each dependency edge purl to its **versioned coordinate** before +promotion and edge resolution, using only static evidence already in the +document. `SbomInventory` builds a version index mapping each version-less purl +identity (type + namespace + name) to the single versioned purl that shares it, +drawn from detected packages, dependency purls, and resolved-package purls. An +unversioned edge whose identity has exactly one versioned sibling is upgraded to +that versioned purl; an identity with zero or multiple versioned siblings is +left unversioned (honest-unknowns — Provenant does not guess which version a +range resolved to). Both promotion dedup and `dependsOn`/`DEPENDS_ON` edge +resolution route through the same canonicalization, so a component and the edges +that target it always agree and the graph stays closed. + +This closes both gaps with the existing purl-dedup: once the unversioned +requirement is canonicalized to the resolved coordinate, it dedups against the +detected package (vendored case → one licensed, versioned component) or against +the versioned lockfile edge (source-absent case → one versioned component, +license carried from `resolved_package` when present, otherwise unset). Nothing +is fetched; the license and version come only from what was scanned. + +Still static and no-network: the change is purely a render-time join over data +already extracted. When neither a detected package nor a resolved version exists +for an identity, the component keeps its unversioned purl and unset license. + ## Consequences ### Benefits @@ -147,6 +189,7 @@ determine it statically**: ## References - Issue #1319 +- Issue #1320 (versioned purls + vendored-license join amendment) - Promotion/dedup: `src/output/sbom.rs` - CycloneDX renderer: `src/output/cyclonedx.rs` - SPDX renderer: `src/output/spdx.rs` diff --git a/examples/sbom/README.md b/examples/sbom/README.md index e2aa1d891..2517b9cac 100644 --- a/examples/sbom/README.md +++ b/examples/sbom/README.md @@ -2,7 +2,7 @@ Real software bills of materials produced by [Provenant](https://github.com/getprovenant/provenant), one directory per target. Each target directory contains an SPDX tag-value document ([`sbom.spdx`](ripgrep/sbom.spdx)) and a CycloneDX JSON document ([`sbom.cdx.json`](ripgrep/sbom.cdx.json)), plus a short provenance README. -These examples are generated by Provenant scanning each project at a pinned commit with license, package, and copyright detection enabled. Every SBOM is a complete, closed inventory: each resolved dependency is promoted to a component with a package URL, and every dependency relationship resolves within the document. +These examples are generated by Provenant 1.0.1 (the current build) scanning each project at a pinned commit with license, package, and copyright detection enabled. Every SBOM is a complete, closed inventory: each resolved dependency is promoted to a component with a package URL, and every dependency relationship resolves within the document. ## Targets diff --git a/examples/sbom/express/sbom.cdx.json b/examples/sbom/express/sbom.cdx.json index 3ca4110f8..9ad52a621 100644 --- a/examples/sbom/express/sbom.cdx.json +++ b/examples/sbom/express/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:91ad61c4-42a1-4321-ad30-83a7bcbd583c", + "serialNumber": "urn:uuid:aa6d0404-c1bd-4a88-97d2-386b6a433602", "version": 1, "metadata": { - "timestamp": "2026-07-23T22:12:14Z", + "timestamp": "2026-07-24T07:16:25Z", "tools": [ { "name": "Provenant", diff --git a/examples/sbom/express/sbom.spdx b/examples/sbom/express/sbom.spdx index 8187b2d9a..16c1c3b0c 100644 --- a/examples/sbom/express/sbom.spdx +++ b/examples/sbom/express/sbom.spdx @@ -13,7 +13,7 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-23T22:12:13Z +Created: 2026-07-24T07:16:25Z ## Package Information PackageName: express SPDXID: SPDXRef-Package-1 diff --git a/examples/sbom/flask/README.md b/examples/sbom/flask/README.md index e70b14f7a..92102fb93 100644 --- a/examples/sbom/flask/README.md +++ b/examples/sbom/flask/README.md @@ -11,8 +11,8 @@ SPDX tag-value ([`sbom.spdx`](sbom.spdx)) and CycloneDX JSON ([`sbom.cdx.json`]( ## What's inside -- **54 components** — the project plus every resolved dependency, each with a package URL (purl). -- **54 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). +- **47 components** — the project plus every resolved dependency, each with a package URL (purl). +- **53 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). ## How it compares diff --git a/examples/sbom/flask/sbom.cdx.json b/examples/sbom/flask/sbom.cdx.json index d722407fd..fffe4bc04 100644 --- a/examples/sbom/flask/sbom.cdx.json +++ b/examples/sbom/flask/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:4d23bf82-3939-4f54-b4e2-e1a2a4c59ee8", + "serialNumber": "urn:uuid:f38ece06-0b4c-4c7d-867e-d60b1d3e2ba9", "version": 1, "metadata": { - "timestamp": "2026-07-23T22:12:16Z", + "timestamp": "2026-07-24T07:16:28Z", "tools": [ { "name": "Provenant", @@ -182,14 +182,6 @@ "scope": "required", "purl": "pkg:pypi/billiard@3.6.4.0" }, - { - "type": "library", - "bom-ref": "pkg:pypi/blinker", - "name": "blinker", - "version": "unknown", - "scope": "required", - "purl": "pkg:pypi/blinker" - }, { "type": "library", "bom-ref": "pkg:pypi/blinker@1.6.2", @@ -198,14 +190,6 @@ "scope": "required", "purl": "pkg:pypi/blinker@1.6.2" }, - { - "type": "library", - "bom-ref": "pkg:pypi/celery", - "name": "celery", - "version": "unknown", - "scope": "required", - "purl": "pkg:pypi/celery" - }, { "type": "library", "bom-ref": "pkg:pypi/celery@5.2.7", @@ -216,11 +200,11 @@ }, { "type": "library", - "bom-ref": "pkg:pypi/click", + "bom-ref": "pkg:pypi/click@8.1.3", "name": "click", - "version": "unknown", + "version": "8.1.3", "scope": "required", - "purl": "pkg:pypi/click" + "purl": "pkg:pypi/click@8.1.3" }, { "type": "library", @@ -246,14 +230,6 @@ "scope": "required", "purl": "pkg:pypi/click-repl@0.2.0" }, - { - "type": "library", - "bom-ref": "pkg:pypi/click@8.1.3", - "name": "click", - "version": "8.1.3", - "scope": "required", - "purl": "pkg:pypi/click@8.1.3" - }, { "type": "library", "bom-ref": "pkg:pypi/cryptography", @@ -302,14 +278,6 @@ "scope": "required", "purl": "pkg:pypi/importlib-metadata" }, - { - "type": "library", - "bom-ref": "pkg:pypi/itsdangerous", - "name": "itsdangerous", - "version": "unknown", - "scope": "required", - "purl": "pkg:pypi/itsdangerous" - }, { "type": "library", "bom-ref": "pkg:pypi/itsdangerous@2.1.2", @@ -318,14 +286,6 @@ "scope": "required", "purl": "pkg:pypi/itsdangerous@2.1.2" }, - { - "type": "library", - "bom-ref": "pkg:pypi/jinja2", - "name": "jinja2", - "version": "unknown", - "scope": "required", - "purl": "pkg:pypi/jinja2" - }, { "type": "library", "bom-ref": "pkg:pypi/jinja2@3.1.2", @@ -342,14 +302,6 @@ "scope": "required", "purl": "pkg:pypi/kombu@5.2.4" }, - { - "type": "library", - "bom-ref": "pkg:pypi/markupsafe", - "name": "markupsafe", - "version": "unknown", - "scope": "required", - "purl": "pkg:pypi/markupsafe" - }, { "type": "library", "bom-ref": "pkg:pypi/markupsafe@2.1.2", @@ -534,14 +486,6 @@ "scope": "required", "purl": "pkg:pypi/wcwidth@0.2.6" }, - { - "type": "library", - "bom-ref": "pkg:pypi/werkzeug", - "name": "werkzeug", - "version": "unknown", - "scope": "required", - "purl": "pkg:pypi/werkzeug" - }, { "type": "library", "bom-ref": "pkg:pypi/werkzeug@2.3.3", @@ -568,26 +512,14 @@ "ref": "pkg:pypi/billiard@3.6.4.0", "dependsOn": [] }, - { - "ref": "pkg:pypi/blinker", - "dependsOn": [] - }, { "ref": "pkg:pypi/blinker@1.6.2", "dependsOn": [] }, - { - "ref": "pkg:pypi/celery", - "dependsOn": [] - }, { "ref": "pkg:pypi/celery@5.2.7", "dependsOn": [] }, - { - "ref": "pkg:pypi/click", - "dependsOn": [] - }, { "ref": "pkg:pypi/click-didyoumean@0.3.0", "dependsOn": [] @@ -619,7 +551,6 @@ "pkg:pypi/async-timeout@4.0.2", "pkg:pypi/billiard@3.6.4.0", "pkg:pypi/blinker@1.6.2", - "pkg:pypi/celery", "pkg:pypi/celery@5.2.7", "pkg:pypi/click-didyoumean@0.3.0", "pkg:pypi/click-plugins@1.1.1", @@ -648,15 +579,15 @@ "ref": "pkg:pypi/flask@3.1.3", "dependsOn": [ "pkg:pypi/asgiref", - "pkg:pypi/blinker", - "pkg:pypi/click", + "pkg:pypi/blinker@1.6.2", + "pkg:pypi/click@8.1.3", "pkg:pypi/cryptography", "pkg:pypi/gha-update", "pkg:pypi/greenlet", "pkg:pypi/importlib-metadata", - "pkg:pypi/itsdangerous", - "pkg:pypi/jinja2", - "pkg:pypi/markupsafe", + "pkg:pypi/itsdangerous@2.1.2", + "pkg:pypi/jinja2@3.1.2", + "pkg:pypi/markupsafe@2.1.2", "pkg:pypi/mypy", "pkg:pypi/pallets-sphinx-themes", "pkg:pypi/pre-commit", @@ -673,7 +604,7 @@ "pkg:pypi/tox-uv", "pkg:pypi/types-contextvars", "pkg:pypi/types-dataclasses", - "pkg:pypi/werkzeug" + "pkg:pypi/werkzeug@2.3.3" ] }, { @@ -695,18 +626,10 @@ "ref": "pkg:pypi/importlib-metadata", "dependsOn": [] }, - { - "ref": "pkg:pypi/itsdangerous", - "dependsOn": [] - }, { "ref": "pkg:pypi/itsdangerous@2.1.2", "dependsOn": [] }, - { - "ref": "pkg:pypi/jinja2", - "dependsOn": [] - }, { "ref": "pkg:pypi/jinja2@3.1.2", "dependsOn": [] @@ -722,10 +645,6 @@ "ref": "pkg:pypi/kombu@5.2.4", "dependsOn": [] }, - { - "ref": "pkg:pypi/markupsafe", - "dependsOn": [] - }, { "ref": "pkg:pypi/markupsafe@2.1.2", "dependsOn": [] @@ -818,10 +737,6 @@ "ref": "pkg:pypi/wcwidth@0.2.6", "dependsOn": [] }, - { - "ref": "pkg:pypi/werkzeug", - "dependsOn": [] - }, { "ref": "pkg:pypi/werkzeug@2.3.3", "dependsOn": [] diff --git a/examples/sbom/flask/sbom.spdx b/examples/sbom/flask/sbom.spdx index d5c1caa88..7e071f995 100644 --- a/examples/sbom/flask/sbom.spdx +++ b/examples/sbom/flask/sbom.spdx @@ -13,7 +13,7 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-23T22:12:15Z +Created: 2026-07-24T07:16:27Z ## Package Information PackageName: flask-example-celery SPDXID: SPDXRef-Package-1 @@ -1739,24 +1739,8 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information -PackageName: blinker -SPDXID: SPDXRef-Package-Dependency-6 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: celery -SPDXID: SPDXRef-Package-Dependency-7 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information PackageName: celery -SPDXID: SPDXRef-Package-Dependency-8 +SPDXID: SPDXRef-Package-Dependency-6 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1764,7 +1748,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: click -SPDXID: SPDXRef-Package-Dependency-9 +SPDXID: SPDXRef-Package-Dependency-7 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1772,7 +1756,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: click-didyoumean -SPDXID: SPDXRef-Package-Dependency-10 +SPDXID: SPDXRef-Package-Dependency-8 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1780,7 +1764,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: click-plugins -SPDXID: SPDXRef-Package-Dependency-11 +SPDXID: SPDXRef-Package-Dependency-9 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1788,15 +1772,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: click-repl -SPDXID: SPDXRef-Package-Dependency-12 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: click -SPDXID: SPDXRef-Package-Dependency-13 +SPDXID: SPDXRef-Package-Dependency-10 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1804,7 +1780,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: cryptography -SPDXID: SPDXRef-Package-Dependency-14 +SPDXID: SPDXRef-Package-Dependency-11 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1812,7 +1788,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: flask -SPDXID: SPDXRef-Package-Dependency-15 +SPDXID: SPDXRef-Package-Dependency-12 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1820,7 +1796,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: flask -SPDXID: SPDXRef-Package-Dependency-16 +SPDXID: SPDXRef-Package-Dependency-13 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1828,7 +1804,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: gha-update -SPDXID: SPDXRef-Package-Dependency-17 +SPDXID: SPDXRef-Package-Dependency-14 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1836,7 +1812,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: greenlet -SPDXID: SPDXRef-Package-Dependency-18 +SPDXID: SPDXRef-Package-Dependency-15 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1844,15 +1820,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: importlib-metadata -SPDXID: SPDXRef-Package-Dependency-19 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: itsdangerous -SPDXID: SPDXRef-Package-Dependency-20 +SPDXID: SPDXRef-Package-Dependency-16 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1860,15 +1828,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: itsdangerous -SPDXID: SPDXRef-Package-Dependency-21 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: jinja2 -SPDXID: SPDXRef-Package-Dependency-22 +SPDXID: SPDXRef-Package-Dependency-17 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1876,7 +1836,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: jinja2 -SPDXID: SPDXRef-Package-Dependency-23 +SPDXID: SPDXRef-Package-Dependency-18 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1884,15 +1844,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: kombu -SPDXID: SPDXRef-Package-Dependency-24 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: markupsafe -SPDXID: SPDXRef-Package-Dependency-25 +SPDXID: SPDXRef-Package-Dependency-19 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1900,7 +1852,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: markupsafe -SPDXID: SPDXRef-Package-Dependency-26 +SPDXID: SPDXRef-Package-Dependency-20 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1908,7 +1860,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: mypy -SPDXID: SPDXRef-Package-Dependency-27 +SPDXID: SPDXRef-Package-Dependency-21 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1916,7 +1868,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: pallets-sphinx-themes -SPDXID: SPDXRef-Package-Dependency-28 +SPDXID: SPDXRef-Package-Dependency-22 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1924,7 +1876,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: pre-commit -SPDXID: SPDXRef-Package-Dependency-29 +SPDXID: SPDXRef-Package-Dependency-23 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1932,7 +1884,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: pre-commit-uv -SPDXID: SPDXRef-Package-Dependency-30 +SPDXID: SPDXRef-Package-Dependency-24 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1940,7 +1892,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: prompt-toolkit -SPDXID: SPDXRef-Package-Dependency-31 +SPDXID: SPDXRef-Package-Dependency-25 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1948,7 +1900,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: pyright -SPDXID: SPDXRef-Package-Dependency-32 +SPDXID: SPDXRef-Package-Dependency-26 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1956,7 +1908,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: pytest -SPDXID: SPDXRef-Package-Dependency-33 +SPDXID: SPDXRef-Package-Dependency-27 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1964,7 +1916,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: python-dotenv -SPDXID: SPDXRef-Package-Dependency-34 +SPDXID: SPDXRef-Package-Dependency-28 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1972,7 +1924,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: pytz -SPDXID: SPDXRef-Package-Dependency-35 +SPDXID: SPDXRef-Package-Dependency-29 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1980,7 +1932,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: redis -SPDXID: SPDXRef-Package-Dependency-36 +SPDXID: SPDXRef-Package-Dependency-30 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1988,7 +1940,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: ruff -SPDXID: SPDXRef-Package-Dependency-37 +SPDXID: SPDXRef-Package-Dependency-31 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1996,7 +1948,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: six -SPDXID: SPDXRef-Package-Dependency-38 +SPDXID: SPDXRef-Package-Dependency-32 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2004,7 +1956,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: sphinx -SPDXID: SPDXRef-Package-Dependency-39 +SPDXID: SPDXRef-Package-Dependency-33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2012,7 +1964,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: sphinx-autobuild -SPDXID: SPDXRef-Package-Dependency-40 +SPDXID: SPDXRef-Package-Dependency-34 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2020,7 +1972,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: sphinx-tabs -SPDXID: SPDXRef-Package-Dependency-41 +SPDXID: SPDXRef-Package-Dependency-35 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2028,7 +1980,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: sphinxcontrib-log-cabinet -SPDXID: SPDXRef-Package-Dependency-42 +SPDXID: SPDXRef-Package-Dependency-36 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2036,7 +1988,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: tox -SPDXID: SPDXRef-Package-Dependency-43 +SPDXID: SPDXRef-Package-Dependency-37 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2044,7 +1996,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: tox-uv -SPDXID: SPDXRef-Package-Dependency-44 +SPDXID: SPDXRef-Package-Dependency-38 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2052,7 +2004,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: types-contextvars -SPDXID: SPDXRef-Package-Dependency-45 +SPDXID: SPDXRef-Package-Dependency-39 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2060,7 +2012,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: types-dataclasses -SPDXID: SPDXRef-Package-Dependency-46 +SPDXID: SPDXRef-Package-Dependency-40 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2068,7 +2020,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: vine -SPDXID: SPDXRef-Package-Dependency-47 +SPDXID: SPDXRef-Package-Dependency-41 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2076,15 +2028,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: wcwidth -SPDXID: SPDXRef-Package-Dependency-48 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: werkzeug -SPDXID: SPDXRef-Package-Dependency-49 +SPDXID: SPDXRef-Package-Dependency-42 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2092,7 +2036,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: werkzeug -SPDXID: SPDXRef-Package-Dependency-50 +SPDXID: SPDXRef-Package-Dependency-43 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2338,58 +2282,57 @@ Relationship: SPDXRef-Package-unassigned CONTAINS SPDXRef-231 Relationship: SPDXRef-Package-unassigned CONTAINS SPDXRef-232 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-1 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-10 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-11 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-12 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-13 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-15 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-16 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-21 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-23 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-24 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-26 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-17 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-18 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-19 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-20 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-25 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-29 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-3 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-31 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-36 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-38 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-30 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-32 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-4 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-47 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-48 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-50 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-41 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-42 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-43 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-5 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-6 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-7 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-9 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-11 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-14 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-15 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-16 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-17 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-18 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-19 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-2 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-20 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-21 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-22 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-25 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-23 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-24 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-26 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-27 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-28 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-29 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-30 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-31 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-33 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-35 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-36 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-37 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-38 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-39 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-40 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-41 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-42 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-43 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-44 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-45 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-46 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-49 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-5 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-15 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-33 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-15 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-7 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-12 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-27 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-12 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-27 ## License Information LicenseID: LicenseRef-scancode-unknown-license-reference ExtractedText: See details at https://github.com/aboutcode-org/scancode-toolkit/tree/develop/src/licensedcode/data/rules/unknown-license-reference_see_license_at_manifest_2.RULE diff --git a/examples/sbom/ripgrep/README.md b/examples/sbom/ripgrep/README.md index aec7b044b..b3afa5fef 100644 --- a/examples/sbom/ripgrep/README.md +++ b/examples/sbom/ripgrep/README.md @@ -11,8 +11,8 @@ SPDX tag-value ([`sbom.spdx`](sbom.spdx)) and CycloneDX JSON ([`sbom.cdx.json`]( ## What's inside -- **114 components** — the project plus every resolved dependency, each with a package URL (purl). -- **149 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). +- **91 components** — the project plus every resolved dependency, each with a package URL (purl). +- **140 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). ## How it compares diff --git a/examples/sbom/ripgrep/sbom.cdx.json b/examples/sbom/ripgrep/sbom.cdx.json index b477e2d9d..107434b24 100644 --- a/examples/sbom/ripgrep/sbom.cdx.json +++ b/examples/sbom/ripgrep/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:25e50a03-8450-46b0-b06a-42b0ff0b606c", + "serialNumber": "urn:uuid:c56f4fa9-9afd-454b-8af9-081122de0c1f", "version": 1, "metadata": { - "timestamp": "2026-07-23T22:12:12Z", + "timestamp": "2026-07-24T07:16:23Z", "tools": [ { "name": "Provenant", @@ -462,19 +462,12 @@ "version": "1.1.4", "purl": "pkg:cargo/aho-corasick@1.1.4" }, - { - "type": "library", - "bom-ref": "pkg:cargo/anyhow", - "name": "anyhow", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/anyhow" - }, { "type": "library", "bom-ref": "pkg:cargo/anyhow@1.0.103", "name": "anyhow", "version": "1.0.103", + "scope": "required", "purl": "pkg:cargo/anyhow@1.0.103" }, { @@ -542,34 +535,20 @@ "version": "1.0.4", "purl": "pkg:cargo/cfg-if@1.0.4" }, - { - "type": "library", - "bom-ref": "pkg:cargo/crossbeam-channel", - "name": "crossbeam-channel", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/crossbeam-channel" - }, { "type": "library", "bom-ref": "pkg:cargo/crossbeam-channel@0.5.16", "name": "crossbeam-channel", "version": "0.5.16", - "purl": "pkg:cargo/crossbeam-channel@0.5.16" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/crossbeam-deque", - "name": "crossbeam-deque", - "version": "unknown", "scope": "required", - "purl": "pkg:cargo/crossbeam-deque" + "purl": "pkg:cargo/crossbeam-channel@0.5.16" }, { "type": "library", "bom-ref": "pkg:cargo/crossbeam-deque@0.8.7", "name": "crossbeam-deque", "version": "0.8.7", + "scope": "required", "purl": "pkg:cargo/crossbeam-deque@0.8.7" }, { @@ -600,34 +579,20 @@ "version": "1.4.2", "purl": "pkg:cargo/derive_arbitrary@1.4.2" }, - { - "type": "library", - "bom-ref": "pkg:cargo/encoding_rs", - "name": "encoding_rs", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/encoding_rs" - }, { "type": "library", "bom-ref": "pkg:cargo/encoding_rs@0.8.35", "name": "encoding_rs", "version": "0.8.35", - "purl": "pkg:cargo/encoding_rs@0.8.35" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/encoding_rs_io", - "name": "encoding_rs_io", - "version": "unknown", "scope": "required", - "purl": "pkg:cargo/encoding_rs_io" + "purl": "pkg:cargo/encoding_rs@0.8.35" }, { "type": "library", "bom-ref": "pkg:cargo/encoding_rs_io@0.1.7", "name": "encoding_rs_io", "version": "0.1.7", + "scope": "required", "purl": "pkg:cargo/encoding_rs_io@0.1.7" }, { @@ -644,19 +609,12 @@ "version": "0.4.3", "purl": "pkg:cargo/getrandom@0.4.3" }, - { - "type": "library", - "bom-ref": "pkg:cargo/glob", - "name": "glob", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/glob" - }, { "type": "library", "bom-ref": "pkg:cargo/glob@0.3.3", "name": "glob", "version": "0.3.3", + "scope": "required", "purl": "pkg:cargo/glob@0.3.3" }, { @@ -674,70 +632,6 @@ "version": "0.4.16", "purl": "pkg:cargo/globset@0.4.16" }, - { - "type": "library", - "bom-ref": "pkg:cargo/grep", - "name": "grep", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/grep" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/grep-cli", - "name": "grep-cli", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/grep-cli" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/grep-matcher", - "name": "grep-matcher", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/grep-matcher" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/grep-pcre2", - "name": "grep-pcre2", - "version": "unknown", - "scope": "optional", - "purl": "pkg:cargo/grep-pcre2" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/grep-printer", - "name": "grep-printer", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/grep-printer" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/grep-regex", - "name": "grep-regex", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/grep-regex" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/grep-searcher", - "name": "grep-searcher", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/grep-searcher" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/ignore", - "name": "ignore", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/ignore" - }, { "type": "library", "bom-ref": "pkg:cargo/itoa@1.0.18", @@ -759,19 +653,12 @@ "version": "0.1.35", "purl": "pkg:cargo/jobserver@0.1.35" }, - { - "type": "library", - "bom-ref": "pkg:cargo/lexopt", - "name": "lexopt", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/lexopt" - }, { "type": "library", "bom-ref": "pkg:cargo/lexopt@0.3.2", "name": "lexopt", "version": "0.3.2", + "scope": "required", "purl": "pkg:cargo/lexopt@0.3.2" }, { @@ -788,19 +675,12 @@ "version": "0.2.186", "purl": "pkg:cargo/libc@0.2.186" }, - { - "type": "library", - "bom-ref": "pkg:cargo/libfuzzer-sys", - "name": "libfuzzer-sys", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/libfuzzer-sys" - }, { "type": "library", "bom-ref": "pkg:cargo/libfuzzer-sys@0.4.7", "name": "libfuzzer-sys", "version": "0.4.7", + "scope": "required", "purl": "pkg:cargo/libfuzzer-sys@0.4.7" }, { @@ -871,11 +751,11 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/pcre2", + "bom-ref": "pkg:cargo/pcre2@0.2.11", "name": "pcre2", - "version": "unknown", + "version": "0.2.11", "scope": "required", - "purl": "pkg:cargo/pcre2" + "purl": "pkg:cargo/pcre2@0.2.11" }, { "type": "library", @@ -884,13 +764,6 @@ "version": "0.2.10", "purl": "pkg:cargo/pcre2-sys@0.2.10" }, - { - "type": "library", - "bom-ref": "pkg:cargo/pcre2@0.2.11", - "name": "pcre2", - "version": "0.2.11", - "purl": "pkg:cargo/pcre2@0.2.11" - }, { "type": "library", "bom-ref": "pkg:cargo/pkg-config@0.3.33", @@ -935,11 +808,11 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/regex", + "bom-ref": "pkg:cargo/regex@1.13.0", "name": "regex", - "version": "unknown", + "version": "1.13.0", "scope": "required", - "purl": "pkg:cargo/regex" + "purl": "pkg:cargo/regex@1.13.0" }, { "type": "library", @@ -985,26 +858,12 @@ "version": "0.8.2", "purl": "pkg:cargo/regex-syntax@0.8.2" }, - { - "type": "library", - "bom-ref": "pkg:cargo/regex@1.13.0", - "name": "regex", - "version": "1.13.0", - "purl": "pkg:cargo/regex@1.13.0" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/same-file", - "name": "same-file", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/same-file" - }, { "type": "library", "bom-ref": "pkg:cargo/same-file@1.0.6", "name": "same-file", "version": "1.0.6", + "scope": "required", "purl": "pkg:cargo/same-file@1.0.6" }, { @@ -1058,19 +917,12 @@ "version": "1.0.228", "purl": "pkg:cargo/serde_derive@1.0.228" }, - { - "type": "library", - "bom-ref": "pkg:cargo/serde_json", - "name": "serde_json", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/serde_json" - }, { "type": "library", "bom-ref": "pkg:cargo/serde_json@1.0.150", "name": "serde_json", "version": "1.0.150", + "scope": "required", "purl": "pkg:cargo/serde_json@1.0.150" }, { @@ -1094,34 +946,20 @@ "version": "2.0.48", "purl": "pkg:cargo/syn@2.0.48" }, - { - "type": "library", - "bom-ref": "pkg:cargo/termcolor", - "name": "termcolor", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/termcolor" - }, { "type": "library", "bom-ref": "pkg:cargo/termcolor@1.4.1", "name": "termcolor", "version": "1.4.1", - "purl": "pkg:cargo/termcolor@1.4.1" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/textwrap", - "name": "textwrap", - "version": "unknown", "scope": "required", - "purl": "pkg:cargo/textwrap" + "purl": "pkg:cargo/termcolor@1.4.1" }, { "type": "library", "bom-ref": "pkg:cargo/textwrap@0.16.2", "name": "textwrap", "version": "0.16.2", + "scope": "required", "purl": "pkg:cargo/textwrap@0.16.2" }, { @@ -1152,19 +990,12 @@ "version": "1.0.24", "purl": "pkg:cargo/unicode-ident@1.0.24" }, - { - "type": "library", - "bom-ref": "pkg:cargo/walkdir", - "name": "walkdir", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/walkdir" - }, { "type": "library", "bom-ref": "pkg:cargo/walkdir@2.5.0", "name": "walkdir", "version": "2.5.0", + "scope": "required", "purl": "pkg:cargo/walkdir@2.5.0" }, { @@ -1209,10 +1040,6 @@ "ref": "pkg:cargo/aho-corasick@1.1.4", "dependsOn": [] }, - { - "ref": "pkg:cargo/anyhow", - "dependsOn": [] - }, { "ref": "pkg:cargo/anyhow@1.0.103", "dependsOn": [] @@ -1253,18 +1080,10 @@ "ref": "pkg:cargo/cfg-if@1.0.4", "dependsOn": [] }, - { - "ref": "pkg:cargo/crossbeam-channel", - "dependsOn": [] - }, { "ref": "pkg:cargo/crossbeam-channel@0.5.16", "dependsOn": [] }, - { - "ref": "pkg:cargo/crossbeam-deque", - "dependsOn": [] - }, { "ref": "pkg:cargo/crossbeam-deque@0.8.7", "dependsOn": [] @@ -1285,18 +1104,10 @@ "ref": "pkg:cargo/derive_arbitrary@1.4.2", "dependsOn": [] }, - { - "ref": "pkg:cargo/encoding_rs", - "dependsOn": [] - }, { "ref": "pkg:cargo/encoding_rs@0.8.35", "dependsOn": [] }, - { - "ref": "pkg:cargo/encoding_rs_io", - "dependsOn": [] - }, { "ref": "pkg:cargo/encoding_rs_io@0.1.7", "dependsOn": [] @@ -1317,7 +1128,6 @@ "pkg:cargo/globset@0.4.16", "pkg:cargo/jobserver@0.1.27", "pkg:cargo/libc@0.2.152", - "pkg:cargo/libfuzzer-sys", "pkg:cargo/libfuzzer-sys@0.4.7", "pkg:cargo/log@0.4.20", "pkg:cargo/memchr@2.7.1", @@ -1336,10 +1146,6 @@ "ref": "pkg:cargo/getrandom@0.4.3", "dependsOn": [] }, - { - "ref": "pkg:cargo/glob", - "dependsOn": [] - }, { "ref": "pkg:cargo/glob@0.3.3", "dependsOn": [] @@ -1358,132 +1164,100 @@ "pkg:cargo/aho-corasick", "pkg:cargo/arbitrary", "pkg:cargo/bstr", - "pkg:cargo/glob", + "pkg:cargo/glob@0.3.3", "pkg:cargo/log", "pkg:cargo/regex-automata", "pkg:cargo/regex-syntax", "pkg:cargo/serde", - "pkg:cargo/serde_json" + "pkg:cargo/serde_json@1.0.150" ] }, - { - "ref": "pkg:cargo/grep", - "dependsOn": [] - }, - { - "ref": "pkg:cargo/grep-cli", - "dependsOn": [] - }, { "ref": "pkg:cargo/grep-cli@0.1.12", "dependsOn": [ "pkg:cargo/bstr", "pkg:cargo/globset", "pkg:cargo/log", - "pkg:cargo/termcolor" + "pkg:cargo/termcolor@1.4.1" ] }, - { - "ref": "pkg:cargo/grep-matcher", - "dependsOn": [] - }, { "ref": "pkg:cargo/grep-matcher@0.1.9", "dependsOn": [ "pkg:cargo/memchr", - "pkg:cargo/regex" + "pkg:cargo/regex@1.13.0" ] }, - { - "ref": "pkg:cargo/grep-pcre2", - "dependsOn": [] - }, { "ref": "pkg:cargo/grep-pcre2@0.1.10", "dependsOn": [ - "pkg:cargo/grep-matcher", + "pkg:cargo/grep-matcher@0.1.9", "pkg:cargo/log", - "pkg:cargo/pcre2" + "pkg:cargo/pcre2@0.2.11" ] }, - { - "ref": "pkg:cargo/grep-printer", - "dependsOn": [] - }, { "ref": "pkg:cargo/grep-printer@0.3.1", "dependsOn": [ "pkg:cargo/bstr", - "pkg:cargo/grep-matcher", - "pkg:cargo/grep-regex", - "pkg:cargo/grep-searcher", + "pkg:cargo/grep-matcher@0.1.9", + "pkg:cargo/grep-regex@0.1.14", + "pkg:cargo/grep-searcher@0.1.17", "pkg:cargo/log", "pkg:cargo/serde", - "pkg:cargo/serde_json", - "pkg:cargo/termcolor" + "pkg:cargo/serde_json@1.0.150", + "pkg:cargo/termcolor@1.4.1" ] }, - { - "ref": "pkg:cargo/grep-regex", - "dependsOn": [] - }, { "ref": "pkg:cargo/grep-regex@0.1.14", "dependsOn": [ "pkg:cargo/bstr", - "pkg:cargo/grep-matcher", + "pkg:cargo/grep-matcher@0.1.9", "pkg:cargo/log", "pkg:cargo/regex-automata", "pkg:cargo/regex-syntax" ] }, - { - "ref": "pkg:cargo/grep-searcher", - "dependsOn": [] - }, { "ref": "pkg:cargo/grep-searcher@0.1.17", "dependsOn": [ "pkg:cargo/bstr", - "pkg:cargo/encoding_rs", - "pkg:cargo/encoding_rs_io", - "pkg:cargo/grep-matcher", - "pkg:cargo/grep-regex", + "pkg:cargo/encoding_rs@0.8.35", + "pkg:cargo/encoding_rs_io@0.1.7", + "pkg:cargo/grep-matcher@0.1.9", + "pkg:cargo/grep-regex@0.1.14", "pkg:cargo/log", "pkg:cargo/memchr", "pkg:cargo/memmap", - "pkg:cargo/regex" + "pkg:cargo/regex@1.13.0" ] }, { "ref": "pkg:cargo/grep@0.4.1", "dependsOn": [ - "pkg:cargo/grep-cli", - "pkg:cargo/grep-matcher", - "pkg:cargo/grep-pcre2", - "pkg:cargo/grep-printer", - "pkg:cargo/grep-regex", - "pkg:cargo/grep-searcher", - "pkg:cargo/termcolor", - "pkg:cargo/walkdir" + "pkg:cargo/grep-cli@0.1.12", + "pkg:cargo/grep-matcher@0.1.9", + "pkg:cargo/grep-pcre2@0.1.10", + "pkg:cargo/grep-printer@0.3.1", + "pkg:cargo/grep-regex@0.1.14", + "pkg:cargo/grep-searcher@0.1.17", + "pkg:cargo/termcolor@1.4.1", + "pkg:cargo/walkdir@2.5.0" ] }, - { - "ref": "pkg:cargo/ignore", - "dependsOn": [] - }, { "ref": "pkg:cargo/ignore@0.4.29", "dependsOn": [ "pkg:cargo/bstr", - "pkg:cargo/crossbeam-channel", - "pkg:cargo/crossbeam-deque", + "pkg:cargo/crossbeam-channel@0.5.16", + "pkg:cargo/crossbeam-deque@0.8.7", "pkg:cargo/globset", "pkg:cargo/log", "pkg:cargo/memchr", "pkg:cargo/regex-automata", - "pkg:cargo/same-file", - "pkg:cargo/walkdir" + "pkg:cargo/same-file@1.0.6", + "pkg:cargo/walkdir@2.5.0" ] }, { @@ -1498,10 +1272,6 @@ "ref": "pkg:cargo/jobserver@0.1.35", "dependsOn": [] }, - { - "ref": "pkg:cargo/lexopt", - "dependsOn": [] - }, { "ref": "pkg:cargo/lexopt@0.3.2", "dependsOn": [] @@ -1514,10 +1284,6 @@ "ref": "pkg:cargo/libc@0.2.186", "dependsOn": [] }, - { - "ref": "pkg:cargo/libfuzzer-sys", - "dependsOn": [] - }, { "ref": "pkg:cargo/libfuzzer-sys@0.4.7", "dependsOn": [] @@ -1558,10 +1324,6 @@ "ref": "pkg:cargo/once_cell@1.19.0", "dependsOn": [] }, - { - "ref": "pkg:cargo/pcre2", - "dependsOn": [] - }, { "ref": "pkg:cargo/pcre2-sys@0.2.10", "dependsOn": [] @@ -1594,10 +1356,6 @@ "ref": "pkg:cargo/r-efi@6.0.0", "dependsOn": [] }, - { - "ref": "pkg:cargo/regex", - "dependsOn": [] - }, { "ref": "pkg:cargo/regex-automata", "dependsOn": [] @@ -1630,7 +1388,6 @@ "ref": "pkg:cargo/ripgrep@15.2.0", "dependsOn": [ "pkg:cargo/aho-corasick@1.1.4", - "pkg:cargo/anyhow", "pkg:cargo/anyhow@1.0.103", "pkg:cargo/arbitrary@1.4.2", "pkg:cargo/bstr", @@ -1648,7 +1405,6 @@ "pkg:cargo/getrandom@0.4.3", "pkg:cargo/glob@0.3.3", "pkg:cargo/globset@0.4.19", - "pkg:cargo/grep", "pkg:cargo/grep-cli@0.1.12", "pkg:cargo/grep-matcher@0.1.9", "pkg:cargo/grep-pcre2@0.1.10", @@ -1656,11 +1412,9 @@ "pkg:cargo/grep-regex@0.1.14", "pkg:cargo/grep-searcher@0.1.17", "pkg:cargo/grep@0.4.1", - "pkg:cargo/ignore", "pkg:cargo/ignore@0.4.29", "pkg:cargo/itoa@1.0.18", "pkg:cargo/jobserver@0.1.35", - "pkg:cargo/lexopt", "pkg:cargo/lexopt@0.3.2", "pkg:cargo/libc@0.2.186", "pkg:cargo/log", @@ -1682,18 +1436,14 @@ "pkg:cargo/serde_core@1.0.228", "pkg:cargo/serde_derive", "pkg:cargo/serde_derive@1.0.228", - "pkg:cargo/serde_json", "pkg:cargo/serde_json@1.0.150", "pkg:cargo/shlex@2.0.1", "pkg:cargo/syn@2.0.119", - "pkg:cargo/termcolor", "pkg:cargo/termcolor@1.4.1", - "pkg:cargo/textwrap", "pkg:cargo/textwrap@0.16.2", "pkg:cargo/tikv-jemalloc-sys@0.7.1%2B5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8", "pkg:cargo/tikv-jemallocator@0.7.0", "pkg:cargo/unicode-ident@1.0.24", - "pkg:cargo/walkdir", "pkg:cargo/walkdir@2.5.0", "pkg:cargo/winapi-util@0.1.11", "pkg:cargo/windows-link@0.2.1", @@ -1701,10 +1451,6 @@ "pkg:cargo/zmij@1.0.23" ] }, - { - "ref": "pkg:cargo/same-file", - "dependsOn": [] - }, { "ref": "pkg:cargo/same-file@1.0.6", "dependsOn": [] @@ -1737,10 +1483,6 @@ "ref": "pkg:cargo/serde_derive@1.0.228", "dependsOn": [] }, - { - "ref": "pkg:cargo/serde_json", - "dependsOn": [] - }, { "ref": "pkg:cargo/serde_json@1.0.150", "dependsOn": [] @@ -1757,18 +1499,10 @@ "ref": "pkg:cargo/syn@2.0.48", "dependsOn": [] }, - { - "ref": "pkg:cargo/termcolor", - "dependsOn": [] - }, { "ref": "pkg:cargo/termcolor@1.4.1", "dependsOn": [] }, - { - "ref": "pkg:cargo/textwrap", - "dependsOn": [] - }, { "ref": "pkg:cargo/textwrap@0.16.2", "dependsOn": [] @@ -1789,10 +1523,6 @@ "ref": "pkg:cargo/unicode-ident@1.0.24", "dependsOn": [] }, - { - "ref": "pkg:cargo/walkdir", - "dependsOn": [] - }, { "ref": "pkg:cargo/walkdir@2.5.0", "dependsOn": [] diff --git a/examples/sbom/ripgrep/sbom.spdx b/examples/sbom/ripgrep/sbom.spdx index 3246e378e..693376e48 100644 --- a/examples/sbom/ripgrep/sbom.spdx +++ b/examples/sbom/ripgrep/sbom.spdx @@ -13,7 +13,7 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-23T22:12:12Z +Created: 2026-07-24T07:16:22Z ## Package Information PackageName: fuzz SPDXID: SPDXRef-Package-1 @@ -1748,7 +1748,7 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information -PackageName: anyhow +PackageName: arbitrary SPDXID: SPDXRef-Package-Dependency-5 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false @@ -1772,7 +1772,7 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information -PackageName: arbitrary +PackageName: bstr SPDXID: SPDXRef-Package-Dependency-8 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false @@ -1796,7 +1796,7 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information -PackageName: bstr +PackageName: cc SPDXID: SPDXRef-Package-Dependency-11 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false @@ -1812,24 +1812,8 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information -PackageName: cc -SPDXID: SPDXRef-Package-Dependency-13 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information PackageName: cfg-if -SPDXID: SPDXRef-Package-Dependency-14 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: crossbeam-channel -SPDXID: SPDXRef-Package-Dependency-15 +SPDXID: SPDXRef-Package-Dependency-13 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1837,15 +1821,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: crossbeam-channel -SPDXID: SPDXRef-Package-Dependency-16 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: crossbeam-deque -SPDXID: SPDXRef-Package-Dependency-17 +SPDXID: SPDXRef-Package-Dependency-14 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1853,7 +1829,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: crossbeam-deque -SPDXID: SPDXRef-Package-Dependency-18 +SPDXID: SPDXRef-Package-Dependency-15 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1861,7 +1837,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: crossbeam-epoch -SPDXID: SPDXRef-Package-Dependency-19 +SPDXID: SPDXRef-Package-Dependency-16 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1869,7 +1845,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: crossbeam-utils -SPDXID: SPDXRef-Package-Dependency-20 +SPDXID: SPDXRef-Package-Dependency-17 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1877,7 +1853,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: derive_arbitrary -SPDXID: SPDXRef-Package-Dependency-21 +SPDXID: SPDXRef-Package-Dependency-18 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1885,15 +1861,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: derive_arbitrary -SPDXID: SPDXRef-Package-Dependency-22 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: encoding_rs -SPDXID: SPDXRef-Package-Dependency-23 +SPDXID: SPDXRef-Package-Dependency-19 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1901,15 +1869,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: encoding_rs -SPDXID: SPDXRef-Package-Dependency-24 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: encoding_rs_io -SPDXID: SPDXRef-Package-Dependency-25 +SPDXID: SPDXRef-Package-Dependency-20 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1917,7 +1877,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: encoding_rs_io -SPDXID: SPDXRef-Package-Dependency-26 +SPDXID: SPDXRef-Package-Dependency-21 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1925,7 +1885,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: find-msvc-tools -SPDXID: SPDXRef-Package-Dependency-27 +SPDXID: SPDXRef-Package-Dependency-22 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1933,15 +1893,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: getrandom -SPDXID: SPDXRef-Package-Dependency-28 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: glob -SPDXID: SPDXRef-Package-Dependency-29 +SPDXID: SPDXRef-Package-Dependency-23 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1949,7 +1901,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: glob -SPDXID: SPDXRef-Package-Dependency-30 +SPDXID: SPDXRef-Package-Dependency-24 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1957,7 +1909,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: globset -SPDXID: SPDXRef-Package-Dependency-31 +SPDXID: SPDXRef-Package-Dependency-25 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -1965,71 +1917,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: globset -SPDXID: SPDXRef-Package-Dependency-32 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: grep -SPDXID: SPDXRef-Package-Dependency-33 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: grep-cli -SPDXID: SPDXRef-Package-Dependency-34 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: grep-matcher -SPDXID: SPDXRef-Package-Dependency-35 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: grep-pcre2 -SPDXID: SPDXRef-Package-Dependency-36 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: grep-printer -SPDXID: SPDXRef-Package-Dependency-37 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: grep-regex -SPDXID: SPDXRef-Package-Dependency-38 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: grep-searcher -SPDXID: SPDXRef-Package-Dependency-39 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: ignore -SPDXID: SPDXRef-Package-Dependency-40 +SPDXID: SPDXRef-Package-Dependency-26 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2037,7 +1925,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: itoa -SPDXID: SPDXRef-Package-Dependency-41 +SPDXID: SPDXRef-Package-Dependency-27 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2045,7 +1933,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: jobserver -SPDXID: SPDXRef-Package-Dependency-42 +SPDXID: SPDXRef-Package-Dependency-28 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2053,15 +1941,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: jobserver -SPDXID: SPDXRef-Package-Dependency-43 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: lexopt -SPDXID: SPDXRef-Package-Dependency-44 +SPDXID: SPDXRef-Package-Dependency-29 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2069,7 +1949,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: lexopt -SPDXID: SPDXRef-Package-Dependency-45 +SPDXID: SPDXRef-Package-Dependency-30 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2077,7 +1957,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: libc -SPDXID: SPDXRef-Package-Dependency-46 +SPDXID: SPDXRef-Package-Dependency-31 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2085,15 +1965,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: libc -SPDXID: SPDXRef-Package-Dependency-47 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: libfuzzer-sys -SPDXID: SPDXRef-Package-Dependency-48 +SPDXID: SPDXRef-Package-Dependency-32 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2101,7 +1973,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: libfuzzer-sys -SPDXID: SPDXRef-Package-Dependency-49 +SPDXID: SPDXRef-Package-Dependency-33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2109,7 +1981,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: log -SPDXID: SPDXRef-Package-Dependency-50 +SPDXID: SPDXRef-Package-Dependency-34 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2117,7 +1989,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: log -SPDXID: SPDXRef-Package-Dependency-51 +SPDXID: SPDXRef-Package-Dependency-35 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2125,7 +1997,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: log -SPDXID: SPDXRef-Package-Dependency-52 +SPDXID: SPDXRef-Package-Dependency-36 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2133,7 +2005,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: memchr -SPDXID: SPDXRef-Package-Dependency-53 +SPDXID: SPDXRef-Package-Dependency-37 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2141,7 +2013,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: memchr -SPDXID: SPDXRef-Package-Dependency-54 +SPDXID: SPDXRef-Package-Dependency-38 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2149,7 +2021,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: memchr -SPDXID: SPDXRef-Package-Dependency-55 +SPDXID: SPDXRef-Package-Dependency-39 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2157,7 +2029,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: memmap -SPDXID: SPDXRef-Package-Dependency-56 +SPDXID: SPDXRef-Package-Dependency-40 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2165,7 +2037,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: memmap2 -SPDXID: SPDXRef-Package-Dependency-57 +SPDXID: SPDXRef-Package-Dependency-41 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2173,7 +2045,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: once_cell -SPDXID: SPDXRef-Package-Dependency-58 +SPDXID: SPDXRef-Package-Dependency-42 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2181,7 +2053,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: pcre2 -SPDXID: SPDXRef-Package-Dependency-59 +SPDXID: SPDXRef-Package-Dependency-43 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2189,15 +2061,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: pcre2-sys -SPDXID: SPDXRef-Package-Dependency-60 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: pcre2 -SPDXID: SPDXRef-Package-Dependency-61 +SPDXID: SPDXRef-Package-Dependency-44 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2205,7 +2069,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: pkg-config -SPDXID: SPDXRef-Package-Dependency-62 +SPDXID: SPDXRef-Package-Dependency-45 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2213,7 +2077,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: proc-macro2 -SPDXID: SPDXRef-Package-Dependency-63 +SPDXID: SPDXRef-Package-Dependency-46 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2221,7 +2085,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: proc-macro2 -SPDXID: SPDXRef-Package-Dependency-64 +SPDXID: SPDXRef-Package-Dependency-47 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2229,7 +2093,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: quote -SPDXID: SPDXRef-Package-Dependency-65 +SPDXID: SPDXRef-Package-Dependency-48 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2237,7 +2101,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: quote -SPDXID: SPDXRef-Package-Dependency-66 +SPDXID: SPDXRef-Package-Dependency-49 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2245,7 +2109,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: r-efi -SPDXID: SPDXRef-Package-Dependency-67 +SPDXID: SPDXRef-Package-Dependency-50 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2253,7 +2117,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: regex -SPDXID: SPDXRef-Package-Dependency-68 +SPDXID: SPDXRef-Package-Dependency-51 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2261,7 +2125,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: regex-automata -SPDXID: SPDXRef-Package-Dependency-69 +SPDXID: SPDXRef-Package-Dependency-52 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2269,7 +2133,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: regex-automata -SPDXID: SPDXRef-Package-Dependency-70 +SPDXID: SPDXRef-Package-Dependency-53 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2277,7 +2141,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: regex-automata -SPDXID: SPDXRef-Package-Dependency-71 +SPDXID: SPDXRef-Package-Dependency-54 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2285,7 +2149,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: regex-syntax -SPDXID: SPDXRef-Package-Dependency-72 +SPDXID: SPDXRef-Package-Dependency-55 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2293,7 +2157,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: regex-syntax -SPDXID: SPDXRef-Package-Dependency-73 +SPDXID: SPDXRef-Package-Dependency-56 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2301,23 +2165,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: regex-syntax -SPDXID: SPDXRef-Package-Dependency-74 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: regex -SPDXID: SPDXRef-Package-Dependency-75 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: same-file -SPDXID: SPDXRef-Package-Dependency-76 +SPDXID: SPDXRef-Package-Dependency-57 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2325,7 +2173,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: same-file -SPDXID: SPDXRef-Package-Dependency-77 +SPDXID: SPDXRef-Package-Dependency-58 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2333,7 +2181,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: serde -SPDXID: SPDXRef-Package-Dependency-78 +SPDXID: SPDXRef-Package-Dependency-59 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2341,7 +2189,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: serde -SPDXID: SPDXRef-Package-Dependency-79 +SPDXID: SPDXRef-Package-Dependency-60 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2349,7 +2197,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: serde -SPDXID: SPDXRef-Package-Dependency-80 +SPDXID: SPDXRef-Package-Dependency-61 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2357,7 +2205,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: serde_core -SPDXID: SPDXRef-Package-Dependency-81 +SPDXID: SPDXRef-Package-Dependency-62 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2365,7 +2213,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: serde_derive -SPDXID: SPDXRef-Package-Dependency-82 +SPDXID: SPDXRef-Package-Dependency-63 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2373,7 +2221,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: serde_derive -SPDXID: SPDXRef-Package-Dependency-83 +SPDXID: SPDXRef-Package-Dependency-64 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2381,15 +2229,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: serde_derive -SPDXID: SPDXRef-Package-Dependency-84 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: serde_json -SPDXID: SPDXRef-Package-Dependency-85 +SPDXID: SPDXRef-Package-Dependency-65 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2397,7 +2237,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: serde_json -SPDXID: SPDXRef-Package-Dependency-86 +SPDXID: SPDXRef-Package-Dependency-66 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2405,7 +2245,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: shlex -SPDXID: SPDXRef-Package-Dependency-87 +SPDXID: SPDXRef-Package-Dependency-67 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2413,7 +2253,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: syn -SPDXID: SPDXRef-Package-Dependency-88 +SPDXID: SPDXRef-Package-Dependency-68 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2421,15 +2261,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: syn -SPDXID: SPDXRef-Package-Dependency-89 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: termcolor -SPDXID: SPDXRef-Package-Dependency-90 +SPDXID: SPDXRef-Package-Dependency-69 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2437,15 +2269,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: termcolor -SPDXID: SPDXRef-Package-Dependency-91 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: textwrap -SPDXID: SPDXRef-Package-Dependency-92 +SPDXID: SPDXRef-Package-Dependency-70 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2453,7 +2277,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: textwrap -SPDXID: SPDXRef-Package-Dependency-93 +SPDXID: SPDXRef-Package-Dependency-71 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2461,7 +2285,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: tikv-jemalloc-sys -SPDXID: SPDXRef-Package-Dependency-94 +SPDXID: SPDXRef-Package-Dependency-72 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2469,7 +2293,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: tikv-jemallocator -SPDXID: SPDXRef-Package-Dependency-95 +SPDXID: SPDXRef-Package-Dependency-73 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2477,7 +2301,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: unicode-ident -SPDXID: SPDXRef-Package-Dependency-96 +SPDXID: SPDXRef-Package-Dependency-74 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2485,15 +2309,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: unicode-ident -SPDXID: SPDXRef-Package-Dependency-97 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: walkdir -SPDXID: SPDXRef-Package-Dependency-98 +SPDXID: SPDXRef-Package-Dependency-75 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2501,7 +2317,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: walkdir -SPDXID: SPDXRef-Package-Dependency-99 +SPDXID: SPDXRef-Package-Dependency-76 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2509,7 +2325,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: winapi-util -SPDXID: SPDXRef-Package-Dependency-100 +SPDXID: SPDXRef-Package-Dependency-77 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2517,7 +2333,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: windows-link -SPDXID: SPDXRef-Package-Dependency-101 +SPDXID: SPDXRef-Package-Dependency-78 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2525,7 +2341,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: windows-sys -SPDXID: SPDXRef-Package-Dependency-102 +SPDXID: SPDXRef-Package-Dependency-79 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2533,7 +2349,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: zmij -SPDXID: SPDXRef-Package-Dependency-103 +SPDXID: SPDXRef-Package-Dependency-80 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -2883,37 +2699,36 @@ Relationship: SPDXRef-Package-11 CONTAINS SPDXRef-216 Relationship: SPDXRef-Package-11 CONTAINS SPDXRef-217 Relationship: SPDXRef-Package-11 CONTAINS SPDXRef-218 Relationship: SPDXRef-Package-11 CONTAINS SPDXRef-219 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-10 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-11 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-12 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-18 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-2 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-21 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-25 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-26 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-28 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-31 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-35 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-38 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-42 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-46 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-47 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-48 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-49 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-51 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-54 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-58 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-57 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-6 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-60 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-64 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-65 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-7 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-71 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-69 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-74 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-79 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-83 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-89 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-96 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-14 Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-15 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-17 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-31 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-53 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-69 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-25 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-37 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-52 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-58 Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-76 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-98 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-8 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-10 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-2 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-3 @@ -2923,115 +2738,107 @@ Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-6 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-7 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-8 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-9 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-10 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-100 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-101 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-102 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-103 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-12 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-13 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-14 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-15 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-16 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-18 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-17 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-19 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-20 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-21 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-22 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-23 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-24 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-26 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-27 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-28 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-29 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-3 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-30 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-36 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-39 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-4 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-40 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-41 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-43 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-44 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-45 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-47 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-5 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-46 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-49 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-52 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-55 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-57 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-60 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-51 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-53 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-56 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-58 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-59 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-61 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-62 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-63 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-65 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-66 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-67 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-68 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-7 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-70 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-71 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-72 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-73 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-75 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-76 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-77 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-78 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-79 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-8 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-80 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-81 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-82 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-84 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-85 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-86 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-87 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-88 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-90 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-91 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-92 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-93 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-94 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-95 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-97 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-98 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-99 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-1 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-29 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-6 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-69 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-72 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-78 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-85 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-31 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-90 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-53 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-68 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-59 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-38 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-39 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-78 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-85 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-90 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-69 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-72 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-23 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-25 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-38 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-53 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-56 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-68 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-36 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-37 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-38 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-39 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-90 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-98 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-24 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-5 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-52 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-55 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-59 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-66 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-25 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-70 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-37 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-51 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-4 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-43 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-4 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-7 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-8 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-59 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-66 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-70 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-4 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-52 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-55 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-4 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-7 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-20 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-21 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-37 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-40 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-51 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-3 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-4 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-5 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-6 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-7 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-8 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-70 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-76 ## License Information LicenseID: LicenseRef-scancode-unknown-license-reference ExtractedText: See details at https://github.com/aboutcode-org/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lead-in_unknown_30.RULE diff --git a/examples/sbom/tokio/README.md b/examples/sbom/tokio/README.md index 0ff98590f..0564fcdac 100644 --- a/examples/sbom/tokio/README.md +++ b/examples/sbom/tokio/README.md @@ -11,7 +11,7 @@ SPDX tag-value ([`sbom.spdx`](sbom.spdx)) and CycloneDX JSON ([`sbom.cdx.json`]( ## What's inside -- **51 components** — the project plus every resolved dependency, each with a package URL (purl). +- **46 components** — the project plus every resolved dependency, each with a package URL (purl). - **80 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). ## How it compares diff --git a/examples/sbom/tokio/sbom.cdx.json b/examples/sbom/tokio/sbom.cdx.json index dc75b3558..1b80526dd 100644 --- a/examples/sbom/tokio/sbom.cdx.json +++ b/examples/sbom/tokio/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:8c52a871-dde8-4702-aa98-ffbbb205c6a9", + "serialNumber": "urn:uuid:affd4893-61f4-4be1-91b6-49e89907c769", "version": 1, "metadata": { - "timestamp": "2026-07-23T22:12:18Z", + "timestamp": "2026-07-24T07:16:31Z", "tools": [ { "name": "Provenant", @@ -628,46 +628,6 @@ "scope": "required", "purl": "pkg:cargo/tempfile" }, - { - "type": "library", - "bom-ref": "pkg:cargo/tokio", - "name": "tokio", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/tokio" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/tokio-macros", - "name": "tokio-macros", - "version": "unknown", - "scope": "optional", - "purl": "pkg:cargo/tokio-macros" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/tokio-stream", - "name": "tokio-stream", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/tokio-stream" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/tokio-test", - "name": "tokio-test", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/tokio-test" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/tokio-util", - "name": "tokio-util", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/tokio-util" - }, { "type": "library", "bom-ref": "pkg:cargo/tracing", @@ -704,9 +664,9 @@ "pkg:cargo/criterion", "pkg:cargo/rand", "pkg:cargo/rand_chacha", - "pkg:cargo/tokio", - "pkg:cargo/tokio-stream", - "pkg:cargo/tokio-util" + "pkg:cargo/tokio-stream@0.1.18", + "pkg:cargo/tokio-util@0.7.18", + "pkg:cargo/tokio@1.53.1" ] }, { @@ -733,9 +693,9 @@ "pkg:cargo/serde", "pkg:cargo/serde_derive", "pkg:cargo/serde_json", - "pkg:cargo/tokio", - "pkg:cargo/tokio-stream", - "pkg:cargo/tokio-util", + "pkg:cargo/tokio-stream@0.1.18", + "pkg:cargo/tokio-util@0.7.18", + "pkg:cargo/tokio@1.53.1", "pkg:cargo/tracing", "pkg:cargo/tracing-subscriber" ] @@ -844,7 +804,7 @@ "ref": "pkg:cargo/stress-test@0.1.0", "dependsOn": [ "pkg:cargo/rand", - "pkg:cargo/tokio" + "pkg:cargo/tokio@1.53.1" ] }, { @@ -858,7 +818,7 @@ { "ref": "pkg:cargo/tests-build@0.1.0", "dependsOn": [ - "pkg:cargo/tokio", + "pkg:cargo/tokio@1.53.1", "pkg:cargo/trybuild" ] }, @@ -868,44 +828,32 @@ "pkg:cargo/bytes", "pkg:cargo/doc-comment", "pkg:cargo/futures", - "pkg:cargo/tokio", - "pkg:cargo/tokio-test" + "pkg:cargo/tokio-test@0.4.5", + "pkg:cargo/tokio@1.53.1" ] }, - { - "ref": "pkg:cargo/tokio", - "dependsOn": [] - }, { "ref": "pkg:cargo/tokio-fuzz@0.0.0", "dependsOn": [ "pkg:cargo/libfuzzer-sys", - "pkg:cargo/tokio" + "pkg:cargo/tokio@1.53.1" ] }, - { - "ref": "pkg:cargo/tokio-macros", - "dependsOn": [] - }, { "ref": "pkg:cargo/tokio-macros@2.7.1", "dependsOn": [ "pkg:cargo/proc-macro2", "pkg:cargo/quote", "pkg:cargo/syn", - "pkg:cargo/tokio" + "pkg:cargo/tokio@1.53.1" ] }, - { - "ref": "pkg:cargo/tokio-stream", - "dependsOn": [] - }, { "ref": "pkg:cargo/tokio-stream-fuzz@0.0.0", "dependsOn": [ "pkg:cargo/libfuzzer-sys", - "pkg:cargo/tokio-stream", - "pkg:cargo/tokio-test" + "pkg:cargo/tokio-stream@0.1.18", + "pkg:cargo/tokio-test@0.4.5" ] }, { @@ -916,28 +864,20 @@ "pkg:cargo/futures-core", "pkg:cargo/parking_lot", "pkg:cargo/pin-project-lite", - "pkg:cargo/tokio", - "pkg:cargo/tokio-test", - "pkg:cargo/tokio-util" + "pkg:cargo/tokio-test@0.4.5", + "pkg:cargo/tokio-util@0.7.18", + "pkg:cargo/tokio@1.53.1" ] }, - { - "ref": "pkg:cargo/tokio-test", - "dependsOn": [] - }, { "ref": "pkg:cargo/tokio-test@0.4.5", "dependsOn": [ "pkg:cargo/futures-core", "pkg:cargo/futures-util", - "pkg:cargo/tokio", - "pkg:cargo/tokio-stream" + "pkg:cargo/tokio-stream@0.1.18", + "pkg:cargo/tokio@1.53.1" ] }, - { - "ref": "pkg:cargo/tokio-util", - "dependsOn": [] - }, { "ref": "pkg:cargo/tokio-util@0.7.18", "dependsOn": [ @@ -954,9 +894,9 @@ "pkg:cargo/pin-project-lite", "pkg:cargo/slab", "pkg:cargo/tempfile", - "pkg:cargo/tokio", - "pkg:cargo/tokio-stream", - "pkg:cargo/tokio-test", + "pkg:cargo/tokio-stream@0.1.18", + "pkg:cargo/tokio-test@0.4.5", + "pkg:cargo/tokio@1.53.1", "pkg:cargo/tracing" ] }, @@ -972,10 +912,10 @@ "pkg:cargo/mockall", "pkg:cargo/parking_lot", "pkg:cargo/pin-project-lite", - "pkg:cargo/tokio-macros", - "pkg:cargo/tokio-stream", - "pkg:cargo/tokio-test", - "pkg:cargo/tokio-util" + "pkg:cargo/tokio-macros@2.7.1", + "pkg:cargo/tokio-stream@0.1.18", + "pkg:cargo/tokio-test@0.4.5", + "pkg:cargo/tokio-util@0.7.18" ] }, { diff --git a/examples/sbom/tokio/sbom.spdx b/examples/sbom/tokio/sbom.spdx index 37f2216a0..7022f478a 100644 --- a/examples/sbom/tokio/sbom.spdx +++ b/examples/sbom/tokio/sbom.spdx @@ -13,7 +13,7 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-23T22:12:17Z +Created: 2026-07-24T07:16:30Z ## Package Information PackageName: benches SPDXID: SPDXRef-Package-1 @@ -6452,48 +6452,8 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information -PackageName: tokio -SPDXID: SPDXRef-Package-Dependency-32 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: tokio-macros -SPDXID: SPDXRef-Package-Dependency-33 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: tokio-stream -SPDXID: SPDXRef-Package-Dependency-34 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: tokio-test -SPDXID: SPDXRef-Package-Dependency-35 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: tokio-util -SPDXID: SPDXRef-Package-Dependency-36 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information PackageName: tracing -SPDXID: SPDXRef-Package-Dependency-37 +SPDXID: SPDXRef-Package-Dependency-32 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -6501,7 +6461,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: tracing-subscriber -SPDXID: SPDXRef-Package-Dependency-38 +SPDXID: SPDXRef-Package-Dependency-33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -6509,7 +6469,7 @@ PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE ## Package Information PackageName: trybuild -SPDXID: SPDXRef-Package-Dependency-39 +SPDXID: SPDXRef-Package-Dependency-34 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION @@ -7709,16 +7669,19 @@ Relationship: SPDXRef-Package-12 CONTAINS SPDXRef-859 Relationship: SPDXRef-Package-12 CONTAINS SPDXRef-860 Relationship: SPDXRef-Package-12 CONTAINS SPDXRef-861 Relationship: SPDXRef-Package-12 CONTAINS SPDXRef-862 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-11 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-12 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-24 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-25 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-3 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-32 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-36 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-12 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-11 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-32 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-34 Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-7 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-10 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-12 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-1 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-10 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-11 @@ -7729,13 +7692,14 @@ Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-21 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-29 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-31 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-32 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-37 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-5 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-7 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-8 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-9 +Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-10 +Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-11 +Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-7 +Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-1 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-10 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-17 @@ -7743,12 +7707,11 @@ Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-18 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-2 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-20 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-21 -Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-33 -Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-36 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-5 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-6 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-11 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-12 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-13 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-14 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-15 @@ -7758,35 +7721,32 @@ Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-26 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-27 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-28 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-32 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-36 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-37 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-38 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-33 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-5 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-12 Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-24 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-32 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-32 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-39 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-12 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-10 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-12 Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-2 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-32 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-35 Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-4 Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-5 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-12 Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-16 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-12 Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-22 Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-23 Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-30 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-10 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-16 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-35 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-10 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-11 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-12 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-1 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-20 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-21 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-32 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-36 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-5 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-7 ## License Information diff --git a/src/output/sbom.rs b/src/output/sbom.rs index 402ab59ab..b20dcdc14 100644 --- a/src/output/sbom.rs +++ b/src/output/sbom.rs @@ -66,6 +66,12 @@ impl<'a> InventoryEntry<'a> { /// The identical component/package inventory used by CycloneDX and SPDX. pub(crate) struct SbomInventory<'a> { pub entries: Vec>, + /// Version-less purl identity → the single versioned purl that shares it, + /// when exactly one exists across the document. Lets an unversioned + /// requirement edge (e.g. `pkg:npm/leftpad` declared in a manifest) resolve + /// to the resolved coordinate (`pkg:npm/leftpad@1.0.0`) recovered from the + /// lockfile, a detected package, or resolved-package metadata. See ADR 0012. + version_index: HashMap, } impl<'a> SbomInventory<'a> { @@ -76,25 +82,43 @@ impl<'a> SbomInventory<'a> { pub(crate) fn packages(&self) -> impl Iterator { self.entries.iter().map(InventoryEntry::package) } + + /// Resolve a dependency edge purl to its versioned coordinate. An + /// unversioned purl whose version-less identity has exactly one versioned + /// sibling in the document is upgraded to that versioned purl; anything + /// already versioned, ambiguous (multiple versions), or without a sibling is + /// returned unchanged. Promotion and graph-edge resolution both route + /// through this so a versioned component and the edges that target it stay + /// consistent and the graph stays closed. + pub(crate) fn canonical_purl(&self, purl: &str) -> String { + canonicalize_purl(purl, &self.version_index) + } } /// Build the shared inventory: detected packages, then every resolved /// dependency promoted and deduped by purl (ADR 0012). pub(crate) fn build_inventory(output: &Output) -> SbomInventory<'_> { + let version_index = build_version_index(&output.packages, &output.dependencies); + let mut entries: Vec> = output .packages .iter() .map(|package| InventoryEntry::Detected { package }) .collect(); - for (package, is_optional) in promote_dependencies(&output.packages, &output.dependencies) { + for (package, is_optional) in + promote_dependencies(&output.packages, &output.dependencies, &version_index) + { entries.push(InventoryEntry::Promoted { package: Box::new(package), is_optional, }); } - SbomInventory { entries } + SbomInventory { + entries, + version_index, + } } /// Resolve owner→child dependency edges among inventory members. @@ -131,6 +155,7 @@ pub(crate) fn dependency_edges( let Some(purl) = dependency_edge_purl(dep) else { continue; }; + let purl = inventory.canonical_purl(&purl); let Some(child_ids) = purl_to_ids.get(purl.as_str()) else { continue; }; @@ -156,6 +181,78 @@ pub(crate) fn dependency_edge_purl(dep: &TopLevelDependency) -> Option { .filter(|purl| !purl.is_empty()) } +/// A purl's version-less identity key and whether it carries a version. `None` +/// when the string does not parse as a purl. The key joins the type, namespace, +/// and name (NUL-separated to avoid delimiter collisions) so purls that differ +/// only in version share one key. +fn purl_identity(purl: &str) -> Option<(String, bool)> { + let parsed = PackageUrl::from_str(purl).ok()?; + let base = format!( + "{}\u{0}{}\u{0}{}", + parsed.ty(), + parsed.namespace().unwrap_or(""), + parsed.name() + ); + Some((base, parsed.version().is_some())) +} + +/// Map each version-less purl identity to the one versioned purl that shares it, +/// drawn from detected packages and every dependency edge (its own purl and its +/// resolved-package purl). An identity with zero or multiple distinct versioned +/// purls is omitted, so an unversioned edge for an ambiguous identity keeps its +/// unversioned purl rather than guess a version (ADR 0012 honest-unknowns). +fn build_version_index( + packages: &[OutputPackage], + dependencies: &[TopLevelDependency], +) -> HashMap { + let mut by_base: HashMap> = HashMap::new(); + let mut record = |purl: &str| { + if let Some((base, true)) = purl_identity(purl) { + by_base.entry(base).or_default().insert(purl.to_string()); + } + }; + + for pkg in packages { + if let Some(purl) = pkg.purl.as_deref() { + record(purl); + } + } + for dep in dependencies { + if let Some(purl) = dep.purl.as_deref() { + record(purl); + } + if let Some(purl) = dep + .resolved_package + .as_ref() + .and_then(|rp| rp.purl.as_deref()) + { + record(purl); + } + } + + by_base + .into_iter() + .filter_map(|(base, versioned)| { + let mut it = versioned.into_iter(); + let only = it.next()?; + it.next().is_none().then_some((base, only)) + }) + .collect() +} + +/// Upgrade an unversioned purl to its unique versioned sibling from +/// `version_index`; return the purl unchanged when it is already versioned, +/// ambiguous, unmatched, or unparseable. +fn canonicalize_purl(purl: &str, version_index: &HashMap) -> String { + match purl_identity(purl) { + Some((base, false)) => version_index + .get(&base) + .cloned() + .unwrap_or_else(|| purl.to_string()), + _ => purl.to_string(), + } +} + /// Promote resolved dependencies, deduped by purl. /// /// A dependency whose purl a detected package already owns is skipped (the @@ -167,6 +264,7 @@ pub(crate) fn dependency_edge_purl(dep: &TopLevelDependency) -> Option { fn promote_dependencies( packages: &[OutputPackage], dependencies: &[TopLevelDependency], + version_index: &HashMap, ) -> Vec<(OutputPackage, Option)> { let existing_purls: HashSet<&str> = packages .iter() @@ -180,6 +278,10 @@ fn promote_dependencies( let Some(purl) = dependency_edge_purl(dep) else { continue; }; + // Upgrade an unversioned requirement edge to its resolved coordinate so + // it dedups against the detected package or lockfile-resolved component + // for the same dependency instead of becoming a second, unversioned one. + let purl = canonicalize_purl(&purl, version_index); if existing_purls.contains(purl.as_str()) { continue; } @@ -776,4 +878,131 @@ mod tests { "an edge whose target is not in inventory must not be emitted" ); } + + fn output_with(packages: Vec, deps: Vec) -> Output { + Output { + summary: None, + tallies: None, + tallies_of_key_files: None, + tallies_by_facet: None, + headers: vec![], + packages, + dependencies: deps, + license_detections: vec![], + files: vec![], + license_references: vec![], + license_rule_references: vec![], + } + } + + fn licensed_detected_package(purl: &str, spdx: &str) -> OutputPackage { + let tail = purl.rsplit('/').next().unwrap_or("pkg"); + let (name, version) = tail + .split_once('@') + .map(|(n, v)| (n.to_string(), Some(v.to_string()))) + .unwrap_or_else(|| (tail.to_string(), None)); + OutputPackage::from(&crate::models::Package::from_package_data( + &PackageData { + package_type: Some(PackageType::Npm), + name: Some(name), + version, + purl: Some(purl.to_string()), + declared_license_expression: Some(spdx.to_lowercase()), + declared_license_expression_spdx: Some(spdx.to_string()), + ..Default::default() + }, + "package.json".to_string(), + )) + } + + // Vendored join (issue #1320): with `node_modules//package.json` on + // disk the dependency is a detected, licensed package at its versioned purl, + // while the manifest yields an unversioned requirement edge. The unversioned + // edge must resolve onto the detected package, leaving ONE licensed, + // versioned component — never a second bare `pkg:npm/leftpad`. + #[test] + fn unversioned_requirement_merges_into_vendored_detected_package() { + let packages = vec![licensed_detected_package("pkg:npm/leftpad@1.0.0", "MIT")]; + let deps = vec![dependency(Some("pkg:npm/leftpad"), Some(false), None, "d1")]; + let output = output_with(packages, deps); + let inventory = build_inventory(&output); + + assert_eq!( + inventory.entries.len(), + 1, + "must not add a second component" + ); + assert!(!inventory.entries[0].is_promoted()); + let package = inventory.entries[0].package(); + assert_eq!(package.purl.as_deref(), Some("pkg:npm/leftpad@1.0.0")); + assert_eq!( + package.declared_license_expression_spdx.as_deref(), + Some("MIT") + ); + } + + // Versioned-purl gap (issue #1320): the resolved version lives only on a + // sibling lockfile edge. An unversioned requirement edge with no detected + // package must still be promoted at the resolved coordinate and pick up the + // license the sibling's resolved package carries. + #[test] + fn unversioned_requirement_coalesces_to_versioned_sibling_edge() { + let mut resolved = ResolvedPackage::new( + PackageType::Npm, + String::new(), + "left-pad".to_string(), + "1.3.0".to_string(), + ); + resolved.purl = Some("pkg:npm/left-pad@1.3.0".to_string()); + resolved.declared_license_expression_spdx = Some("MIT".to_string()); + + let deps = vec![ + dependency(Some("pkg:npm/left-pad"), Some(false), None, "req"), + dependency( + Some("pkg:npm/left-pad@1.3.0"), + Some(false), + Some(resolved), + "lock", + ), + ]; + let output = output_with(vec![], deps); + let inventory = build_inventory(&output); + + assert_eq!(inventory.entries.len(), 1, "the two edges collapse to one"); + let package = inventory.entries[0].package(); + assert_eq!(package.purl.as_deref(), Some("pkg:npm/left-pad@1.3.0")); + assert_eq!(package.version.as_deref(), Some("1.3.0")); + assert_eq!( + package.declared_license_expression_spdx.as_deref(), + Some("MIT") + ); + } + + // Honest-unknowns: when an unversioned requirement could match more than one + // resolved version, Provenant must not guess. The edge keeps its unversioned + // purl and each resolved version remains its own component. + #[test] + fn ambiguous_versions_leave_unversioned_requirement_unresolved() { + let deps = vec![ + dependency(Some("pkg:npm/multi"), Some(false), None, "req"), + dependency(Some("pkg:npm/multi@1.0.0"), Some(false), None, "v1"), + dependency(Some("pkg:npm/multi@2.0.0"), Some(false), None, "v2"), + ]; + let output = output_with(vec![], deps); + let inventory = build_inventory(&output); + + let purls: BTreeSet<&str> = inventory + .packages() + .filter_map(|pkg| pkg.purl.as_deref()) + .collect(); + assert_eq!( + purls, + BTreeSet::from([ + "pkg:npm/multi", + "pkg:npm/multi@1.0.0", + "pkg:npm/multi@2.0.0", + ]), + "an ambiguous unversioned requirement stays unversioned" + ); + } } diff --git a/testdata/output-formats/cyclonedx-dependencies-expected.json b/testdata/output-formats/cyclonedx-dependencies-expected.json index 9669e475e..7ae007634 100644 --- a/testdata/output-formats/cyclonedx-dependencies-expected.json +++ b/testdata/output-formats/cyclonedx-dependencies-expected.json @@ -1,14 +1,14 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:ce548f93-c5aa-499a-834c-a0233495928f", + "serialNumber": "urn:uuid:a423c1be-9bf8-4660-a3c6-95427fd95098", "version": 1, "metadata": { - "timestamp": "2023-03-31T10:36:22Z", + "timestamp": "2026-01-01T00:00:01Z", "tools": [ { "name": "Provenant", - "version": "0.0.5" + "version": "1.0.1" } ], "component": { @@ -42,6 +42,19 @@ "version": "2.0.0", "scope": "required", "purl": "pkg:npm/dep@2.0.0" + }, + { + "type": "library", + "bom-ref": "pkg:npm/left-pad@1.3.0", + "name": "left-pad", + "version": "1.3.0", + "scope": "required", + "purl": "pkg:npm/left-pad@1.3.0", + "licenses": [ + { + "expression": "MIT" + } + ] } ], "dependencies": [ @@ -49,13 +62,22 @@ "ref": "pkg:npm/dep@2.0.0", "dependsOn": [] }, + { + "ref": "pkg:npm/left-pad@1.3.0", + "dependsOn": [] + }, { "ref": "pkg:npm/other@1.0.0", - "dependsOn": ["pkg:npm/dep@2.0.0"] + "dependsOn": [ + "pkg:npm/dep@2.0.0" + ] }, { "ref": "pkg:npm/root@1.0.0", - "dependsOn": ["pkg:npm/dep@2.0.0"] + "dependsOn": [ + "pkg:npm/dep@2.0.0", + "pkg:npm/left-pad@1.3.0" + ] } ] } diff --git a/testdata/output-formats/cyclonedx-dependencies-expected.xml b/testdata/output-formats/cyclonedx-dependencies-expected.xml index 2a01a4b4c..08166290e 100644 --- a/testdata/output-formats/cyclonedx-dependencies-expected.xml +++ b/testdata/output-formats/cyclonedx-dependencies-expected.xml @@ -1,13 +1,9 @@ - + - 2023-03-31T10:36:22Z + 2026-01-01T00:00:01Z - - Provenant - Provenant - 0.0.5 - + ProvenantProvenant1.0.1 root @@ -34,15 +30,25 @@ required pkg:npm/dep@2.0.0 + + left-pad + 1.3.0 + required + MIT + pkg:npm/left-pad@1.3.0 + + + + diff --git a/testdata/output-formats/spdx-dependencies-expected.tv b/testdata/output-formats/spdx-dependencies-expected.tv index 6d93fe1b4..667fedc7b 100644 --- a/testdata/output-formats/spdx-dependencies-expected.tv +++ b/testdata/output-formats/spdx-dependencies-expected.tv @@ -12,7 +12,7 @@ Provenant is a free software code scanning tool. Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information -Creator: Tool: Provenant-1.0.1-g934b1ca7-dirty +Creator: Tool: Provenant-1.0.1 Created: 2026-01-01T00:00:00Z ## Package Information PackageName: root @@ -47,8 +47,17 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +## Package Information +PackageName: left-pad +SPDXID: SPDXRef-Package-Dependency-2 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: MIT +PackageLicenseDeclared: MIT +PackageCopyrightText: NONE ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-2 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-1 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-2 diff --git a/tests/output_format_golden.rs b/tests/output_format_golden.rs index 239109a34..b474028c4 100644 --- a/tests/output_format_golden.rs +++ b/tests/output_format_golden.rs @@ -2477,11 +2477,63 @@ fn sample_cyclonedx_dependency_output() -> Output { namespace: None, }; + // Versioned-purl + vendored-license join (issue #1320): the manifest declares + // an *unversioned* requirement while the lockfile resolves the same + // dependency to a version and carries its license. The two must collapse into + // one licensed, versioned component (`pkg:npm/left-pad@1.3.0` / MIT), not a + // bare `pkg:npm/left-pad` plus a separate versioned one. + let leftpad_requirement = TopLevelDependency { + purl: Some("pkg:npm/left-pad".to_string()), + extracted_requirement: Some("^1.3.0".to_string()), + scope: Some("dependencies".to_string()), + is_runtime: Some(true), + is_optional: Some(false), + is_pinned: Some(false), + is_direct: Some(true), + resolved_package: None, + extra_data: None, + dependency_uid: DependencyUid::from_raw( + "pkg:npm/left-pad?uuid=00000000-0000-0000-0000-000000000003".to_string(), + ), + for_package_uid: Some(root_uid.clone()), + datafile_path: "scan/package.json".to_string(), + datasource_id: DatasourceId::NpmPackageJson, + namespace: None, + }; + let leftpad_resolved = TopLevelDependency { + purl: Some("pkg:npm/left-pad@1.3.0".to_string()), + extracted_requirement: Some("1.3.0".to_string()), + scope: Some("dependencies".to_string()), + is_runtime: Some(true), + is_optional: Some(false), + is_pinned: Some(true), + is_direct: Some(false), + resolved_package: Some(Box::new(ResolvedPackage { + purl: Some("pkg:npm/left-pad@1.3.0".to_string()), + declared_license_expression: Some("mit".to_string()), + declared_license_expression_spdx: Some("MIT".to_string()), + ..ResolvedPackage::new( + PackageType::Npm, + String::new(), + "left-pad".to_string(), + "1.3.0".to_string(), + ) + })), + extra_data: None, + dependency_uid: DependencyUid::from_raw( + "pkg:npm/left-pad@1.3.0?uuid=00000000-0000-0000-0000-000000000004".to_string(), + ), + for_package_uid: Some(root_uid), + datafile_path: "scan/package-lock.json".to_string(), + datasource_id: DatasourceId::NpmPackageLockJson, + namespace: None, + }; + sample_output_with_sections( 0, 0, vec![root_pkg, other_pkg], - vec![owned_dep, shared_dep], + vec![owned_dep, shared_dep, leftpad_requirement, leftpad_resolved], vec![], ) } @@ -2537,6 +2589,57 @@ fn sample_spdx_dependency_output() -> Output { namespace: None, }; + // Versioned-purl + vendored-license join (issue #1320): an unversioned + // manifest requirement and the lockfile's versioned, licensed resolution of + // the same dependency collapse to one `pkg:npm/left-pad@1.3.0` package + // carrying MIT. + let leftpad_requirement = TopLevelDependency { + purl: Some("pkg:npm/left-pad".to_string()), + extracted_requirement: Some("^1.3.0".to_string()), + scope: Some("dependencies".to_string()), + is_runtime: Some(true), + is_optional: Some(false), + is_pinned: Some(false), + is_direct: Some(true), + resolved_package: None, + extra_data: None, + dependency_uid: DependencyUid::from_raw( + "pkg:npm/left-pad?uuid=00000000-0000-0000-0000-000000000003".to_string(), + ), + for_package_uid: Some(root_uid.clone()), + datafile_path: "scan/package.json".to_string(), + datasource_id: DatasourceId::NpmPackageJson, + namespace: None, + }; + let leftpad_resolved = TopLevelDependency { + purl: Some("pkg:npm/left-pad@1.3.0".to_string()), + extracted_requirement: Some("1.3.0".to_string()), + scope: Some("dependencies".to_string()), + is_runtime: Some(true), + is_optional: Some(false), + is_pinned: Some(true), + is_direct: Some(false), + resolved_package: Some(Box::new(ResolvedPackage { + purl: Some("pkg:npm/left-pad@1.3.0".to_string()), + declared_license_expression: Some("mit".to_string()), + declared_license_expression_spdx: Some("MIT".to_string()), + ..ResolvedPackage::new( + PackageType::Npm, + String::new(), + "left-pad".to_string(), + "1.3.0".to_string(), + ) + })), + extra_data: None, + dependency_uid: DependencyUid::from_raw( + "pkg:npm/left-pad@1.3.0?uuid=00000000-0000-0000-0000-000000000004".to_string(), + ), + for_package_uid: Some(root_uid.clone()), + datafile_path: "scan/package-lock.json".to_string(), + datasource_id: DatasourceId::NpmPackageLockJson, + namespace: None, + }; + let mut manifest = sample_plain_text_file( "package.json", "package", @@ -2562,7 +2665,7 @@ fn sample_spdx_dependency_output() -> Output { 2, 0, vec![root_pkg], - vec![owned_dep], + vec![owned_dep, leftpad_requirement, leftpad_resolved], vec![manifest, source], ) } @@ -2613,7 +2716,10 @@ fn test_spdx_tag_value_emits_promoted_dependency_packages_after_file_section() { let expected = fs::read_to_string("testdata/output-formats/spdx-dependencies-expected.tv") .expect("spdx dependency fixture should be readable"); - assert_eq!(actual, expected); + // Normalize away the build-specific Creator/Created lines like every other + // SPDX tag-value golden; the ordering assertions above already cover the + // section layout this fixture is here to protect. + assert_eq!(normalize_spdx_tv(&actual), normalize_spdx_tv(&expected)); } fn empty_output() -> Output { From bed65b7d2b036ab5d726ddf4acd03d96aa524b09 Mon Sep 17 00:00:00 2001 From: Maxim Stykow Date: Fri, 24 Jul 2026 10:06:16 +0200 Subject: [PATCH 2/4] fix(output): scope SBOM version join to owner+identity and render purls in SPDX MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address two P1 correctness bugs in the version-index join and fold in the deferred SPDX purl/version rendering. P1(a) identity now strips only the version: type, namespace, name, qualifiers, and subpath are preserved (rebuilt through PackageUrl for a canonical, qualifier-sorted key). Variants that differ only by a qualifier (?arch=, ?classifier=, …) or subpath are no longer conflated. P1(b) the version index is per-owner, keyed by (for_package_uid, version-less identity) and built from dependency edges only (not detected packages). An unversioned edge is upgraded only from its own resolved_package purl or a single unambiguous versioned sibling under the SAME owner. A version is never borrowed across owners, and ambiguous or cross-owner cases stay unversioned (honest-unknown). Added regression tests for both: two owners resolving one name to different versions (no cross-assignment, graph stays closed) and qualifier/subpath variants that must not be conflated. SPDX now surfaces the versioned coordinate for every package (subject and promoted dependency): tag-value emits PackageVersion and `ExternalRef: PACKAGE-MANAGER purl `; RDF emits spdx:versionInfo and a spdx:externalRef (referenceCategory packageManager, referenceType purl). Both validate with pyspdxtools. Regenerated the four examples/sbom and the affected goldens; updated ADR 0012. All four examples (CycloneDX + SPDX) and the goldens pass the official validators. Owner-scoping is stricter than the previous document-wide index, so workspace cross-member deps whose lockfile edges are owned elsewhere now stay honestly unversioned (ripgrep 91->107, flask 47->53, tokio 46->51 components); the graph stays closed (0 dangling) in every document. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Maxim Stykow --- ...012-sbom-resolved-dependency-components.md | 59 +- examples/sbom/express/sbom.cdx.json | 4 +- examples/sbom/express/sbom.spdx | 48 +- examples/sbom/flask/README.md | 4 +- examples/sbom/flask/sbom.cdx.json | 107 ++- examples/sbom/flask/sbom.spdx | 253 ++++++-- examples/sbom/ripgrep/README.md | 4 +- examples/sbom/ripgrep/sbom.cdx.json | 334 +++++++--- examples/sbom/ripgrep/sbom.spdx | 614 +++++++++++++----- examples/sbom/tokio/README.md | 2 +- examples/sbom/tokio/sbom.cdx.json | 116 +++- examples/sbom/tokio/sbom.spdx | 167 ++++- src/output/sbom.rs | 322 ++++++--- src/output/spdx.rs | 42 ++ .../cyclonedx-dependencies-expected.json | 11 +- .../cyclonedx-dependencies-expected.xml | 2 +- .../spdx-dependencies-expected.tv | 6 + .../output-formats/spdx-licensed-expected.tv | 4 + .../spdx-multi-package-expected.tv | 4 + 19 files changed, 1612 insertions(+), 491 deletions(-) diff --git a/docs/adr/0012-sbom-resolved-dependency-components.md b/docs/adr/0012-sbom-resolved-dependency-components.md index aa66440dc..edde871fb 100644 --- a/docs/adr/0012-sbom-resolved-dependency-components.md +++ b/docs/adr/0012-sbom-resolved-dependency-components.md @@ -107,7 +107,7 @@ determine it statically**: ## Amendment (issue #1320): versioned purls and the vendored-license join The original decision keyed promotion and graph edges on the dependency's -*declared* purl. For an ecosystem that resolves versions in a lockfile that is a +_declared_ purl. For an ecosystem that resolves versions in a lockfile that is a separate datasource from the manifest (npm, Cargo, PyPI, …), that produced two shortcomings visible in a real scan: @@ -125,26 +125,51 @@ shortcomings visible in a real scan: Resolve each dependency edge purl to its **versioned coordinate** before promotion and edge resolution, using only static evidence already in the -document. `SbomInventory` builds a version index mapping each version-less purl -identity (type + namespace + name) to the single versioned purl that shares it, -drawn from detected packages, dependency purls, and resolved-package purls. An -unversioned edge whose identity has exactly one versioned sibling is upgraded to -that versioned purl; an identity with zero or multiple versioned siblings is -left unversioned (honest-unknowns — Provenant does not guess which version a -range resolved to). Both promotion dedup and `dependsOn`/`DEPENDS_ON` edge -resolution route through the same canonicalization, so a component and the edges -that target it always agree and the graph stays closed. +document. An already-versioned edge keeps its purl. An unversioned edge is +upgraded only from proof about that same edge: + +1. the edge's own `resolved_package` purl (its actual resolution), else +2. a **single unambiguous** versioned sibling recorded under the **same owner** + (`for_package_uid`) and the same identity. + +`SbomInventory` builds that evidence as a per-owner version index keyed by +`(owner, version-less identity)` from dependency edges only — never from +detected packages, which are not owner-scoped. Two correctness rules make the +join safe: + +- **Owner-scoped.** A version is never borrowed across owners. Two packages can + resolve the same requirement to different versions; each edge takes its + version only from its own owner's resolution. +- **Identity strips only the version.** Type, namespace, name, qualifiers, and + subpath are all preserved, so variants that differ by a qualifier (`?arch=`, + `?classifier=`, …) or subpath are distinct coordinates and never conflated. + +When the owner has zero or multiple candidate versions for an identity, the edge +keeps its unversioned purl (honest-unknowns — Provenant does not guess which +version a range resolved to; e.g. a workspace member whose lockfile edges are +owned elsewhere, or a diamond that resolves two versions). Both promotion dedup +and `dependsOn`/`DEPENDS_ON` edge resolution route through the same resolver, so +a component and the edges that target it always agree and the graph stays +closed. This closes both gaps with the existing purl-dedup: once the unversioned -requirement is canonicalized to the resolved coordinate, it dedups against the -detected package (vendored case → one licensed, versioned component) or against -the versioned lockfile edge (source-absent case → one versioned component, -license carried from `resolved_package` when present, otherwise unset). Nothing -is fetched; the license and version come only from what was scanned. +requirement is resolved to the coordinate, it dedups against the detected +package (vendored case → one licensed, versioned component) or against the +versioned lockfile edge (source-absent case → one versioned component, license +carried from `resolved_package` when present, otherwise unset). Nothing is +fetched; the license and version come only from what was scanned. + +Both formats render the versioned coordinate. CycloneDX components carry the +versioned purl as `bom-ref` and `purl`. SPDX packages (subject and promoted +dependency alike) now emit `PackageVersion` and a package-manager purl +`ExternalRef` — tag-value `ExternalRef: PACKAGE-MANAGER purl ` and RDF +`spdx:versionInfo` + `spdx:externalRef` (referenceCategory `packageManager`, +referenceType `purl`) — so the join key is usable from SPDX too. Still static and no-network: the change is purely a render-time join over data -already extracted. When neither a detected package nor a resolved version exists -for an identity, the component keeps its unversioned purl and unset license. +already extracted. When neither a detected package nor a same-owner resolved +version exists for an identity, the component keeps its unversioned purl and +unset license. ## Consequences diff --git a/examples/sbom/express/sbom.cdx.json b/examples/sbom/express/sbom.cdx.json index 9ad52a621..c2eb4d80d 100644 --- a/examples/sbom/express/sbom.cdx.json +++ b/examples/sbom/express/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:aa6d0404-c1bd-4a88-97d2-386b6a433602", + "serialNumber": "urn:uuid:39c66028-e3ae-4e52-bf05-e69d7557065a", "version": 1, "metadata": { - "timestamp": "2026-07-24T07:16:25Z", + "timestamp": "2026-07-24T08:01:41Z", "tools": [ { "name": "Provenant", diff --git a/examples/sbom/express/sbom.spdx b/examples/sbom/express/sbom.spdx index 16c1c3b0c..01c81b2b4 100644 --- a/examples/sbom/express/sbom.spdx +++ b/examples/sbom/express/sbom.spdx @@ -13,10 +13,11 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-24T07:16:25Z +Created: 2026-07-24T08:01:40Z ## Package Information PackageName: express SPDXID: SPDXRef-Package-1 +PackageVersion: 5.2.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: ea2aa897220d8ebe58a2faf63f08c3f2bc9421f6 @@ -29,6 +30,7 @@ Copyright (c) 2014-2015 Douglas Christopher Wilson Copyright(c) 2009-2013 TJ Holowaychuk Copyright(c) 2013 Roman Shtylman Copyright(c) 2014-2015 Douglas Christopher Wilson +ExternalRef: PACKAGE-MANAGER purl pkg:npm/express@5.2.1 ## File Information FileName: ./.editorconfig SPDXID: SPDXRef-1 @@ -1557,6 +1559,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/accepts ## Package Information PackageName: after SPDXID: SPDXRef-Package-Dependency-2 @@ -1565,6 +1568,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/after ## Package Information PackageName: body-parser SPDXID: SPDXRef-Package-Dependency-3 @@ -1573,6 +1577,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/body-parser ## Package Information PackageName: connect-redis SPDXID: SPDXRef-Package-Dependency-4 @@ -1581,6 +1586,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/connect-redis ## Package Information PackageName: content-disposition SPDXID: SPDXRef-Package-Dependency-5 @@ -1589,6 +1595,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/content-disposition ## Package Information PackageName: content-type SPDXID: SPDXRef-Package-Dependency-6 @@ -1597,6 +1604,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/content-type ## Package Information PackageName: cookie SPDXID: SPDXRef-Package-Dependency-7 @@ -1605,6 +1613,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/cookie ## Package Information PackageName: cookie-parser SPDXID: SPDXRef-Package-Dependency-8 @@ -1613,6 +1622,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/cookie-parser ## Package Information PackageName: cookie-session SPDXID: SPDXRef-Package-Dependency-9 @@ -1621,6 +1631,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/cookie-session ## Package Information PackageName: cookie-signature SPDXID: SPDXRef-Package-Dependency-10 @@ -1629,6 +1640,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/cookie-signature ## Package Information PackageName: debug SPDXID: SPDXRef-Package-Dependency-11 @@ -1637,6 +1649,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/debug ## Package Information PackageName: depd SPDXID: SPDXRef-Package-Dependency-12 @@ -1645,6 +1658,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/depd ## Package Information PackageName: ejs SPDXID: SPDXRef-Package-Dependency-13 @@ -1653,6 +1667,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/ejs ## Package Information PackageName: encodeurl SPDXID: SPDXRef-Package-Dependency-14 @@ -1661,6 +1676,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/encodeurl ## Package Information PackageName: escape-html SPDXID: SPDXRef-Package-Dependency-15 @@ -1669,6 +1685,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/escape-html ## Package Information PackageName: eslint SPDXID: SPDXRef-Package-Dependency-16 @@ -1677,6 +1694,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/eslint ## Package Information PackageName: etag SPDXID: SPDXRef-Package-Dependency-17 @@ -1685,6 +1703,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/etag ## Package Information PackageName: express-session SPDXID: SPDXRef-Package-Dependency-18 @@ -1693,6 +1712,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/express-session ## Package Information PackageName: finalhandler SPDXID: SPDXRef-Package-Dependency-19 @@ -1701,6 +1721,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/finalhandler ## Package Information PackageName: fresh SPDXID: SPDXRef-Package-Dependency-20 @@ -1709,6 +1730,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/fresh ## Package Information PackageName: hbs SPDXID: SPDXRef-Package-Dependency-21 @@ -1717,6 +1739,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/hbs ## Package Information PackageName: http-errors SPDXID: SPDXRef-Package-Dependency-22 @@ -1725,6 +1748,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/http-errors ## Package Information PackageName: marked SPDXID: SPDXRef-Package-Dependency-23 @@ -1733,6 +1757,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/marked ## Package Information PackageName: merge-descriptors SPDXID: SPDXRef-Package-Dependency-24 @@ -1741,6 +1766,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/merge-descriptors ## Package Information PackageName: method-override SPDXID: SPDXRef-Package-Dependency-25 @@ -1749,6 +1775,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/method-override ## Package Information PackageName: mime-types SPDXID: SPDXRef-Package-Dependency-26 @@ -1757,6 +1784,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/mime-types ## Package Information PackageName: mocha SPDXID: SPDXRef-Package-Dependency-27 @@ -1765,6 +1793,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/mocha ## Package Information PackageName: morgan SPDXID: SPDXRef-Package-Dependency-28 @@ -1773,6 +1802,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/morgan ## Package Information PackageName: nyc SPDXID: SPDXRef-Package-Dependency-29 @@ -1781,6 +1811,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/nyc ## Package Information PackageName: on-finished SPDXID: SPDXRef-Package-Dependency-30 @@ -1789,6 +1820,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/on-finished ## Package Information PackageName: once SPDXID: SPDXRef-Package-Dependency-31 @@ -1797,6 +1829,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/once ## Package Information PackageName: parseurl SPDXID: SPDXRef-Package-Dependency-32 @@ -1805,6 +1838,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/parseurl ## Package Information PackageName: pbkdf2-password SPDXID: SPDXRef-Package-Dependency-33 @@ -1813,6 +1847,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/pbkdf2-password ## Package Information PackageName: proxy-addr SPDXID: SPDXRef-Package-Dependency-34 @@ -1821,6 +1856,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/proxy-addr ## Package Information PackageName: qs SPDXID: SPDXRef-Package-Dependency-35 @@ -1829,6 +1865,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/qs ## Package Information PackageName: range-parser SPDXID: SPDXRef-Package-Dependency-36 @@ -1837,6 +1874,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/range-parser ## Package Information PackageName: router SPDXID: SPDXRef-Package-Dependency-37 @@ -1845,6 +1883,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/router ## Package Information PackageName: send SPDXID: SPDXRef-Package-Dependency-38 @@ -1853,6 +1892,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/send ## Package Information PackageName: serve-static SPDXID: SPDXRef-Package-Dependency-39 @@ -1861,6 +1901,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/serve-static ## Package Information PackageName: statuses SPDXID: SPDXRef-Package-Dependency-40 @@ -1869,6 +1910,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/statuses ## Package Information PackageName: supertest SPDXID: SPDXRef-Package-Dependency-41 @@ -1877,6 +1919,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/supertest ## Package Information PackageName: type-is SPDXID: SPDXRef-Package-Dependency-42 @@ -1885,6 +1928,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/type-is ## Package Information PackageName: vary SPDXID: SPDXRef-Package-Dependency-43 @@ -1893,6 +1937,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/vary ## Package Information PackageName: vhost SPDXID: SPDXRef-Package-Dependency-44 @@ -1901,6 +1946,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/vhost ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-1 diff --git a/examples/sbom/flask/README.md b/examples/sbom/flask/README.md index 92102fb93..69f40322d 100644 --- a/examples/sbom/flask/README.md +++ b/examples/sbom/flask/README.md @@ -11,8 +11,8 @@ SPDX tag-value ([`sbom.spdx`](sbom.spdx)) and CycloneDX JSON ([`sbom.cdx.json`]( ## What's inside -- **47 components** — the project plus every resolved dependency, each with a package URL (purl). -- **53 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). +- **53 components** — the project plus every resolved dependency, each with a package URL (purl). +- **52 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). ## How it compares diff --git a/examples/sbom/flask/sbom.cdx.json b/examples/sbom/flask/sbom.cdx.json index fffe4bc04..d8fe82ff4 100644 --- a/examples/sbom/flask/sbom.cdx.json +++ b/examples/sbom/flask/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:f38ece06-0b4c-4c7d-867e-d60b1d3e2ba9", + "serialNumber": "urn:uuid:8d6c4efc-89ee-4220-8f62-3e58f370f2e9", "version": 1, "metadata": { - "timestamp": "2026-07-24T07:16:28Z", + "timestamp": "2026-07-24T08:01:46Z", "tools": [ { "name": "Provenant", @@ -182,6 +182,14 @@ "scope": "required", "purl": "pkg:pypi/billiard@3.6.4.0" }, + { + "type": "library", + "bom-ref": "pkg:pypi/blinker", + "name": "blinker", + "version": "unknown", + "scope": "required", + "purl": "pkg:pypi/blinker" + }, { "type": "library", "bom-ref": "pkg:pypi/blinker@1.6.2", @@ -200,11 +208,11 @@ }, { "type": "library", - "bom-ref": "pkg:pypi/click@8.1.3", + "bom-ref": "pkg:pypi/click", "name": "click", - "version": "8.1.3", + "version": "unknown", "scope": "required", - "purl": "pkg:pypi/click@8.1.3" + "purl": "pkg:pypi/click" }, { "type": "library", @@ -230,6 +238,14 @@ "scope": "required", "purl": "pkg:pypi/click-repl@0.2.0" }, + { + "type": "library", + "bom-ref": "pkg:pypi/click@8.1.3", + "name": "click", + "version": "8.1.3", + "scope": "required", + "purl": "pkg:pypi/click@8.1.3" + }, { "type": "library", "bom-ref": "pkg:pypi/cryptography", @@ -240,19 +256,19 @@ }, { "type": "library", - "bom-ref": "pkg:pypi/flask", + "bom-ref": "pkg:pypi/flask@2.3.2", "name": "flask", - "version": "unknown", + "version": "2.3.2", "scope": "required", - "purl": "pkg:pypi/flask" + "purl": "pkg:pypi/flask@2.3.2" }, { "type": "library", - "bom-ref": "pkg:pypi/flask@2.3.2", + "bom-ref": "pkg:pypi/flask", "name": "flask", - "version": "2.3.2", + "version": "unknown", "scope": "required", - "purl": "pkg:pypi/flask@2.3.2" + "purl": "pkg:pypi/flask" }, { "type": "library", @@ -278,6 +294,14 @@ "scope": "required", "purl": "pkg:pypi/importlib-metadata" }, + { + "type": "library", + "bom-ref": "pkg:pypi/itsdangerous", + "name": "itsdangerous", + "version": "unknown", + "scope": "required", + "purl": "pkg:pypi/itsdangerous" + }, { "type": "library", "bom-ref": "pkg:pypi/itsdangerous@2.1.2", @@ -286,6 +310,14 @@ "scope": "required", "purl": "pkg:pypi/itsdangerous@2.1.2" }, + { + "type": "library", + "bom-ref": "pkg:pypi/jinja2", + "name": "jinja2", + "version": "unknown", + "scope": "required", + "purl": "pkg:pypi/jinja2" + }, { "type": "library", "bom-ref": "pkg:pypi/jinja2@3.1.2", @@ -302,6 +334,14 @@ "scope": "required", "purl": "pkg:pypi/kombu@5.2.4" }, + { + "type": "library", + "bom-ref": "pkg:pypi/markupsafe", + "name": "markupsafe", + "version": "unknown", + "scope": "required", + "purl": "pkg:pypi/markupsafe" + }, { "type": "library", "bom-ref": "pkg:pypi/markupsafe@2.1.2", @@ -486,6 +526,14 @@ "scope": "required", "purl": "pkg:pypi/wcwidth@0.2.6" }, + { + "type": "library", + "bom-ref": "pkg:pypi/werkzeug", + "name": "werkzeug", + "version": "unknown", + "scope": "required", + "purl": "pkg:pypi/werkzeug" + }, { "type": "library", "bom-ref": "pkg:pypi/werkzeug@2.3.3", @@ -512,6 +560,10 @@ "ref": "pkg:pypi/billiard@3.6.4.0", "dependsOn": [] }, + { + "ref": "pkg:pypi/blinker", + "dependsOn": [] + }, { "ref": "pkg:pypi/blinker@1.6.2", "dependsOn": [] @@ -520,6 +572,10 @@ "ref": "pkg:pypi/celery@5.2.7", "dependsOn": [] }, + { + "ref": "pkg:pypi/click", + "dependsOn": [] + }, { "ref": "pkg:pypi/click-didyoumean@0.3.0", "dependsOn": [] @@ -556,7 +612,6 @@ "pkg:pypi/click-plugins@1.1.1", "pkg:pypi/click-repl@0.2.0", "pkg:pypi/click@8.1.3", - "pkg:pypi/flask", "pkg:pypi/flask@2.3.2", "pkg:pypi/itsdangerous@2.1.2", "pkg:pypi/jinja2@3.1.2", @@ -579,15 +634,15 @@ "ref": "pkg:pypi/flask@3.1.3", "dependsOn": [ "pkg:pypi/asgiref", - "pkg:pypi/blinker@1.6.2", - "pkg:pypi/click@8.1.3", + "pkg:pypi/blinker", + "pkg:pypi/click", "pkg:pypi/cryptography", "pkg:pypi/gha-update", "pkg:pypi/greenlet", "pkg:pypi/importlib-metadata", - "pkg:pypi/itsdangerous@2.1.2", - "pkg:pypi/jinja2@3.1.2", - "pkg:pypi/markupsafe@2.1.2", + "pkg:pypi/itsdangerous", + "pkg:pypi/jinja2", + "pkg:pypi/markupsafe", "pkg:pypi/mypy", "pkg:pypi/pallets-sphinx-themes", "pkg:pypi/pre-commit", @@ -604,7 +659,7 @@ "pkg:pypi/tox-uv", "pkg:pypi/types-contextvars", "pkg:pypi/types-dataclasses", - "pkg:pypi/werkzeug@2.3.3" + "pkg:pypi/werkzeug" ] }, { @@ -626,10 +681,18 @@ "ref": "pkg:pypi/importlib-metadata", "dependsOn": [] }, + { + "ref": "pkg:pypi/itsdangerous", + "dependsOn": [] + }, { "ref": "pkg:pypi/itsdangerous@2.1.2", "dependsOn": [] }, + { + "ref": "pkg:pypi/jinja2", + "dependsOn": [] + }, { "ref": "pkg:pypi/jinja2@3.1.2", "dependsOn": [] @@ -645,6 +708,10 @@ "ref": "pkg:pypi/kombu@5.2.4", "dependsOn": [] }, + { + "ref": "pkg:pypi/markupsafe", + "dependsOn": [] + }, { "ref": "pkg:pypi/markupsafe@2.1.2", "dependsOn": [] @@ -737,6 +804,10 @@ "ref": "pkg:pypi/wcwidth@0.2.6", "dependsOn": [] }, + { + "ref": "pkg:pypi/werkzeug", + "dependsOn": [] + }, { "ref": "pkg:pypi/werkzeug@2.3.3", "dependsOn": [] diff --git a/examples/sbom/flask/sbom.spdx b/examples/sbom/flask/sbom.spdx index 7e071f995..d852a4bdf 100644 --- a/examples/sbom/flask/sbom.spdx +++ b/examples/sbom/flask/sbom.spdx @@ -13,10 +13,11 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-24T07:16:27Z +Created: 2026-07-24T08:01:46Z ## Package Information PackageName: flask-example-celery SPDXID: SPDXRef-Package-1 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 94e723dc305f28b58ba1aba04e14aade037baa95 @@ -24,9 +25,11 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/flask-example-celery@1.0.0 ## Package Information PackageName: Flask SPDXID: SPDXRef-Package-2 +PackageVersion: 3.1.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 10a34637ad661d98ba3344717656fcc76209c2f8 @@ -35,9 +38,11 @@ PackageLicenseInfoFromFiles: BSD-3-Clause PackageLicenseInfoFromFiles: LicenseRef-scancode-unknown-license-reference PackageLicenseDeclared: BSD-3-Clause PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/flask@3.1.3 ## Package Information PackageName: flaskr SPDXID: SPDXRef-Package-3 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 10a34637ad661d98ba3344717656fcc76209c2f8 @@ -46,9 +51,11 @@ PackageLicenseInfoFromFiles: BSD-3-Clause PackageLicenseInfoFromFiles: LicenseRef-scancode-unknown-license-reference PackageLicenseDeclared: BSD-3-Clause PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/flaskr@1.0.0 ## Package Information PackageName: js_example SPDXID: SPDXRef-Package-4 +PackageVersion: 1.1.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 10a34637ad661d98ba3344717656fcc76209c2f8 @@ -57,6 +64,7 @@ PackageLicenseInfoFromFiles: BSD-3-Clause PackageLicenseInfoFromFiles: LicenseRef-scancode-unknown-license-reference PackageLicenseDeclared: BSD-3-Clause PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/js-example@1.1.0 ## Package Information PackageName: flask SPDXID: SPDXRef-Package-unassigned @@ -1701,11 +1709,13 @@ FileCopyrightText: NONE ## Package Information PackageName: amqp SPDXID: SPDXRef-Package-Dependency-1 +PackageVersion: 5.1.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/amqp@5.1.1 ## Package Information PackageName: asgiref SPDXID: SPDXRef-Package-Dependency-2 @@ -1714,22 +1724,27 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/asgiref ## Package Information PackageName: async-timeout SPDXID: SPDXRef-Package-Dependency-3 +PackageVersion: 4.0.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/async-timeout@4.0.2 ## Package Information PackageName: billiard SPDXID: SPDXRef-Package-Dependency-4 +PackageVersion: 3.6.4.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/billiard@3.6.4.0 ## Package Information PackageName: blinker SPDXID: SPDXRef-Package-Dependency-5 @@ -1738,310 +1753,421 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/blinker ## Package Information -PackageName: celery +PackageName: blinker SPDXID: SPDXRef-Package-Dependency-6 +PackageVersion: 1.6.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/blinker@1.6.2 ## Package Information -PackageName: click +PackageName: celery SPDXID: SPDXRef-Package-Dependency-7 +PackageVersion: 5.2.7 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/celery@5.2.7 ## Package Information -PackageName: click-didyoumean +PackageName: click SPDXID: SPDXRef-Package-Dependency-8 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/click ## Package Information -PackageName: click-plugins +PackageName: click-didyoumean SPDXID: SPDXRef-Package-Dependency-9 +PackageVersion: 0.3.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/click-didyoumean@0.3.0 ## Package Information -PackageName: click-repl +PackageName: click-plugins SPDXID: SPDXRef-Package-Dependency-10 +PackageVersion: 1.1.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/click-plugins@1.1.1 ## Package Information -PackageName: cryptography +PackageName: click-repl SPDXID: SPDXRef-Package-Dependency-11 +PackageVersion: 0.2.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/click-repl@0.2.0 ## Package Information -PackageName: flask +PackageName: click SPDXID: SPDXRef-Package-Dependency-12 +PackageVersion: 8.1.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/click@8.1.3 ## Package Information -PackageName: flask +PackageName: cryptography SPDXID: SPDXRef-Package-Dependency-13 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/cryptography ## Package Information -PackageName: gha-update +PackageName: flask SPDXID: SPDXRef-Package-Dependency-14 +PackageVersion: 2.3.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/flask@2.3.2 ## Package Information -PackageName: greenlet +PackageName: flask SPDXID: SPDXRef-Package-Dependency-15 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/flask ## Package Information -PackageName: importlib-metadata +PackageName: gha-update SPDXID: SPDXRef-Package-Dependency-16 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/gha-update ## Package Information -PackageName: itsdangerous +PackageName: greenlet SPDXID: SPDXRef-Package-Dependency-17 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/greenlet ## Package Information -PackageName: jinja2 +PackageName: importlib-metadata SPDXID: SPDXRef-Package-Dependency-18 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/importlib-metadata ## Package Information -PackageName: kombu +PackageName: itsdangerous SPDXID: SPDXRef-Package-Dependency-19 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/itsdangerous ## Package Information -PackageName: markupsafe +PackageName: itsdangerous SPDXID: SPDXRef-Package-Dependency-20 +PackageVersion: 2.1.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/itsdangerous@2.1.2 ## Package Information -PackageName: mypy +PackageName: jinja2 SPDXID: SPDXRef-Package-Dependency-21 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/jinja2 ## Package Information -PackageName: pallets-sphinx-themes +PackageName: jinja2 SPDXID: SPDXRef-Package-Dependency-22 +PackageVersion: 3.1.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/jinja2@3.1.2 ## Package Information -PackageName: pre-commit +PackageName: kombu SPDXID: SPDXRef-Package-Dependency-23 +PackageVersion: 5.2.4 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/kombu@5.2.4 ## Package Information -PackageName: pre-commit-uv +PackageName: markupsafe SPDXID: SPDXRef-Package-Dependency-24 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/markupsafe ## Package Information -PackageName: prompt-toolkit +PackageName: markupsafe SPDXID: SPDXRef-Package-Dependency-25 +PackageVersion: 2.1.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/markupsafe@2.1.2 ## Package Information -PackageName: pyright +PackageName: mypy SPDXID: SPDXRef-Package-Dependency-26 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/mypy ## Package Information -PackageName: pytest +PackageName: pallets-sphinx-themes SPDXID: SPDXRef-Package-Dependency-27 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pallets-sphinx-themes ## Package Information -PackageName: python-dotenv +PackageName: pre-commit SPDXID: SPDXRef-Package-Dependency-28 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pre-commit ## Package Information -PackageName: pytz +PackageName: pre-commit-uv SPDXID: SPDXRef-Package-Dependency-29 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pre-commit-uv ## Package Information -PackageName: redis +PackageName: prompt-toolkit SPDXID: SPDXRef-Package-Dependency-30 +PackageVersion: 3.0.38 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/prompt-toolkit@3.0.38 ## Package Information -PackageName: ruff +PackageName: pyright SPDXID: SPDXRef-Package-Dependency-31 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pyright ## Package Information -PackageName: six +PackageName: pytest SPDXID: SPDXRef-Package-Dependency-32 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pytest ## Package Information -PackageName: sphinx +PackageName: python-dotenv SPDXID: SPDXRef-Package-Dependency-33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/python-dotenv ## Package Information -PackageName: sphinx-autobuild +PackageName: pytz SPDXID: SPDXRef-Package-Dependency-34 +PackageVersion: 2023.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pytz@2023.3 ## Package Information -PackageName: sphinx-tabs +PackageName: redis SPDXID: SPDXRef-Package-Dependency-35 +PackageVersion: 4.5.4 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/redis@4.5.4 ## Package Information -PackageName: sphinxcontrib-log-cabinet +PackageName: ruff SPDXID: SPDXRef-Package-Dependency-36 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/ruff ## Package Information -PackageName: tox +PackageName: six SPDXID: SPDXRef-Package-Dependency-37 +PackageVersion: 1.16.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/six@1.16.0 ## Package Information -PackageName: tox-uv +PackageName: sphinx SPDXID: SPDXRef-Package-Dependency-38 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/sphinx ## Package Information -PackageName: types-contextvars +PackageName: sphinx-autobuild SPDXID: SPDXRef-Package-Dependency-39 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/sphinx-autobuild ## Package Information -PackageName: types-dataclasses +PackageName: sphinx-tabs SPDXID: SPDXRef-Package-Dependency-40 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/sphinx-tabs ## Package Information -PackageName: vine +PackageName: sphinxcontrib-log-cabinet SPDXID: SPDXRef-Package-Dependency-41 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/sphinxcontrib-log-cabinet ## Package Information -PackageName: wcwidth +PackageName: tox SPDXID: SPDXRef-Package-Dependency-42 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/tox ## Package Information -PackageName: werkzeug +PackageName: tox-uv SPDXID: SPDXRef-Package-Dependency-43 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/tox-uv +## Package Information +PackageName: types-contextvars +SPDXID: SPDXRef-Package-Dependency-44 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/types-contextvars +## Package Information +PackageName: types-dataclasses +SPDXID: SPDXRef-Package-Dependency-45 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/types-dataclasses +## Package Information +PackageName: vine +SPDXID: SPDXRef-Package-Dependency-46 +PackageVersion: 5.0.0 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/vine@5.0.0 +## Package Information +PackageName: wcwidth +SPDXID: SPDXRef-Package-Dependency-47 +PackageVersion: 0.2.6 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/wcwidth@0.2.6 +## Package Information +PackageName: werkzeug +SPDXID: SPDXRef-Package-Dependency-48 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/werkzeug +## Package Information +PackageName: werkzeug +SPDXID: SPDXRef-Package-Dependency-49 +PackageVersion: 2.3.3 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/werkzeug@2.3.3 ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-106 @@ -2282,57 +2408,56 @@ Relationship: SPDXRef-Package-unassigned CONTAINS SPDXRef-231 Relationship: SPDXRef-Package-unassigned CONTAINS SPDXRef-232 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-1 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-10 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-11 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-12 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-13 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-17 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-18 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-19 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-14 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-20 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-22 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-23 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-25 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-29 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-3 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-30 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-35 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-37 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-4 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-41 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-42 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-43 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-5 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-46 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-47 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-49 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-6 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-7 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-8 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-11 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-14 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-15 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-13 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-16 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-17 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-18 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-19 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-2 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-20 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-21 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-22 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-23 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-24 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-26 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-27 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-28 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-29 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-31 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-32 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-33 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-35 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-36 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-37 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-38 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-39 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-40 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-41 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-42 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-43 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-44 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-48 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-5 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-7 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-12 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-27 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-12 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-27 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-15 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-15 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-32 ## License Information LicenseID: LicenseRef-scancode-unknown-license-reference ExtractedText: See details at https://github.com/aboutcode-org/scancode-toolkit/tree/develop/src/licensedcode/data/rules/unknown-license-reference_see_license_at_manifest_2.RULE diff --git a/examples/sbom/ripgrep/README.md b/examples/sbom/ripgrep/README.md index b3afa5fef..f3e2e7c7a 100644 --- a/examples/sbom/ripgrep/README.md +++ b/examples/sbom/ripgrep/README.md @@ -11,8 +11,8 @@ SPDX tag-value ([`sbom.spdx`](sbom.spdx)) and CycloneDX JSON ([`sbom.cdx.json`]( ## What's inside -- **91 components** — the project plus every resolved dependency, each with a package URL (purl). -- **140 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). +- **107 components** — the project plus every resolved dependency, each with a package URL (purl). +- **135 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). ## How it compares diff --git a/examples/sbom/ripgrep/sbom.cdx.json b/examples/sbom/ripgrep/sbom.cdx.json index 107434b24..4f628ac04 100644 --- a/examples/sbom/ripgrep/sbom.cdx.json +++ b/examples/sbom/ripgrep/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:c56f4fa9-9afd-454b-8af9-081122de0c1f", + "serialNumber": "urn:uuid:97629256-60c7-481d-ada9-0cce9f7deb94", "version": 1, "metadata": { - "timestamp": "2026-07-24T07:16:23Z", + "timestamp": "2026-07-24T08:01:39Z", "tools": [ { "name": "Provenant", @@ -505,6 +505,7 @@ "bom-ref": "pkg:cargo/bstr@1.13.0", "name": "bstr", "version": "1.13.0", + "scope": "required", "purl": "pkg:cargo/bstr@1.13.0" }, { @@ -535,20 +536,34 @@ "version": "1.0.4", "purl": "pkg:cargo/cfg-if@1.0.4" }, + { + "type": "library", + "bom-ref": "pkg:cargo/crossbeam-channel", + "name": "crossbeam-channel", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/crossbeam-channel" + }, { "type": "library", "bom-ref": "pkg:cargo/crossbeam-channel@0.5.16", "name": "crossbeam-channel", "version": "0.5.16", - "scope": "required", "purl": "pkg:cargo/crossbeam-channel@0.5.16" }, + { + "type": "library", + "bom-ref": "pkg:cargo/crossbeam-deque", + "name": "crossbeam-deque", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/crossbeam-deque" + }, { "type": "library", "bom-ref": "pkg:cargo/crossbeam-deque@0.8.7", "name": "crossbeam-deque", "version": "0.8.7", - "scope": "required", "purl": "pkg:cargo/crossbeam-deque@0.8.7" }, { @@ -579,20 +594,34 @@ "version": "1.4.2", "purl": "pkg:cargo/derive_arbitrary@1.4.2" }, + { + "type": "library", + "bom-ref": "pkg:cargo/encoding_rs", + "name": "encoding_rs", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/encoding_rs" + }, { "type": "library", "bom-ref": "pkg:cargo/encoding_rs@0.8.35", "name": "encoding_rs", "version": "0.8.35", - "scope": "required", "purl": "pkg:cargo/encoding_rs@0.8.35" }, + { + "type": "library", + "bom-ref": "pkg:cargo/encoding_rs_io", + "name": "encoding_rs_io", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/encoding_rs_io" + }, { "type": "library", "bom-ref": "pkg:cargo/encoding_rs_io@0.1.7", "name": "encoding_rs_io", "version": "0.1.7", - "scope": "required", "purl": "pkg:cargo/encoding_rs_io@0.1.7" }, { @@ -609,14 +638,29 @@ "version": "0.4.3", "purl": "pkg:cargo/getrandom@0.4.3" }, + { + "type": "library", + "bom-ref": "pkg:cargo/glob", + "name": "glob", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/glob" + }, { "type": "library", "bom-ref": "pkg:cargo/glob@0.3.3", "name": "glob", "version": "0.3.3", - "scope": "required", "purl": "pkg:cargo/glob@0.3.3" }, + { + "type": "library", + "bom-ref": "pkg:cargo/globset@0.4.16", + "name": "globset", + "version": "0.4.16", + "scope": "required", + "purl": "pkg:cargo/globset@0.4.16" + }, { "type": "library", "bom-ref": "pkg:cargo/globset", @@ -627,10 +671,51 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/globset@0.4.16", - "name": "globset", - "version": "0.4.16", - "purl": "pkg:cargo/globset@0.4.16" + "bom-ref": "pkg:cargo/grep-cli", + "name": "grep-cli", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/grep-cli" + }, + { + "type": "library", + "bom-ref": "pkg:cargo/grep-matcher", + "name": "grep-matcher", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/grep-matcher" + }, + { + "type": "library", + "bom-ref": "pkg:cargo/grep-pcre2", + "name": "grep-pcre2", + "version": "unknown", + "scope": "optional", + "purl": "pkg:cargo/grep-pcre2" + }, + { + "type": "library", + "bom-ref": "pkg:cargo/grep-printer", + "name": "grep-printer", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/grep-printer" + }, + { + "type": "library", + "bom-ref": "pkg:cargo/grep-regex", + "name": "grep-regex", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/grep-regex" + }, + { + "type": "library", + "bom-ref": "pkg:cargo/grep-searcher", + "name": "grep-searcher", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/grep-searcher" }, { "type": "library", @@ -693,17 +778,18 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/log@0.4.20", + "bom-ref": "pkg:cargo/log@0.4.33", "name": "log", - "version": "0.4.20", - "purl": "pkg:cargo/log@0.4.20" + "version": "0.4.33", + "scope": "required", + "purl": "pkg:cargo/log@0.4.33" }, { "type": "library", - "bom-ref": "pkg:cargo/log@0.4.33", + "bom-ref": "pkg:cargo/log@0.4.20", "name": "log", - "version": "0.4.33", - "purl": "pkg:cargo/log@0.4.33" + "version": "0.4.20", + "purl": "pkg:cargo/log@0.4.20" }, { "type": "library", @@ -751,11 +837,11 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/pcre2@0.2.11", + "bom-ref": "pkg:cargo/pcre2", "name": "pcre2", - "version": "0.2.11", + "version": "unknown", "scope": "required", - "purl": "pkg:cargo/pcre2@0.2.11" + "purl": "pkg:cargo/pcre2" }, { "type": "library", @@ -764,6 +850,13 @@ "version": "0.2.10", "purl": "pkg:cargo/pcre2-sys@0.2.10" }, + { + "type": "library", + "bom-ref": "pkg:cargo/pcre2@0.2.11", + "name": "pcre2", + "version": "0.2.11", + "purl": "pkg:cargo/pcre2@0.2.11" + }, { "type": "library", "bom-ref": "pkg:cargo/pkg-config@0.3.33", @@ -808,11 +901,11 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/regex@1.13.0", + "bom-ref": "pkg:cargo/regex", "name": "regex", - "version": "1.13.0", + "version": "unknown", "scope": "required", - "purl": "pkg:cargo/regex@1.13.0" + "purl": "pkg:cargo/regex" }, { "type": "library", @@ -858,12 +951,26 @@ "version": "0.8.2", "purl": "pkg:cargo/regex-syntax@0.8.2" }, + { + "type": "library", + "bom-ref": "pkg:cargo/regex@1.13.0", + "name": "regex", + "version": "1.13.0", + "purl": "pkg:cargo/regex@1.13.0" + }, + { + "type": "library", + "bom-ref": "pkg:cargo/same-file", + "name": "same-file", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/same-file" + }, { "type": "library", "bom-ref": "pkg:cargo/same-file@1.0.6", "name": "same-file", "version": "1.0.6", - "scope": "required", "purl": "pkg:cargo/same-file@1.0.6" }, { @@ -871,22 +978,23 @@ "bom-ref": "pkg:cargo/serde", "name": "serde", "version": "unknown", - "scope": "required", + "scope": "optional", "purl": "pkg:cargo/serde" }, { "type": "library", - "bom-ref": "pkg:cargo/serde@1.0.195", + "bom-ref": "pkg:cargo/serde@1.0.228", "name": "serde", - "version": "1.0.195", - "purl": "pkg:cargo/serde@1.0.195" + "version": "1.0.228", + "scope": "required", + "purl": "pkg:cargo/serde@1.0.228" }, { "type": "library", - "bom-ref": "pkg:cargo/serde@1.0.228", + "bom-ref": "pkg:cargo/serde@1.0.195", "name": "serde", - "version": "1.0.228", - "purl": "pkg:cargo/serde@1.0.228" + "version": "1.0.195", + "purl": "pkg:cargo/serde@1.0.195" }, { "type": "library", @@ -897,11 +1005,11 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/serde_derive", + "bom-ref": "pkg:cargo/serde_derive@1.0.228", "name": "serde_derive", - "version": "unknown", + "version": "1.0.228", "scope": "required", - "purl": "pkg:cargo/serde_derive" + "purl": "pkg:cargo/serde_derive@1.0.228" }, { "type": "library", @@ -912,10 +1020,11 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/serde_derive@1.0.228", - "name": "serde_derive", - "version": "1.0.228", - "purl": "pkg:cargo/serde_derive@1.0.228" + "bom-ref": "pkg:cargo/serde_json", + "name": "serde_json", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/serde_json" }, { "type": "library", @@ -946,6 +1055,14 @@ "version": "2.0.48", "purl": "pkg:cargo/syn@2.0.48" }, + { + "type": "library", + "bom-ref": "pkg:cargo/termcolor", + "name": "termcolor", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/termcolor" + }, { "type": "library", "bom-ref": "pkg:cargo/termcolor@1.4.1", @@ -998,6 +1115,14 @@ "scope": "required", "purl": "pkg:cargo/walkdir@2.5.0" }, + { + "type": "library", + "bom-ref": "pkg:cargo/walkdir", + "name": "walkdir", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/walkdir" + }, { "type": "library", "bom-ref": "pkg:cargo/winapi-util@0.1.11", @@ -1080,10 +1205,18 @@ "ref": "pkg:cargo/cfg-if@1.0.4", "dependsOn": [] }, + { + "ref": "pkg:cargo/crossbeam-channel", + "dependsOn": [] + }, { "ref": "pkg:cargo/crossbeam-channel@0.5.16", "dependsOn": [] }, + { + "ref": "pkg:cargo/crossbeam-deque", + "dependsOn": [] + }, { "ref": "pkg:cargo/crossbeam-deque@0.8.7", "dependsOn": [] @@ -1104,10 +1237,18 @@ "ref": "pkg:cargo/derive_arbitrary@1.4.2", "dependsOn": [] }, + { + "ref": "pkg:cargo/encoding_rs", + "dependsOn": [] + }, { "ref": "pkg:cargo/encoding_rs@0.8.35", "dependsOn": [] }, + { + "ref": "pkg:cargo/encoding_rs_io", + "dependsOn": [] + }, { "ref": "pkg:cargo/encoding_rs_io@0.1.7", "dependsOn": [] @@ -1124,7 +1265,6 @@ "pkg:cargo/bstr@1.9.0", "pkg:cargo/cc@1.0.83", "pkg:cargo/derive_arbitrary@1.3.2", - "pkg:cargo/globset", "pkg:cargo/globset@0.4.16", "pkg:cargo/jobserver@0.1.27", "pkg:cargo/libc@0.2.152", @@ -1146,6 +1286,10 @@ "ref": "pkg:cargo/getrandom@0.4.3", "dependsOn": [] }, + { + "ref": "pkg:cargo/glob", + "dependsOn": [] + }, { "ref": "pkg:cargo/glob@0.3.3", "dependsOn": [] @@ -1164,100 +1308,124 @@ "pkg:cargo/aho-corasick", "pkg:cargo/arbitrary", "pkg:cargo/bstr", - "pkg:cargo/glob@0.3.3", + "pkg:cargo/glob", "pkg:cargo/log", "pkg:cargo/regex-automata", "pkg:cargo/regex-syntax", "pkg:cargo/serde", - "pkg:cargo/serde_json@1.0.150" + "pkg:cargo/serde_json" ] }, + { + "ref": "pkg:cargo/grep-cli", + "dependsOn": [] + }, { "ref": "pkg:cargo/grep-cli@0.1.12", "dependsOn": [ "pkg:cargo/bstr", "pkg:cargo/globset", "pkg:cargo/log", - "pkg:cargo/termcolor@1.4.1" + "pkg:cargo/termcolor" ] }, + { + "ref": "pkg:cargo/grep-matcher", + "dependsOn": [] + }, { "ref": "pkg:cargo/grep-matcher@0.1.9", "dependsOn": [ "pkg:cargo/memchr", - "pkg:cargo/regex@1.13.0" + "pkg:cargo/regex" ] }, + { + "ref": "pkg:cargo/grep-pcre2", + "dependsOn": [] + }, { "ref": "pkg:cargo/grep-pcre2@0.1.10", "dependsOn": [ - "pkg:cargo/grep-matcher@0.1.9", + "pkg:cargo/grep-matcher", "pkg:cargo/log", - "pkg:cargo/pcre2@0.2.11" + "pkg:cargo/pcre2" ] }, + { + "ref": "pkg:cargo/grep-printer", + "dependsOn": [] + }, { "ref": "pkg:cargo/grep-printer@0.3.1", "dependsOn": [ "pkg:cargo/bstr", - "pkg:cargo/grep-matcher@0.1.9", - "pkg:cargo/grep-regex@0.1.14", - "pkg:cargo/grep-searcher@0.1.17", + "pkg:cargo/grep-matcher", + "pkg:cargo/grep-regex", + "pkg:cargo/grep-searcher", "pkg:cargo/log", "pkg:cargo/serde", - "pkg:cargo/serde_json@1.0.150", - "pkg:cargo/termcolor@1.4.1" + "pkg:cargo/serde_json", + "pkg:cargo/termcolor" ] }, + { + "ref": "pkg:cargo/grep-regex", + "dependsOn": [] + }, { "ref": "pkg:cargo/grep-regex@0.1.14", "dependsOn": [ "pkg:cargo/bstr", - "pkg:cargo/grep-matcher@0.1.9", + "pkg:cargo/grep-matcher", "pkg:cargo/log", "pkg:cargo/regex-automata", "pkg:cargo/regex-syntax" ] }, + { + "ref": "pkg:cargo/grep-searcher", + "dependsOn": [] + }, { "ref": "pkg:cargo/grep-searcher@0.1.17", "dependsOn": [ "pkg:cargo/bstr", - "pkg:cargo/encoding_rs@0.8.35", - "pkg:cargo/encoding_rs_io@0.1.7", - "pkg:cargo/grep-matcher@0.1.9", - "pkg:cargo/grep-regex@0.1.14", + "pkg:cargo/encoding_rs", + "pkg:cargo/encoding_rs_io", + "pkg:cargo/grep-matcher", + "pkg:cargo/grep-regex", "pkg:cargo/log", "pkg:cargo/memchr", "pkg:cargo/memmap", - "pkg:cargo/regex@1.13.0" + "pkg:cargo/regex" ] }, { "ref": "pkg:cargo/grep@0.4.1", "dependsOn": [ - "pkg:cargo/grep-cli@0.1.12", - "pkg:cargo/grep-matcher@0.1.9", - "pkg:cargo/grep-pcre2@0.1.10", - "pkg:cargo/grep-printer@0.3.1", - "pkg:cargo/grep-regex@0.1.14", - "pkg:cargo/grep-searcher@0.1.17", - "pkg:cargo/termcolor@1.4.1", - "pkg:cargo/walkdir@2.5.0" + "pkg:cargo/grep-cli", + "pkg:cargo/grep-matcher", + "pkg:cargo/grep-pcre2", + "pkg:cargo/grep-printer", + "pkg:cargo/grep-regex", + "pkg:cargo/grep-searcher", + "pkg:cargo/termcolor", + "pkg:cargo/walkdir" ] }, { "ref": "pkg:cargo/ignore@0.4.29", "dependsOn": [ "pkg:cargo/bstr", - "pkg:cargo/crossbeam-channel@0.5.16", - "pkg:cargo/crossbeam-deque@0.8.7", + "pkg:cargo/crossbeam-channel", + "pkg:cargo/crossbeam-deque", "pkg:cargo/globset", "pkg:cargo/log", "pkg:cargo/memchr", "pkg:cargo/regex-automata", - "pkg:cargo/same-file@1.0.6", - "pkg:cargo/walkdir@2.5.0" + "pkg:cargo/same-file", + "pkg:cargo/walkdir" ] }, { @@ -1324,6 +1492,10 @@ "ref": "pkg:cargo/once_cell@1.19.0", "dependsOn": [] }, + { + "ref": "pkg:cargo/pcre2", + "dependsOn": [] + }, { "ref": "pkg:cargo/pcre2-sys@0.2.10", "dependsOn": [] @@ -1356,6 +1528,10 @@ "ref": "pkg:cargo/r-efi@6.0.0", "dependsOn": [] }, + { + "ref": "pkg:cargo/regex", + "dependsOn": [] + }, { "ref": "pkg:cargo/regex-automata", "dependsOn": [] @@ -1390,7 +1566,6 @@ "pkg:cargo/aho-corasick@1.1.4", "pkg:cargo/anyhow@1.0.103", "pkg:cargo/arbitrary@1.4.2", - "pkg:cargo/bstr", "pkg:cargo/bstr@1.13.0", "pkg:cargo/cc@1.2.67", "pkg:cargo/cfg-if@1.0.4", @@ -1417,7 +1592,6 @@ "pkg:cargo/jobserver@0.1.35", "pkg:cargo/lexopt@0.3.2", "pkg:cargo/libc@0.2.186", - "pkg:cargo/log", "pkg:cargo/log@0.4.33", "pkg:cargo/memchr@2.8.3", "pkg:cargo/memmap2@0.9.11", @@ -1431,10 +1605,8 @@ "pkg:cargo/regex-syntax@0.8.11", "pkg:cargo/regex@1.13.0", "pkg:cargo/same-file@1.0.6", - "pkg:cargo/serde", "pkg:cargo/serde@1.0.228", "pkg:cargo/serde_core@1.0.228", - "pkg:cargo/serde_derive", "pkg:cargo/serde_derive@1.0.228", "pkg:cargo/serde_json@1.0.150", "pkg:cargo/shlex@2.0.1", @@ -1451,6 +1623,10 @@ "pkg:cargo/zmij@1.0.23" ] }, + { + "ref": "pkg:cargo/same-file", + "dependsOn": [] + }, { "ref": "pkg:cargo/same-file@1.0.6", "dependsOn": [] @@ -1472,15 +1648,15 @@ "dependsOn": [] }, { - "ref": "pkg:cargo/serde_derive", + "ref": "pkg:cargo/serde_derive@1.0.195", "dependsOn": [] }, { - "ref": "pkg:cargo/serde_derive@1.0.195", + "ref": "pkg:cargo/serde_derive@1.0.228", "dependsOn": [] }, { - "ref": "pkg:cargo/serde_derive@1.0.228", + "ref": "pkg:cargo/serde_json", "dependsOn": [] }, { @@ -1499,6 +1675,10 @@ "ref": "pkg:cargo/syn@2.0.48", "dependsOn": [] }, + { + "ref": "pkg:cargo/termcolor", + "dependsOn": [] + }, { "ref": "pkg:cargo/termcolor@1.4.1", "dependsOn": [] @@ -1523,6 +1703,10 @@ "ref": "pkg:cargo/unicode-ident@1.0.24", "dependsOn": [] }, + { + "ref": "pkg:cargo/walkdir", + "dependsOn": [] + }, { "ref": "pkg:cargo/walkdir@2.5.0", "dependsOn": [] diff --git a/examples/sbom/ripgrep/sbom.spdx b/examples/sbom/ripgrep/sbom.spdx index 693376e48..1bae8d031 100644 --- a/examples/sbom/ripgrep/sbom.spdx +++ b/examples/sbom/ripgrep/sbom.spdx @@ -13,10 +13,11 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-24T07:16:22Z +Created: 2026-07-24T08:01:38Z ## Package Information PackageName: fuzz SPDXID: SPDXRef-Package-1 +PackageVersion: 0.0.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 2e0767dbc9bb91ae59bf5f4297e72f9c2874882f @@ -24,9 +25,11 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/fuzz@0.0.1 ## Package Information PackageName: globset SPDXID: SPDXRef-Package-2 +PackageVersion: 0.4.19 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: a4641fc7440f9435dd38377ec029842221bf09f2 @@ -35,9 +38,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/globset@0.4.19 ## Package Information PackageName: grep-cli SPDXID: SPDXRef-Package-3 +PackageVersion: 0.1.12 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 0daec6527430984dfbfdcfa3a357a12e1b5d0eca @@ -46,9 +51,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-cli@0.1.12 ## Package Information PackageName: grep-matcher SPDXID: SPDXRef-Package-4 +PackageVersion: 0.1.9 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 01472b4d18bdd34567f7f2edc91523083ff525ef @@ -57,9 +64,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-matcher@0.1.9 ## Package Information PackageName: grep-pcre2 SPDXID: SPDXRef-Package-5 +PackageVersion: 0.1.10 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 4a55ed8385f20049c341a93c614634ab225c3506 @@ -68,9 +77,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-pcre2@0.1.10 ## Package Information PackageName: grep-printer SPDXID: SPDXRef-Package-6 +PackageVersion: 0.3.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 016a80314935f80eae19154c6bf99520ba63eff3 @@ -79,9 +90,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-printer@0.3.1 ## Package Information PackageName: grep-regex SPDXID: SPDXRef-Package-7 +PackageVersion: 0.1.14 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: a6eebff08f9c03fe260145837a6e59a0ca67570a @@ -90,9 +103,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-regex@0.1.14 ## Package Information PackageName: grep-searcher SPDXID: SPDXRef-Package-8 +PackageVersion: 0.1.17 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 835822eb40ce254ad0cf4cb1df89c814613d47ea @@ -101,9 +116,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-searcher@0.1.17 ## Package Information PackageName: grep SPDXID: SPDXRef-Package-9 +PackageVersion: 0.4.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 4a55ed8385f20049c341a93c614634ab225c3506 @@ -112,9 +129,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep@0.4.1 ## Package Information PackageName: ignore SPDXID: SPDXRef-Package-10 +PackageVersion: 0.4.29 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: ff7a120ddcac30925f40819e3f4254c91d372057 @@ -127,9 +146,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/ignore@0.4.29 ## Package Information PackageName: ripgrep SPDXID: SPDXRef-Package-11 +PackageVersion: 15.2.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 5da12ee7757ca1904c357805da062b8b7da23282 @@ -148,6 +169,7 @@ PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2011 Github Copyright (c) 2011 Github zsh-users - http://github.com/zsh-users Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/ripgrep@15.2.0 ## File Information FileName: ./.cargo/config.toml SPDXID: SPDXRef-1 @@ -1723,30 +1745,37 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/aho-corasick ## Package Information PackageName: aho-corasick SPDXID: SPDXRef-Package-Dependency-2 +PackageVersion: 1.1.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/aho-corasick@1.1.2 ## Package Information PackageName: aho-corasick SPDXID: SPDXRef-Package-Dependency-3 +PackageVersion: 1.1.4 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/aho-corasick@1.1.4 ## Package Information PackageName: anyhow SPDXID: SPDXRef-Package-Dependency-4 +PackageVersion: 1.0.103 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/anyhow@1.0.103 ## Package Information PackageName: arbitrary SPDXID: SPDXRef-Package-Dependency-5 @@ -1755,22 +1784,27 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/arbitrary ## Package Information PackageName: arbitrary SPDXID: SPDXRef-Package-Dependency-6 +PackageVersion: 1.3.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/arbitrary@1.3.2 ## Package Information PackageName: arbitrary SPDXID: SPDXRef-Package-Dependency-7 +PackageVersion: 1.4.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/arbitrary@1.4.2 ## Package Information PackageName: bstr SPDXID: SPDXRef-Package-Dependency-8 @@ -1779,46 +1813,57 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/bstr ## Package Information PackageName: bstr SPDXID: SPDXRef-Package-Dependency-9 +PackageVersion: 1.13.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/bstr@1.13.0 ## Package Information PackageName: bstr SPDXID: SPDXRef-Package-Dependency-10 +PackageVersion: 1.9.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/bstr@1.9.0 ## Package Information PackageName: cc SPDXID: SPDXRef-Package-Dependency-11 +PackageVersion: 1.0.83 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/cc@1.0.83 ## Package Information PackageName: cc SPDXID: SPDXRef-Package-Dependency-12 +PackageVersion: 1.2.67 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/cc@1.2.67 ## Package Information PackageName: cfg-if SPDXID: SPDXRef-Package-Dependency-13 +PackageVersion: 1.0.4 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/cfg-if@1.0.4 ## Package Information PackageName: crossbeam-channel SPDXID: SPDXRef-Package-Dependency-14 @@ -1827,534 +1872,804 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-channel ## Package Information -PackageName: crossbeam-deque +PackageName: crossbeam-channel SPDXID: SPDXRef-Package-Dependency-15 +PackageVersion: 0.5.16 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-channel@0.5.16 ## Package Information -PackageName: crossbeam-epoch +PackageName: crossbeam-deque SPDXID: SPDXRef-Package-Dependency-16 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-deque ## Package Information -PackageName: crossbeam-utils +PackageName: crossbeam-deque SPDXID: SPDXRef-Package-Dependency-17 +PackageVersion: 0.8.7 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-deque@0.8.7 ## Package Information -PackageName: derive_arbitrary +PackageName: crossbeam-epoch SPDXID: SPDXRef-Package-Dependency-18 +PackageVersion: 0.9.20 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-epoch@0.9.20 ## Package Information -PackageName: derive_arbitrary +PackageName: crossbeam-utils SPDXID: SPDXRef-Package-Dependency-19 +PackageVersion: 0.8.22 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-utils@0.8.22 ## Package Information -PackageName: encoding_rs +PackageName: derive_arbitrary SPDXID: SPDXRef-Package-Dependency-20 +PackageVersion: 1.3.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/derive_arbitrary@1.3.2 ## Package Information -PackageName: encoding_rs_io +PackageName: derive_arbitrary SPDXID: SPDXRef-Package-Dependency-21 +PackageVersion: 1.4.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/derive_arbitrary@1.4.2 ## Package Information -PackageName: find-msvc-tools +PackageName: encoding_rs SPDXID: SPDXRef-Package-Dependency-22 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/encoding_rs ## Package Information -PackageName: getrandom +PackageName: encoding_rs SPDXID: SPDXRef-Package-Dependency-23 +PackageVersion: 0.8.35 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/encoding_rs@0.8.35 ## Package Information -PackageName: glob +PackageName: encoding_rs_io SPDXID: SPDXRef-Package-Dependency-24 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/encoding_rs_io ## Package Information -PackageName: globset +PackageName: encoding_rs_io SPDXID: SPDXRef-Package-Dependency-25 +PackageVersion: 0.1.7 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/encoding_rs_io@0.1.7 ## Package Information -PackageName: globset +PackageName: find-msvc-tools SPDXID: SPDXRef-Package-Dependency-26 +PackageVersion: 0.1.9 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/find-msvc-tools@0.1.9 ## Package Information -PackageName: itoa +PackageName: getrandom SPDXID: SPDXRef-Package-Dependency-27 +PackageVersion: 0.4.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/getrandom@0.4.3 ## Package Information -PackageName: jobserver +PackageName: glob SPDXID: SPDXRef-Package-Dependency-28 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/glob ## Package Information -PackageName: jobserver +PackageName: glob SPDXID: SPDXRef-Package-Dependency-29 +PackageVersion: 0.3.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/glob@0.3.3 ## Package Information -PackageName: lexopt +PackageName: globset SPDXID: SPDXRef-Package-Dependency-30 +PackageVersion: 0.4.16 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/globset@0.4.16 ## Package Information -PackageName: libc +PackageName: globset SPDXID: SPDXRef-Package-Dependency-31 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/globset ## Package Information -PackageName: libc +PackageName: grep-cli SPDXID: SPDXRef-Package-Dependency-32 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-cli ## Package Information -PackageName: libfuzzer-sys +PackageName: grep-matcher SPDXID: SPDXRef-Package-Dependency-33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-matcher ## Package Information -PackageName: log +PackageName: grep-pcre2 SPDXID: SPDXRef-Package-Dependency-34 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-pcre2 ## Package Information -PackageName: log +PackageName: grep-printer SPDXID: SPDXRef-Package-Dependency-35 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-printer ## Package Information -PackageName: log +PackageName: grep-regex SPDXID: SPDXRef-Package-Dependency-36 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-regex ## Package Information -PackageName: memchr +PackageName: grep-searcher SPDXID: SPDXRef-Package-Dependency-37 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-searcher ## Package Information -PackageName: memchr +PackageName: itoa SPDXID: SPDXRef-Package-Dependency-38 +PackageVersion: 1.0.18 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/itoa@1.0.18 ## Package Information -PackageName: memchr +PackageName: jobserver SPDXID: SPDXRef-Package-Dependency-39 +PackageVersion: 0.1.27 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/jobserver@0.1.27 ## Package Information -PackageName: memmap +PackageName: jobserver SPDXID: SPDXRef-Package-Dependency-40 +PackageVersion: 0.1.35 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/jobserver@0.1.35 ## Package Information -PackageName: memmap2 +PackageName: lexopt SPDXID: SPDXRef-Package-Dependency-41 +PackageVersion: 0.3.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/lexopt@0.3.2 ## Package Information -PackageName: once_cell +PackageName: libc SPDXID: SPDXRef-Package-Dependency-42 +PackageVersion: 0.2.152 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/libc@0.2.152 ## Package Information -PackageName: pcre2 +PackageName: libc SPDXID: SPDXRef-Package-Dependency-43 +PackageVersion: 0.2.186 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/libc@0.2.186 ## Package Information -PackageName: pcre2-sys +PackageName: libfuzzer-sys SPDXID: SPDXRef-Package-Dependency-44 +PackageVersion: 0.4.7 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/libfuzzer-sys@0.4.7 ## Package Information -PackageName: pkg-config +PackageName: log SPDXID: SPDXRef-Package-Dependency-45 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/log ## Package Information -PackageName: proc-macro2 +PackageName: log SPDXID: SPDXRef-Package-Dependency-46 +PackageVersion: 0.4.33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/log@0.4.33 ## Package Information -PackageName: proc-macro2 +PackageName: log SPDXID: SPDXRef-Package-Dependency-47 +PackageVersion: 0.4.20 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/log@0.4.20 ## Package Information -PackageName: quote +PackageName: memchr SPDXID: SPDXRef-Package-Dependency-48 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/memchr ## Package Information -PackageName: quote +PackageName: memchr SPDXID: SPDXRef-Package-Dependency-49 +PackageVersion: 2.7.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/memchr@2.7.1 ## Package Information -PackageName: r-efi +PackageName: memchr SPDXID: SPDXRef-Package-Dependency-50 +PackageVersion: 2.8.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/memchr@2.8.3 ## Package Information -PackageName: regex +PackageName: memmap SPDXID: SPDXRef-Package-Dependency-51 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/memmap ## Package Information -PackageName: regex-automata +PackageName: memmap2 SPDXID: SPDXRef-Package-Dependency-52 +PackageVersion: 0.9.11 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/memmap2@0.9.11 ## Package Information -PackageName: regex-automata +PackageName: once_cell SPDXID: SPDXRef-Package-Dependency-53 +PackageVersion: 1.19.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/once_cell@1.19.0 ## Package Information -PackageName: regex-automata +PackageName: pcre2 SPDXID: SPDXRef-Package-Dependency-54 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/pcre2 ## Package Information -PackageName: regex-syntax +PackageName: pcre2-sys SPDXID: SPDXRef-Package-Dependency-55 +PackageVersion: 0.2.10 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/pcre2-sys@0.2.10 ## Package Information -PackageName: regex-syntax +PackageName: pcre2 SPDXID: SPDXRef-Package-Dependency-56 +PackageVersion: 0.2.11 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/pcre2@0.2.11 ## Package Information -PackageName: regex-syntax +PackageName: pkg-config SPDXID: SPDXRef-Package-Dependency-57 +PackageVersion: 0.3.33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/pkg-config@0.3.33 ## Package Information -PackageName: same-file +PackageName: proc-macro2 SPDXID: SPDXRef-Package-Dependency-58 +PackageVersion: 1.0.106 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/proc-macro2@1.0.106 ## Package Information -PackageName: serde +PackageName: proc-macro2 SPDXID: SPDXRef-Package-Dependency-59 +PackageVersion: 1.0.78 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/proc-macro2@1.0.78 ## Package Information -PackageName: serde +PackageName: quote SPDXID: SPDXRef-Package-Dependency-60 +PackageVersion: 1.0.35 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/quote@1.0.35 ## Package Information -PackageName: serde +PackageName: quote SPDXID: SPDXRef-Package-Dependency-61 +PackageVersion: 1.0.46 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/quote@1.0.46 ## Package Information -PackageName: serde_core +PackageName: r-efi SPDXID: SPDXRef-Package-Dependency-62 +PackageVersion: 6.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/r-efi@6.0.0 ## Package Information -PackageName: serde_derive +PackageName: regex SPDXID: SPDXRef-Package-Dependency-63 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex ## Package Information -PackageName: serde_derive +PackageName: regex-automata SPDXID: SPDXRef-Package-Dependency-64 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-automata ## Package Information -PackageName: serde_derive +PackageName: regex-automata SPDXID: SPDXRef-Package-Dependency-65 +PackageVersion: 0.4.15 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-automata@0.4.15 ## Package Information -PackageName: serde_json +PackageName: regex-automata SPDXID: SPDXRef-Package-Dependency-66 +PackageVersion: 0.4.4 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-automata@0.4.4 ## Package Information -PackageName: shlex +PackageName: regex-syntax SPDXID: SPDXRef-Package-Dependency-67 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-syntax ## Package Information -PackageName: syn +PackageName: regex-syntax SPDXID: SPDXRef-Package-Dependency-68 +PackageVersion: 0.8.11 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-syntax@0.8.11 ## Package Information -PackageName: syn +PackageName: regex-syntax SPDXID: SPDXRef-Package-Dependency-69 +PackageVersion: 0.8.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-syntax@0.8.2 ## Package Information -PackageName: termcolor +PackageName: regex SPDXID: SPDXRef-Package-Dependency-70 +PackageVersion: 1.13.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex@1.13.0 ## Package Information -PackageName: textwrap +PackageName: same-file SPDXID: SPDXRef-Package-Dependency-71 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/same-file ## Package Information -PackageName: tikv-jemalloc-sys +PackageName: same-file SPDXID: SPDXRef-Package-Dependency-72 +PackageVersion: 1.0.6 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/same-file@1.0.6 ## Package Information -PackageName: tikv-jemallocator +PackageName: serde SPDXID: SPDXRef-Package-Dependency-73 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde ## Package Information -PackageName: unicode-ident +PackageName: serde SPDXID: SPDXRef-Package-Dependency-74 +PackageVersion: 1.0.228 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde@1.0.228 ## Package Information -PackageName: unicode-ident +PackageName: serde SPDXID: SPDXRef-Package-Dependency-75 +PackageVersion: 1.0.195 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde@1.0.195 ## Package Information -PackageName: walkdir +PackageName: serde_core SPDXID: SPDXRef-Package-Dependency-76 +PackageVersion: 1.0.228 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_core@1.0.228 ## Package Information -PackageName: winapi-util +PackageName: serde_derive SPDXID: SPDXRef-Package-Dependency-77 +PackageVersion: 1.0.228 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_derive@1.0.228 ## Package Information -PackageName: windows-link +PackageName: serde_derive SPDXID: SPDXRef-Package-Dependency-78 +PackageVersion: 1.0.195 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_derive@1.0.195 ## Package Information -PackageName: windows-sys +PackageName: serde_json SPDXID: SPDXRef-Package-Dependency-79 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_json ## Package Information -PackageName: zmij +PackageName: serde_json SPDXID: SPDXRef-Package-Dependency-80 +PackageVersion: 1.0.150 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_json@1.0.150 +## Package Information +PackageName: shlex +SPDXID: SPDXRef-Package-Dependency-81 +PackageVersion: 2.0.1 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/shlex@2.0.1 +## Package Information +PackageName: syn +SPDXID: SPDXRef-Package-Dependency-82 +PackageVersion: 2.0.119 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/syn@2.0.119 +## Package Information +PackageName: syn +SPDXID: SPDXRef-Package-Dependency-83 +PackageVersion: 2.0.48 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/syn@2.0.48 +## Package Information +PackageName: termcolor +SPDXID: SPDXRef-Package-Dependency-84 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/termcolor +## Package Information +PackageName: termcolor +SPDXID: SPDXRef-Package-Dependency-85 +PackageVersion: 1.4.1 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/termcolor@1.4.1 +## Package Information +PackageName: textwrap +SPDXID: SPDXRef-Package-Dependency-86 +PackageVersion: 0.16.2 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/textwrap@0.16.2 +## Package Information +PackageName: tikv-jemalloc-sys +SPDXID: SPDXRef-Package-Dependency-87 +PackageVersion: 0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tikv-jemalloc-sys@0.7.1%2B5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8 +## Package Information +PackageName: tikv-jemallocator +SPDXID: SPDXRef-Package-Dependency-88 +PackageVersion: 0.7.0 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tikv-jemallocator@0.7.0 +## Package Information +PackageName: unicode-ident +SPDXID: SPDXRef-Package-Dependency-89 +PackageVersion: 1.0.12 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/unicode-ident@1.0.12 +## Package Information +PackageName: unicode-ident +SPDXID: SPDXRef-Package-Dependency-90 +PackageVersion: 1.0.24 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/unicode-ident@1.0.24 +## Package Information +PackageName: walkdir +SPDXID: SPDXRef-Package-Dependency-91 +PackageVersion: 2.5.0 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/walkdir@2.5.0 +## Package Information +PackageName: walkdir +SPDXID: SPDXRef-Package-Dependency-92 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/walkdir +## Package Information +PackageName: winapi-util +SPDXID: SPDXRef-Package-Dependency-93 +PackageVersion: 0.1.11 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/winapi-util@0.1.11 +## Package Information +PackageName: windows-link +SPDXID: SPDXRef-Package-Dependency-94 +PackageVersion: 0.2.1 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/windows-link@0.2.1 +## Package Information +PackageName: windows-sys +SPDXID: SPDXRef-Package-Dependency-95 +PackageVersion: 0.61.2 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/windows-sys@0.61.2 +## Package Information +PackageName: zmij +SPDXID: SPDXRef-Package-Dependency-96 +PackageVersion: 1.0.23 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/zmij@1.0.23 ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-192 @@ -2701,34 +3016,33 @@ Relationship: SPDXRef-Package-11 CONTAINS SPDXRef-218 Relationship: SPDXRef-Package-11 CONTAINS SPDXRef-219 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-10 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-11 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-18 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-2 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-25 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-26 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-28 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-31 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-33 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-38 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-20 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-30 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-39 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-42 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-44 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-47 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-48 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-54 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-57 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-49 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-53 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-59 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-6 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-60 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-64 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-66 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-69 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-74 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-75 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-78 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-83 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-89 Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-14 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-15 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-25 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-37 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-52 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-58 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-76 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-16 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-31 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-48 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-64 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-71 Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-92 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-10 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-2 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-3 @@ -2740,105 +3054,101 @@ Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-8 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-12 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-13 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-14 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-15 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-16 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-17 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-18 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-19 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-20 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-21 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-22 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-23 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-24 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-25 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-26 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-27 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-29 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-3 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-30 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-32 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-36 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-39 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-38 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-4 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-40 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-41 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-43 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-44 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-45 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-46 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-49 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-51 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-53 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-52 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-55 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-56 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-57 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-58 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-59 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-61 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-62 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-63 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-65 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-66 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-67 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-68 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-7 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-70 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-71 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-72 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-73 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-75 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-74 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-76 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-77 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-78 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-79 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-8 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-80 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-81 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-82 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-85 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-86 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-87 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-88 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-9 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-90 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-91 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-93 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-94 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-95 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-96 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-1 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-24 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-28 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-45 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-5 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-52 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-55 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-59 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-66 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-64 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-67 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-73 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-79 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-8 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-25 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-70 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-31 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-45 Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-8 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-37 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-51 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-4 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-43 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-4 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-7 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-8 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-59 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-66 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-70 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-84 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-48 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-63 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-54 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-36 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-37 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-73 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-79 Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-8 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-4 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-52 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-55 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-84 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-64 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-67 Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-8 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-4 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-7 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-20 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-21 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-37 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-40 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-22 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-24 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-36 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-48 Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-51 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-63 Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-8 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-3 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-4 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-5 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-6 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-7 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-8 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-70 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-76 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-35 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-36 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-37 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-84 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-92 ## License Information LicenseID: LicenseRef-scancode-unknown-license-reference ExtractedText: See details at https://github.com/aboutcode-org/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lead-in_unknown_30.RULE diff --git a/examples/sbom/tokio/README.md b/examples/sbom/tokio/README.md index 0564fcdac..0ff98590f 100644 --- a/examples/sbom/tokio/README.md +++ b/examples/sbom/tokio/README.md @@ -11,7 +11,7 @@ SPDX tag-value ([`sbom.spdx`](sbom.spdx)) and CycloneDX JSON ([`sbom.cdx.json`]( ## What's inside -- **46 components** — the project plus every resolved dependency, each with a package URL (purl). +- **51 components** — the project plus every resolved dependency, each with a package URL (purl). - **80 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). ## How it compares diff --git a/examples/sbom/tokio/sbom.cdx.json b/examples/sbom/tokio/sbom.cdx.json index 1b80526dd..571527508 100644 --- a/examples/sbom/tokio/sbom.cdx.json +++ b/examples/sbom/tokio/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:affd4893-61f4-4be1-91b6-49e89907c769", + "serialNumber": "urn:uuid:abc23e86-21fc-45d2-aa08-5ffe58efb2e9", "version": 1, "metadata": { - "timestamp": "2026-07-24T07:16:31Z", + "timestamp": "2026-07-24T08:01:51Z", "tools": [ { "name": "Provenant", @@ -628,6 +628,46 @@ "scope": "required", "purl": "pkg:cargo/tempfile" }, + { + "type": "library", + "bom-ref": "pkg:cargo/tokio", + "name": "tokio", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/tokio" + }, + { + "type": "library", + "bom-ref": "pkg:cargo/tokio-macros", + "name": "tokio-macros", + "version": "unknown", + "scope": "optional", + "purl": "pkg:cargo/tokio-macros" + }, + { + "type": "library", + "bom-ref": "pkg:cargo/tokio-stream", + "name": "tokio-stream", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/tokio-stream" + }, + { + "type": "library", + "bom-ref": "pkg:cargo/tokio-test", + "name": "tokio-test", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/tokio-test" + }, + { + "type": "library", + "bom-ref": "pkg:cargo/tokio-util", + "name": "tokio-util", + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/tokio-util" + }, { "type": "library", "bom-ref": "pkg:cargo/tracing", @@ -664,9 +704,9 @@ "pkg:cargo/criterion", "pkg:cargo/rand", "pkg:cargo/rand_chacha", - "pkg:cargo/tokio-stream@0.1.18", - "pkg:cargo/tokio-util@0.7.18", - "pkg:cargo/tokio@1.53.1" + "pkg:cargo/tokio", + "pkg:cargo/tokio-stream", + "pkg:cargo/tokio-util" ] }, { @@ -693,9 +733,9 @@ "pkg:cargo/serde", "pkg:cargo/serde_derive", "pkg:cargo/serde_json", - "pkg:cargo/tokio-stream@0.1.18", - "pkg:cargo/tokio-util@0.7.18", - "pkg:cargo/tokio@1.53.1", + "pkg:cargo/tokio", + "pkg:cargo/tokio-stream", + "pkg:cargo/tokio-util", "pkg:cargo/tracing", "pkg:cargo/tracing-subscriber" ] @@ -804,7 +844,7 @@ "ref": "pkg:cargo/stress-test@0.1.0", "dependsOn": [ "pkg:cargo/rand", - "pkg:cargo/tokio@1.53.1" + "pkg:cargo/tokio" ] }, { @@ -818,7 +858,7 @@ { "ref": "pkg:cargo/tests-build@0.1.0", "dependsOn": [ - "pkg:cargo/tokio@1.53.1", + "pkg:cargo/tokio", "pkg:cargo/trybuild" ] }, @@ -828,32 +868,44 @@ "pkg:cargo/bytes", "pkg:cargo/doc-comment", "pkg:cargo/futures", - "pkg:cargo/tokio-test@0.4.5", - "pkg:cargo/tokio@1.53.1" + "pkg:cargo/tokio", + "pkg:cargo/tokio-test" ] }, + { + "ref": "pkg:cargo/tokio", + "dependsOn": [] + }, { "ref": "pkg:cargo/tokio-fuzz@0.0.0", "dependsOn": [ "pkg:cargo/libfuzzer-sys", - "pkg:cargo/tokio@1.53.1" + "pkg:cargo/tokio" ] }, + { + "ref": "pkg:cargo/tokio-macros", + "dependsOn": [] + }, { "ref": "pkg:cargo/tokio-macros@2.7.1", "dependsOn": [ "pkg:cargo/proc-macro2", "pkg:cargo/quote", "pkg:cargo/syn", - "pkg:cargo/tokio@1.53.1" + "pkg:cargo/tokio" ] }, + { + "ref": "pkg:cargo/tokio-stream", + "dependsOn": [] + }, { "ref": "pkg:cargo/tokio-stream-fuzz@0.0.0", "dependsOn": [ "pkg:cargo/libfuzzer-sys", - "pkg:cargo/tokio-stream@0.1.18", - "pkg:cargo/tokio-test@0.4.5" + "pkg:cargo/tokio-stream", + "pkg:cargo/tokio-test" ] }, { @@ -864,20 +916,28 @@ "pkg:cargo/futures-core", "pkg:cargo/parking_lot", "pkg:cargo/pin-project-lite", - "pkg:cargo/tokio-test@0.4.5", - "pkg:cargo/tokio-util@0.7.18", - "pkg:cargo/tokio@1.53.1" + "pkg:cargo/tokio", + "pkg:cargo/tokio-test", + "pkg:cargo/tokio-util" ] }, + { + "ref": "pkg:cargo/tokio-test", + "dependsOn": [] + }, { "ref": "pkg:cargo/tokio-test@0.4.5", "dependsOn": [ "pkg:cargo/futures-core", "pkg:cargo/futures-util", - "pkg:cargo/tokio-stream@0.1.18", - "pkg:cargo/tokio@1.53.1" + "pkg:cargo/tokio", + "pkg:cargo/tokio-stream" ] }, + { + "ref": "pkg:cargo/tokio-util", + "dependsOn": [] + }, { "ref": "pkg:cargo/tokio-util@0.7.18", "dependsOn": [ @@ -894,9 +954,9 @@ "pkg:cargo/pin-project-lite", "pkg:cargo/slab", "pkg:cargo/tempfile", - "pkg:cargo/tokio-stream@0.1.18", - "pkg:cargo/tokio-test@0.4.5", - "pkg:cargo/tokio@1.53.1", + "pkg:cargo/tokio", + "pkg:cargo/tokio-stream", + "pkg:cargo/tokio-test", "pkg:cargo/tracing" ] }, @@ -912,10 +972,10 @@ "pkg:cargo/mockall", "pkg:cargo/parking_lot", "pkg:cargo/pin-project-lite", - "pkg:cargo/tokio-macros@2.7.1", - "pkg:cargo/tokio-stream@0.1.18", - "pkg:cargo/tokio-test@0.4.5", - "pkg:cargo/tokio-util@0.7.18" + "pkg:cargo/tokio-macros", + "pkg:cargo/tokio-stream", + "pkg:cargo/tokio-test", + "pkg:cargo/tokio-util" ] }, { diff --git a/examples/sbom/tokio/sbom.spdx b/examples/sbom/tokio/sbom.spdx index 7022f478a..cb512a085 100644 --- a/examples/sbom/tokio/sbom.spdx +++ b/examples/sbom/tokio/sbom.spdx @@ -13,10 +13,11 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-24T07:16:30Z +Created: 2026-07-24T08:01:50Z ## Package Information PackageName: benches SPDXID: SPDXRef-Package-1 +PackageVersion: 0.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 5a81fff35ef5c81e42ebcbcef9537afcde153a5a @@ -26,9 +27,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/benches@0.0.0 ## Package Information PackageName: examples SPDXID: SPDXRef-Package-2 +PackageVersion: 0.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 39464e61fe27a50459cd14ae93d09e177b0542b7 @@ -38,9 +41,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/examples@0.0.0 ## Package Information PackageName: stress-test SPDXID: SPDXRef-Package-3 +PackageVersion: 0.1.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 30fd08be04f99aadba1d69d7a35b492a7645482e @@ -50,9 +55,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/stress-test@0.1.0 ## Package Information PackageName: tests-build SPDXID: SPDXRef-Package-4 +PackageVersion: 0.1.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 39464e61fe27a50459cd14ae93d09e177b0542b7 @@ -62,9 +69,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tests-build@0.1.0 ## Package Information PackageName: tests-integration SPDXID: SPDXRef-Package-5 +PackageVersion: 0.1.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 43e08c01a8b8a3c516f98e6ef7b1083a92536974 @@ -74,9 +83,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tests-integration@0.1.0 ## Package Information PackageName: tokio-fuzz SPDXID: SPDXRef-Package-6 +PackageVersion: 0.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 94e723dc305f28b58ba1aba04e14aade037baa95 @@ -84,9 +95,11 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-fuzz@0.0.0 ## Package Information PackageName: tokio-macros SPDXID: SPDXRef-Package-7 +PackageVersion: 2.7.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: f55b97d80aed21c1644c24c49e35cc86aa8c9bb9 @@ -97,9 +110,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) 2019 Yoshua Wuyts Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-macros@2.7.1 ## Package Information PackageName: tokio-stream-fuzz SPDXID: SPDXRef-Package-8 +PackageVersion: 0.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 94e723dc305f28b58ba1aba04e14aade037baa95 @@ -107,9 +122,11 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-stream-fuzz@0.0.0 ## Package Information PackageName: tokio-stream SPDXID: SPDXRef-Package-9 +PackageVersion: 0.1.18 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 8fa7072d1e15a3e9a6c95d428b2b954294d58e5e @@ -119,9 +136,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-stream@0.1.18 ## Package Information PackageName: tokio-test SPDXID: SPDXRef-Package-10 +PackageVersion: 0.4.5 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 1836b8628c3230a8677fcb87ad28bad263e7eb94 @@ -131,9 +150,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-test@0.4.5 ## Package Information PackageName: tokio-util SPDXID: SPDXRef-Package-11 +PackageVersion: 0.7.18 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: f852916d00afee02b0e8a70733712d23e8323ebe @@ -143,9 +164,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-util@0.7.18 ## Package Information PackageName: tokio SPDXID: SPDXRef-Package-12 +PackageVersion: 1.53.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 9688db982320e1d79a81501339bc4593b0c3099a @@ -155,6 +178,7 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio@1.53.1 ## File Information FileName: ./.github/FUNDING.yml SPDXID: SPDXRef-1 @@ -6211,6 +6235,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/async-stream ## Package Information PackageName: bytes SPDXID: SPDXRef-Package-Dependency-2 @@ -6219,6 +6244,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/bytes ## Package Information PackageName: criterion SPDXID: SPDXRef-Package-Dependency-3 @@ -6227,6 +6253,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/criterion ## Package Information PackageName: doc-comment SPDXID: SPDXRef-Package-Dependency-4 @@ -6235,6 +6262,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/doc-comment ## Package Information PackageName: futures SPDXID: SPDXRef-Package-Dependency-5 @@ -6243,6 +6271,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures ## Package Information PackageName: futures-concurrency SPDXID: SPDXRef-Package-Dependency-6 @@ -6251,6 +6280,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-concurrency ## Package Information PackageName: futures-core SPDXID: SPDXRef-Package-Dependency-7 @@ -6259,6 +6289,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-core ## Package Information PackageName: futures-io SPDXID: SPDXRef-Package-Dependency-8 @@ -6267,6 +6298,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-io ## Package Information PackageName: futures-sink SPDXID: SPDXRef-Package-Dependency-9 @@ -6275,6 +6307,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-sink ## Package Information PackageName: futures-test SPDXID: SPDXRef-Package-Dependency-10 @@ -6283,6 +6316,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-test ## Package Information PackageName: futures-util SPDXID: SPDXRef-Package-Dependency-11 @@ -6291,6 +6325,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-util ## Package Information PackageName: hashbrown SPDXID: SPDXRef-Package-Dependency-12 @@ -6299,6 +6334,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/hashbrown ## Package Information PackageName: http SPDXID: SPDXRef-Package-Dependency-13 @@ -6307,6 +6343,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/http ## Package Information PackageName: httparse SPDXID: SPDXRef-Package-Dependency-14 @@ -6315,6 +6352,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/httparse ## Package Information PackageName: httpdate SPDXID: SPDXRef-Package-Dependency-15 @@ -6323,6 +6361,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/httpdate ## Package Information PackageName: libfuzzer-sys SPDXID: SPDXRef-Package-Dependency-16 @@ -6331,6 +6370,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/libfuzzer-sys ## Package Information PackageName: mio SPDXID: SPDXRef-Package-Dependency-17 @@ -6339,6 +6379,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/mio ## Package Information PackageName: mockall SPDXID: SPDXRef-Package-Dependency-18 @@ -6347,6 +6388,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/mockall ## Package Information PackageName: once_cell SPDXID: SPDXRef-Package-Dependency-19 @@ -6355,6 +6397,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/once_cell ## Package Information PackageName: parking_lot SPDXID: SPDXRef-Package-Dependency-20 @@ -6363,6 +6406,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/parking_lot ## Package Information PackageName: pin-project-lite SPDXID: SPDXRef-Package-Dependency-21 @@ -6371,6 +6415,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/pin-project-lite ## Package Information PackageName: proc-macro2 SPDXID: SPDXRef-Package-Dependency-22 @@ -6379,6 +6424,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/proc-macro2 ## Package Information PackageName: quote SPDXID: SPDXRef-Package-Dependency-23 @@ -6387,6 +6433,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/quote ## Package Information PackageName: rand SPDXID: SPDXRef-Package-Dependency-24 @@ -6395,6 +6442,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/rand ## Package Information PackageName: rand_chacha SPDXID: SPDXRef-Package-Dependency-25 @@ -6403,6 +6451,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/rand_chacha ## Package Information PackageName: serde SPDXID: SPDXRef-Package-Dependency-26 @@ -6411,6 +6460,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde ## Package Information PackageName: serde_derive SPDXID: SPDXRef-Package-Dependency-27 @@ -6419,6 +6469,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_derive ## Package Information PackageName: serde_json SPDXID: SPDXRef-Package-Dependency-28 @@ -6427,6 +6478,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_json ## Package Information PackageName: slab SPDXID: SPDXRef-Package-Dependency-29 @@ -6435,6 +6487,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/slab ## Package Information PackageName: syn SPDXID: SPDXRef-Package-Dependency-30 @@ -6443,6 +6496,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/syn ## Package Information PackageName: tempfile SPDXID: SPDXRef-Package-Dependency-31 @@ -6451,30 +6505,79 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tempfile ## Package Information -PackageName: tracing +PackageName: tokio SPDXID: SPDXRef-Package-Dependency-32 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio ## Package Information -PackageName: tracing-subscriber +PackageName: tokio-macros SPDXID: SPDXRef-Package-Dependency-33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-macros ## Package Information -PackageName: trybuild +PackageName: tokio-stream SPDXID: SPDXRef-Package-Dependency-34 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-stream +## Package Information +PackageName: tokio-test +SPDXID: SPDXRef-Package-Dependency-35 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-test +## Package Information +PackageName: tokio-util +SPDXID: SPDXRef-Package-Dependency-36 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-util +## Package Information +PackageName: tracing +SPDXID: SPDXRef-Package-Dependency-37 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tracing +## Package Information +PackageName: tracing-subscriber +SPDXID: SPDXRef-Package-Dependency-38 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tracing-subscriber +## Package Information +PackageName: trybuild +SPDXID: SPDXRef-Package-Dependency-39 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: NOASSERTION +PackageLicenseDeclared: NOASSERTION +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/trybuild ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-1 @@ -7669,19 +7772,16 @@ Relationship: SPDXRef-Package-12 CONTAINS SPDXRef-859 Relationship: SPDXRef-Package-12 CONTAINS SPDXRef-860 Relationship: SPDXRef-Package-12 CONTAINS SPDXRef-861 Relationship: SPDXRef-Package-12 CONTAINS SPDXRef-862 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-11 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-12 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-24 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-25 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-3 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-12 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-9 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-36 Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-11 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-34 Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-7 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-10 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-12 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-1 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-10 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-11 @@ -7692,14 +7792,13 @@ Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-21 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-29 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-31 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-35 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-37 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-5 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-7 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-8 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-10 -Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-11 -Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-7 -Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-1 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-10 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-17 @@ -7707,11 +7806,12 @@ Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-18 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-2 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-20 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-21 +Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-35 +Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-36 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-5 Relationship: SPDXRef-Package-12 DEPENDS_ON SPDXRef-Package-Dependency-6 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-11 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-12 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-9 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-13 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-14 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-15 @@ -7721,32 +7821,35 @@ Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-26 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-27 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-28 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-32 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-36 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-37 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-38 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-5 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-12 Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-24 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-12 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-10 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-12 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-39 Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-2 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-35 Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-4 Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-5 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-12 Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-16 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-12 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-32 Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-22 Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-23 Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-30 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-10 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-9 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-32 Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-16 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-10 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-11 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-12 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-34 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-35 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-1 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-20 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-21 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-35 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-36 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-5 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-7 ## License Information diff --git a/src/output/sbom.rs b/src/output/sbom.rs index b20dcdc14..b3110b184 100644 --- a/src/output/sbom.rs +++ b/src/output/sbom.rs @@ -66,12 +66,12 @@ impl<'a> InventoryEntry<'a> { /// The identical component/package inventory used by CycloneDX and SPDX. pub(crate) struct SbomInventory<'a> { pub entries: Vec>, - /// Version-less purl identity → the single versioned purl that shares it, - /// when exactly one exists across the document. Lets an unversioned - /// requirement edge (e.g. `pkg:npm/leftpad` declared in a manifest) resolve - /// to the resolved coordinate (`pkg:npm/leftpad@1.0.0`) recovered from the - /// lockfile, a detected package, or resolved-package metadata. See ADR 0012. - version_index: HashMap, + /// Per-owner version evidence: `(owner package_uid, version-less purl + /// identity)` → the versioned purls that owner's own dependency edges + /// resolved that identity to. Scoped by owner so an unversioned requirement + /// under one package never inherits a version another package resolved the + /// same name to. See ADR 0012. + version_index: VersionIndex, } impl<'a> SbomInventory<'a> { @@ -83,22 +83,22 @@ impl<'a> SbomInventory<'a> { self.entries.iter().map(InventoryEntry::package) } - /// Resolve a dependency edge purl to its versioned coordinate. An - /// unversioned purl whose version-less identity has exactly one versioned - /// sibling in the document is upgraded to that versioned purl; anything - /// already versioned, ambiguous (multiple versions), or without a sibling is - /// returned unchanged. Promotion and graph-edge resolution both route - /// through this so a versioned component and the edges that target it stay - /// consistent and the graph stays closed. - pub(crate) fn canonical_purl(&self, purl: &str) -> String { - canonicalize_purl(purl, &self.version_index) + /// Resolve a dependency edge to the purl its component and graph edges use. + /// An already-versioned edge keeps its purl; an unversioned one is upgraded + /// only from that edge's own `resolved_package`, or from a single + /// unambiguous versioned sibling under the **same owner** — never across + /// owners and never by guessing among multiple versions. Promotion and + /// graph-edge resolution both route through this so a versioned component + /// and the edges that target it stay consistent and the graph stays closed. + pub(crate) fn resolve_edge_purl(&self, dep: &TopLevelDependency) -> Option { + resolve_edge_purl(dep, &self.version_index) } } /// Build the shared inventory: detected packages, then every resolved /// dependency promoted and deduped by purl (ADR 0012). pub(crate) fn build_inventory(output: &Output) -> SbomInventory<'_> { - let version_index = build_version_index(&output.packages, &output.dependencies); + let version_index = build_version_index(&output.dependencies); let mut entries: Vec> = output .packages @@ -152,10 +152,9 @@ pub(crate) fn dependency_edges( let Some(owner_id) = uid_to_id.get(owner_uid).copied() else { continue; }; - let Some(purl) = dependency_edge_purl(dep) else { + let Some(purl) = inventory.resolve_edge_purl(dep) else { continue; }; - let purl = inventory.canonical_purl(&purl); let Some(child_ids) = purl_to_ids.get(purl.as_str()) else { continue; }; @@ -181,76 +180,109 @@ pub(crate) fn dependency_edge_purl(dep: &TopLevelDependency) -> Option { .filter(|purl| !purl.is_empty()) } -/// A purl's version-less identity key and whether it carries a version. `None` -/// when the string does not parse as a purl. The key joins the type, namespace, -/// and name (NUL-separated to avoid delimiter collisions) so purls that differ -/// only in version share one key. -fn purl_identity(purl: &str) -> Option<(String, bool)> { +/// Per-owner version evidence keyed by `(owner package_uid, version-less purl +/// identity)`. The value is the set of distinct versioned purls that owner's +/// dependency edges resolved that identity to. +type VersionIndex = HashMap<(String, String), BTreeSet>; + +/// A purl's version-less identity and whether it carries a version. `None` when +/// the string does not parse as a purl. +/// +/// The identity strips **only** the version: type, namespace, name, +/// qualifiers, and subpath are all preserved (rebuilt through `PackageUrl` so +/// the string is canonical, with qualifiers sorted). Two purls therefore share +/// an identity only when they are the same coordinate at different versions — +/// variants that differ by a qualifier (`?arch=`, `?classifier=`, …) or subpath +/// stay distinct and are never conflated. +fn purl_version_less_identity(purl: &str) -> Option<(String, bool)> { let parsed = PackageUrl::from_str(purl).ok()?; - let base = format!( - "{}\u{0}{}\u{0}{}", - parsed.ty(), - parsed.namespace().unwrap_or(""), - parsed.name() - ); - Some((base, parsed.version().is_some())) + let versioned = parsed.version().is_some(); + + let mut identity = PackageUrl::new(parsed.ty().to_string(), parsed.name().to_string()).ok()?; + if let Some(namespace) = parsed.namespace() { + identity.with_namespace(namespace.to_string()).ok()?; + } + for (key, value) in parsed.qualifiers() { + identity + .add_qualifier(key.to_string(), value.to_string()) + .ok()?; + } + if let Some(subpath) = parsed.subpath() { + identity.with_subpath(subpath.to_string()).ok()?; + } + Some((identity.to_string(), versioned)) } -/// Map each version-less purl identity to the one versioned purl that shares it, -/// drawn from detected packages and every dependency edge (its own purl and its -/// resolved-package purl). An identity with zero or multiple distinct versioned -/// purls is omitted, so an unversioned edge for an ambiguous identity keeps its -/// unversioned purl rather than guess a version (ADR 0012 honest-unknowns). -fn build_version_index( - packages: &[OutputPackage], - dependencies: &[TopLevelDependency], -) -> HashMap { - let mut by_base: HashMap> = HashMap::new(); - let mut record = |purl: &str| { - if let Some((base, true)) = purl_identity(purl) { - by_base.entry(base).or_default().insert(purl.to_string()); - } - }; +/// Owner (`for_package_uid`) key for a dependency edge; `None` collapses to an +/// empty owner so unowned edges only ever match each other, never a real owner. +fn owner_key(dep: &TopLevelDependency) -> String { + dep.for_package_uid.clone().unwrap_or_default() +} - for pkg in packages { - if let Some(purl) = pkg.purl.as_deref() { - record(purl); - } - } +/// Build per-owner version evidence from dependency edges only. Each edge +/// records the versioned purls it carries (its own purl and its resolved +/// package's purl) under its owner and version-less identity. Detected packages +/// are intentionally excluded — they are not owner-scoped, so using them as +/// version evidence could assign one package's resolved version to another +/// package's requirement. +fn build_version_index(dependencies: &[TopLevelDependency]) -> VersionIndex { + let mut index: VersionIndex = HashMap::new(); for dep in dependencies { - if let Some(purl) = dep.purl.as_deref() { - record(purl); - } - if let Some(purl) = dep - .resolved_package - .as_ref() - .and_then(|rp| rp.purl.as_deref()) - { - record(purl); + let owner = owner_key(dep); + let purls = [ + dep.purl.as_deref(), + dep.resolved_package + .as_ref() + .and_then(|rp| rp.purl.as_deref()), + ]; + for purl in purls.into_iter().flatten() { + if let Some((identity, true)) = purl_version_less_identity(purl) { + index + .entry((owner.clone(), identity)) + .or_default() + .insert(purl.to_string()); + } } } - - by_base - .into_iter() - .filter_map(|(base, versioned)| { - let mut it = versioned.into_iter(); - let only = it.next()?; - it.next().is_none().then_some((base, only)) - }) - .collect() + index } -/// Upgrade an unversioned purl to its unique versioned sibling from -/// `version_index`; return the purl unchanged when it is already versioned, -/// ambiguous, unmatched, or unparseable. -fn canonicalize_purl(purl: &str, version_index: &HashMap) -> String { - match purl_identity(purl) { - Some((base, false)) => version_index - .get(&base) - .cloned() - .unwrap_or_else(|| purl.to_string()), - _ => purl.to_string(), +/// Resolve a dependency edge to the purl its component and graph edges use. +/// +/// An already-versioned edge keeps its purl. An unversioned edge is upgraded +/// only from proof about that same edge — first its own `resolved_package` +/// purl, then a single unambiguous versioned sibling recorded under the **same +/// owner** and identity. When the owner has zero or several candidate versions +/// for the identity, the edge keeps its unversioned purl (honest-unknown), and +/// no version is ever borrowed from a different owner. +fn resolve_edge_purl(dep: &TopLevelDependency, version_index: &VersionIndex) -> Option { + let declared = dependency_edge_purl(dep)?; + let (identity, versioned) = purl_version_less_identity(&declared)?; + if versioned { + return Some(declared); + } + + // The edge's own resolved-package purl is its actual resolution — trust it + // when it is versioned and the same coordinate. + if let Some(resolved_purl) = dep + .resolved_package + .as_ref() + .and_then(|rp| rp.purl.as_deref()) + && let Some((resolved_identity, true)) = purl_version_less_identity(resolved_purl) + && resolved_identity == identity + { + return Some(resolved_purl.to_string()); } + + // Same-owner sibling evidence, only when unambiguous. + if let Some(candidates) = version_index.get(&(owner_key(dep), identity)) + && candidates.len() == 1 + && let Some(only) = candidates.iter().next() + { + return Some(only.clone()); + } + + Some(declared) } /// Promote resolved dependencies, deduped by purl. @@ -264,7 +296,7 @@ fn canonicalize_purl(purl: &str, version_index: &HashMap) -> Str fn promote_dependencies( packages: &[OutputPackage], dependencies: &[TopLevelDependency], - version_index: &HashMap, + version_index: &VersionIndex, ) -> Vec<(OutputPackage, Option)> { let existing_purls: HashSet<&str> = packages .iter() @@ -275,13 +307,12 @@ fn promote_dependencies( let mut promoted: Vec<(OutputPackage, Option)> = Vec::new(); for dep in dependencies { - let Some(purl) = dependency_edge_purl(dep) else { - continue; - }; // Upgrade an unversioned requirement edge to its resolved coordinate so // it dedups against the detected package or lockfile-resolved component // for the same dependency instead of becoming a second, unversioned one. - let purl = canonicalize_purl(&purl, version_index); + let Some(purl) = resolve_edge_purl(dep, version_index) else { + continue; + }; if existing_purls.contains(purl.as_str()) { continue; } @@ -609,6 +640,30 @@ mod tests { }) } + fn dependency_owned( + purl: Option<&str>, + resolved: Option, + uid: &str, + owner: &str, + ) -> TopLevelDependency { + TopLevelDependency::from(&crate::models::TopLevelDependency { + purl: purl.map(str::to_string), + extracted_requirement: None, + scope: None, + is_runtime: None, + is_optional: Some(false), + is_pinned: None, + is_direct: None, + resolved_package: resolved.map(Box::new), + extra_data: None, + dependency_uid: crate::models::DependencyUid::from_raw(uid.to_string()), + for_package_uid: Some(crate::models::PackageUid::from_raw(owner.to_string())), + datafile_path: "package-lock.json".to_string(), + datasource_id: DatasourceId::NpmPackageLockJson, + namespace: None, + }) + } + fn promoted_optional(entries: &[InventoryEntry<'_>]) -> Option { match entries.iter().find(|e| e.is_promoted()) { Some(InventoryEntry::Promoted { is_optional, .. }) => *is_optional, @@ -916,14 +971,18 @@ mod tests { } // Vendored join (issue #1320): with `node_modules//package.json` on - // disk the dependency is a detected, licensed package at its versioned purl, - // while the manifest yields an unversioned requirement edge. The unversioned - // edge must resolve onto the detected package, leaving ONE licensed, - // versioned component — never a second bare `pkg:npm/leftpad`. + // disk the dependency is a detected, licensed package at its versioned purl. + // The manifest yields an unversioned requirement edge and the lockfile a + // versioned resolution — both under the same owner. The unversioned edge + // resolves onto the detected package, leaving ONE licensed, versioned + // component — never a second bare `pkg:npm/leftpad`. #[test] fn unversioned_requirement_merges_into_vendored_detected_package() { let packages = vec![licensed_detected_package("pkg:npm/leftpad@1.0.0", "MIT")]; - let deps = vec![dependency(Some("pkg:npm/leftpad"), Some(false), None, "d1")]; + let deps = vec![ + dependency_owned(Some("pkg:npm/leftpad"), None, "req", "owner-1"), + dependency_owned(Some("pkg:npm/leftpad@1.0.0"), None, "lock", "owner-1"), + ]; let output = output_with(packages, deps); let inventory = build_inventory(&output); @@ -941,6 +1000,93 @@ mod tests { ); } + // P1 (cross-owner): two packages can resolve the same requirement to + // different versions. An unversioned edge must take its version only from + // its own owner's resolution — never from another owner's. + #[test] + fn unversioned_requirement_never_inherits_version_across_owners() { + let deps = vec![ + // owner A: requirement + its own resolution to 1.0.0 + dependency_owned(Some("pkg:npm/lib"), None, "a-req", "owner-a"), + dependency_owned(Some("pkg:npm/lib@1.0.0"), None, "a-lock", "owner-a"), + // owner B: requirement + its own resolution to 2.0.0 + dependency_owned(Some("pkg:npm/lib"), None, "b-req", "owner-b"), + dependency_owned(Some("pkg:npm/lib@2.0.0"), None, "b-lock", "owner-b"), + ]; + let index = build_version_index(&deps); + // Each owner's unversioned requirement resolves to that owner's version. + assert_eq!( + resolve_edge_purl(&deps[0], &index).as_deref(), + Some("pkg:npm/lib@1.0.0"), + "owner A keeps its own 1.0.0" + ); + assert_eq!( + resolve_edge_purl(&deps[2], &index).as_deref(), + Some("pkg:npm/lib@2.0.0"), + "owner B keeps its own 2.0.0 — no cross-owner assignment" + ); + + // Both versioned components still exist and the graph stays closed. + let output = output_with(vec![], deps); + let inventory = build_inventory(&output); + let purls: BTreeSet<&str> = inventory + .packages() + .filter_map(|pkg| pkg.purl.as_deref()) + .collect(); + assert_eq!( + purls, + BTreeSet::from(["pkg:npm/lib@1.0.0", "pkg:npm/lib@2.0.0"]) + ); + let ids: Vec = (0..inventory.entries.len()) + .map(|i| format!("id-{i}")) + .collect(); + let edges = dependency_edges(&inventory, &output.dependencies, &ids); + for children in edges.values() { + for child in children { + assert!( + ids.contains(child), + "every edge resolves within the document" + ); + } + } + } + + // P1 (qualifiers/subpath): purls that differ only by a qualifier or subpath + // are DIFFERENT coordinates. An unversioned edge for one must not be rewritten + // to a versioned sibling that carries a different qualifier/subpath. + #[test] + fn qualifier_and_subpath_variants_are_not_conflated() { + let deps = vec![ + // A versioned candidate that carries a qualifier. + dependency_owned( + Some("pkg:maven/g/a@1.0.0?classifier=sources"), + None, + "v", + "owner-1", + ), + // An unversioned requirement WITHOUT that qualifier — different identity. + dependency_owned(Some("pkg:maven/g/a"), None, "req", "owner-1"), + ]; + let index = build_version_index(&deps); + assert_eq!( + resolve_edge_purl(&deps[1], &index).as_deref(), + Some("pkg:maven/g/a"), + "a qualifier-bearing sibling must not version a bare requirement" + ); + + // And a subpath variant is likewise its own identity. + let subpath_deps = vec![ + dependency_owned(Some("pkg:golang/ex.com/m@1.0.0#sub"), None, "v", "owner-1"), + dependency_owned(Some("pkg:golang/ex.com/m"), None, "req", "owner-1"), + ]; + let subpath_index = build_version_index(&subpath_deps); + assert_eq!( + resolve_edge_purl(&subpath_deps[1], &subpath_index).as_deref(), + Some("pkg:golang/ex.com/m"), + "a subpath-bearing sibling must not version a bare requirement" + ); + } + // Versioned-purl gap (issue #1320): the resolved version lives only on a // sibling lockfile edge. An unversioned requirement edge with no detected // package must still be promoted at the resolved coordinate and pick up the diff --git a/src/output/spdx.rs b/src/output/spdx.rs index 043b69044..ecb2f704f 100644 --- a/src/output/spdx.rs +++ b/src/output/spdx.rs @@ -222,6 +222,9 @@ fn write_spdx_tag_value_package( writeln!(writer, "## Package Information")?; writeln!(writer, "PackageName: {}", plan.name)?; writeln!(writer, "SPDXID: {}", plan.spdx_id)?; + if let Some(version) = spdx_package_version(plan.package) { + writeln!(writer, "PackageVersion: {version}")?; + } writeln!(writer, "PackageDownloadLocation: NOASSERTION")?; writeln!(writer, "FilesAnalyzed: {}", plan.role.files_analyzed())?; // SPDX 2.2: a package verification code and per-file license info are @@ -262,9 +265,30 @@ fn write_spdx_tag_value_package( "PackageCopyrightText: {}", format_spdx_text_field(&package_copyright_text) )?; + // The purl is the join key for downstream license enrichment; emit it as a + // package-manager ExternalRef (ADR 0012, issue #1320). + if let Some(purl) = spdx_package_purl(plan.package) { + writeln!(writer, "ExternalRef: PACKAGE-MANAGER purl {purl}")?; + } Ok(()) } +/// The package version for an SPDX package, when the inventory package carries a +/// non-empty one. Promoted-dependency packages carry the resolved version from +/// their versioned purl (issue #1320). +fn spdx_package_version(package: Option<&OutputPackage>) -> Option<&str> { + package + .and_then(|package| package.version.as_deref()) + .filter(|version| !version.is_empty()) +} + +/// The package purl for an SPDX package, when present and non-empty. +fn spdx_package_purl(package: Option<&OutputPackage>) -> Option<&str> { + package + .and_then(|package| package.purl.as_deref()) + .filter(|purl| !purl.is_empty()) +} + pub(crate) fn write_spdx_rdf_xml( output: &Output, writer: &mut dyn Write, @@ -450,6 +474,24 @@ pub(crate) fn write_spdx_rdf_xml( xml.push_str(" "); xml.push_str(&package_name); xml.push_str("\n"); + if let Some(version) = spdx_package_version(plan.package) { + xml.push_str(" "); + xml.push_str(&xml_escape(version)); + xml.push_str("\n"); + } + // Purl as a package-manager ExternalRef — the downstream join key + // (ADR 0012, issue #1320). + if let Some(purl) = spdx_package_purl(plan.package) { + xml.push_str(" "); + xml.push_str(""); + xml.push_str( + "", + ); + xml.push_str(""); + xml.push_str(&xml_escape(purl)); + xml.push_str(""); + xml.push_str("\n"); + } xml.push_str(" \n"); } diff --git a/testdata/output-formats/cyclonedx-dependencies-expected.json b/testdata/output-formats/cyclonedx-dependencies-expected.json index 7ae007634..fc3bc9b55 100644 --- a/testdata/output-formats/cyclonedx-dependencies-expected.json +++ b/testdata/output-formats/cyclonedx-dependencies-expected.json @@ -1,7 +1,7 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:a423c1be-9bf8-4660-a3c6-95427fd95098", + "serialNumber": "urn:uuid:4504b45a-f05a-47e3-81c8-5080f4eecd2b", "version": 1, "metadata": { "timestamp": "2026-01-01T00:00:01Z", @@ -68,16 +68,11 @@ }, { "ref": "pkg:npm/other@1.0.0", - "dependsOn": [ - "pkg:npm/dep@2.0.0" - ] + "dependsOn": ["pkg:npm/dep@2.0.0"] }, { "ref": "pkg:npm/root@1.0.0", - "dependsOn": [ - "pkg:npm/dep@2.0.0", - "pkg:npm/left-pad@1.3.0" - ] + "dependsOn": ["pkg:npm/dep@2.0.0", "pkg:npm/left-pad@1.3.0"] } ] } diff --git a/testdata/output-formats/cyclonedx-dependencies-expected.xml b/testdata/output-formats/cyclonedx-dependencies-expected.xml index 08166290e..43be6f1d6 100644 --- a/testdata/output-formats/cyclonedx-dependencies-expected.xml +++ b/testdata/output-formats/cyclonedx-dependencies-expected.xml @@ -1,5 +1,5 @@ - + 2026-01-01T00:00:01Z diff --git a/testdata/output-formats/spdx-dependencies-expected.tv b/testdata/output-formats/spdx-dependencies-expected.tv index 667fedc7b..dfe2f0ef3 100644 --- a/testdata/output-formats/spdx-dependencies-expected.tv +++ b/testdata/output-formats/spdx-dependencies-expected.tv @@ -17,6 +17,7 @@ Created: 2026-01-01T00:00:00Z ## Package Information PackageName: root SPDXID: SPDXRef-Package-1 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 2a4976b2c9ac8e1fc0747dba6f0c5588b1318680 @@ -24,6 +25,7 @@ PackageLicenseConcluded: MIT PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: MIT PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/root@1.0.0 ## File Information FileName: ./index.js SPDXID: SPDXRef-1 @@ -42,19 +44,23 @@ FileCopyrightText: NONE ## Package Information PackageName: dep SPDXID: SPDXRef-Package-Dependency-1 +PackageVersion: 2.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/dep@2.0.0 ## Package Information PackageName: left-pad SPDXID: SPDXRef-Package-Dependency-2 +PackageVersion: 1.3.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/left-pad@1.3.0 ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-1 diff --git a/testdata/output-formats/spdx-licensed-expected.tv b/testdata/output-formats/spdx-licensed-expected.tv index 79bb60ee3..01b514f3c 100644 --- a/testdata/output-formats/spdx-licensed-expected.tv +++ b/testdata/output-formats/spdx-licensed-expected.tv @@ -17,6 +17,7 @@ Created: 2026-01-01T00:00:00Z ## Package Information PackageName: widget-mit SPDXID: SPDXRef-Package-1 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 0a05a9e69e5757ac71c75a50418622624f042c97 @@ -24,9 +25,11 @@ PackageLicenseConcluded: MIT PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/widget-mit@1.0.0 ## Package Information PackageName: widget-other SPDXID: SPDXRef-Package-2 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 4ef6c88cdec9dbcc9bd8b7fa0fdfe4cc43bfed4f @@ -34,6 +37,7 @@ PackageLicenseConcluded: Apache-2.0 PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/widget-other@1.0.0 ## File Information FileName: ./widget-mit/package.json SPDXID: SPDXRef-1 diff --git a/testdata/output-formats/spdx-multi-package-expected.tv b/testdata/output-formats/spdx-multi-package-expected.tv index 7d46e7cb0..36eeac17e 100644 --- a/testdata/output-formats/spdx-multi-package-expected.tv +++ b/testdata/output-formats/spdx-multi-package-expected.tv @@ -17,6 +17,7 @@ Created: 2026-01-01T00:00:00Z ## Package Information PackageName: widget-a SPDXID: SPDXRef-Package-1 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: c361e706434ebcd03e8857c6c8dd2786adaeb3ef @@ -24,9 +25,11 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: NOASSERTION PackageCopyrightText: Copyright 2024 Widget A Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:npm/widget-a@1.0.0 ## Package Information PackageName: widget-b SPDXID: SPDXRef-Package-2 +PackageVersion: 2.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 8fe04df3f4570c5b3840493e6159d69afa80ed7d @@ -34,6 +37,7 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: Apache-2.0 PackageLicenseDeclared: NOASSERTION PackageCopyrightText: Copyright 2024 Widget B Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:npm/widget-b@2.0.0 ## Package Information PackageName: workspace SPDXID: SPDXRef-Package-unassigned From fb978e2f298ba8015d8c473aa81a95033dff8b09 Mon Sep 17 00:00:00 2001 From: Maxim Stykow Date: Fri, 24 Jul 2026 10:28:33 +0200 Subject: [PATCH 3/4] fix(output): never pool SBOM versions across ownerless dependency edges MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A dependency edge with no (or empty) `for_package_uid` previously collapsed to a shared empty-owner key in the version index, so an unversioned ownerless requirement could adopt the sole versioned purl contributed by an unrelated ownerless dependency (e.g. a hoisted dep from another workspace/datafile) — a wrong concrete coordinate. Ownerless edges now neither contribute to nor consult the same-owner sibling index: only edges with a concrete `for_package_uid` build or read it. An ownerless unversioned edge resolves its version solely from its own `resolved_package` purl, otherwise stays unversioned (honest-unknown). Added regression test `ownerless_requirement_does_not_borrow_sibling_version`: two ownerless deps from different contexts (`lib@1.0.0` versioned, bare `lib` requirement with no resolved_package) — the bare one stays unversioned, both components are present, and the graph stays closed. Updated ADR 0012. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Maxim Stykow --- ...012-sbom-resolved-dependency-components.md | 5 +- src/output/sbom.rs | 102 +++++++++++++----- 2 files changed, 82 insertions(+), 25 deletions(-) diff --git a/docs/adr/0012-sbom-resolved-dependency-components.md b/docs/adr/0012-sbom-resolved-dependency-components.md index edde871fb..8151ac555 100644 --- a/docs/adr/0012-sbom-resolved-dependency-components.md +++ b/docs/adr/0012-sbom-resolved-dependency-components.md @@ -139,7 +139,10 @@ join safe: - **Owner-scoped.** A version is never borrowed across owners. Two packages can resolve the same requirement to different versions; each edge takes its - version only from its own owner's resolution. + version only from its own owner's resolution. An absent or empty owner is not + a shared bucket either: ownerless edges never contribute to or consult the + sibling index, so a bare hoisted requirement can only take a version from its + own `resolved_package`, never from an unrelated ownerless dependency. - **Identity strips only the version.** Type, namespace, name, qualifiers, and subpath are all preserved, so variants that differ by a qualifier (`?arch=`, `?classifier=`, …) or subpath are distinct coordinates and never conflated. diff --git a/src/output/sbom.rs b/src/output/sbom.rs index b3110b184..d29b09e5e 100644 --- a/src/output/sbom.rs +++ b/src/output/sbom.rs @@ -213,22 +213,29 @@ fn purl_version_less_identity(purl: &str) -> Option<(String, bool)> { Some((identity.to_string(), versioned)) } -/// Owner (`for_package_uid`) key for a dependency edge; `None` collapses to an -/// empty owner so unowned edges only ever match each other, never a real owner. -fn owner_key(dep: &TopLevelDependency) -> String { - dep.for_package_uid.clone().unwrap_or_default() +/// The concrete owner (`for_package_uid`) of a dependency edge, if any. An +/// absent or empty owner is **not** a shared coalescing bucket: distinct +/// ownerless (e.g. hoisted, or from separate workspaces/datafiles) edges must +/// never pool their versions, so such edges have no sibling-index key at all. +fn concrete_owner(dep: &TopLevelDependency) -> Option<&str> { + dep.for_package_uid + .as_deref() + .filter(|owner| !owner.is_empty()) } -/// Build per-owner version evidence from dependency edges only. Each edge -/// records the versioned purls it carries (its own purl and its resolved -/// package's purl) under its owner and version-less identity. Detected packages -/// are intentionally excluded — they are not owner-scoped, so using them as -/// version evidence could assign one package's resolved version to another -/// package's requirement. +/// Build per-owner version evidence from dependency edges only. Each edge with a +/// concrete owner records the versioned purls it carries (its own purl and its +/// resolved package's purl) under `(owner, version-less identity)`. Ownerless +/// edges are excluded so they can never pool versions with each other, and +/// detected packages are excluded because they are not owner-scoped — either +/// could otherwise assign one context's resolved version to another's +/// requirement. fn build_version_index(dependencies: &[TopLevelDependency]) -> VersionIndex { let mut index: VersionIndex = HashMap::new(); for dep in dependencies { - let owner = owner_key(dep); + let Some(owner) = concrete_owner(dep) else { + continue; + }; let purls = [ dep.purl.as_deref(), dep.resolved_package @@ -238,7 +245,7 @@ fn build_version_index(dependencies: &[TopLevelDependency]) -> VersionIndex { for purl in purls.into_iter().flatten() { if let Some((identity, true)) = purl_version_less_identity(purl) { index - .entry((owner.clone(), identity)) + .entry((owner.to_string(), identity)) .or_default() .insert(purl.to_string()); } @@ -252,9 +259,10 @@ fn build_version_index(dependencies: &[TopLevelDependency]) -> VersionIndex { /// An already-versioned edge keeps its purl. An unversioned edge is upgraded /// only from proof about that same edge — first its own `resolved_package` /// purl, then a single unambiguous versioned sibling recorded under the **same -/// owner** and identity. When the owner has zero or several candidate versions -/// for the identity, the edge keeps its unversioned purl (honest-unknown), and -/// no version is ever borrowed from a different owner. +/// concrete owner** and identity. When the edge is ownerless, or its owner has +/// zero or several candidate versions for the identity, the edge keeps its +/// unversioned purl (honest-unknown); a version is never borrowed from a +/// different owner or pooled across ownerless contexts. fn resolve_edge_purl(dep: &TopLevelDependency, version_index: &VersionIndex) -> Option { let declared = dependency_edge_purl(dep)?; let (identity, versioned) = purl_version_less_identity(&declared)?; @@ -274,8 +282,10 @@ fn resolve_edge_purl(dep: &TopLevelDependency, version_index: &VersionIndex) -> return Some(resolved_purl.to_string()); } - // Same-owner sibling evidence, only when unambiguous. - if let Some(candidates) = version_index.get(&(owner_key(dep), identity)) + // Same-owner sibling evidence, only for a concrete owner and only when + // unambiguous. Ownerless edges never consult the index. + if let Some(owner) = concrete_owner(dep) + && let Some(candidates) = version_index.get(&(owner.to_string(), identity)) && candidates.len() == 1 && let Some(only) = candidates.iter().next() { @@ -1087,6 +1097,50 @@ mod tests { ); } + // P1 (ownerless): an absent owner is not a shared coalescing bucket. Two + // ownerless dependencies from different contexts (e.g. separate workspaces + // or datafiles) must not pool versions — a bare ownerless requirement stays + // unversioned rather than borrow an unrelated ownerless sibling's version. + #[test] + fn ownerless_requirement_does_not_borrow_sibling_version() { + let deps = vec![ + // A versioned ownerless dependency from one context. + dependency(Some("pkg:npm/lib@1.0.0"), Some(false), None, "ctx-a"), + // A bare ownerless requirement from an unrelated context. + dependency(Some("pkg:npm/lib"), Some(false), None, "ctx-b"), + ]; + let index = build_version_index(&deps); + assert_eq!( + resolve_edge_purl(&deps[1], &index).as_deref(), + Some("pkg:npm/lib"), + "an ownerless requirement must not borrow an unrelated ownerless version" + ); + + let output = output_with(vec![], deps); + let inventory = build_inventory(&output); + let purls: BTreeSet<&str> = inventory + .packages() + .filter_map(|pkg| pkg.purl.as_deref()) + .collect(); + assert_eq!( + purls, + BTreeSet::from(["pkg:npm/lib", "pkg:npm/lib@1.0.0"]), + "both components present; the bare requirement stays unversioned" + ); + let ids: Vec = (0..inventory.entries.len()) + .map(|i| format!("id-{i}")) + .collect(); + let edges = dependency_edges(&inventory, &output.dependencies, &ids); + for children in edges.values() { + for child in children { + assert!( + ids.contains(child), + "every edge resolves within the document" + ); + } + } + } + // Versioned-purl gap (issue #1320): the resolved version lives only on a // sibling lockfile edge. An unversioned requirement edge with no detected // package must still be promoted at the resolved coordinate and pick up the @@ -1103,12 +1157,12 @@ mod tests { resolved.declared_license_expression_spdx = Some("MIT".to_string()); let deps = vec![ - dependency(Some("pkg:npm/left-pad"), Some(false), None, "req"), - dependency( + dependency_owned(Some("pkg:npm/left-pad"), None, "req", "owner-1"), + dependency_owned( Some("pkg:npm/left-pad@1.3.0"), - Some(false), Some(resolved), "lock", + "owner-1", ), ]; let output = output_with(vec![], deps); @@ -1124,15 +1178,15 @@ mod tests { ); } - // Honest-unknowns: when an unversioned requirement could match more than one + // Honest-unknowns: when one owner's requirement could match more than one // resolved version, Provenant must not guess. The edge keeps its unversioned // purl and each resolved version remains its own component. #[test] fn ambiguous_versions_leave_unversioned_requirement_unresolved() { let deps = vec![ - dependency(Some("pkg:npm/multi"), Some(false), None, "req"), - dependency(Some("pkg:npm/multi@1.0.0"), Some(false), None, "v1"), - dependency(Some("pkg:npm/multi@2.0.0"), Some(false), None, "v2"), + dependency_owned(Some("pkg:npm/multi"), None, "req", "owner-1"), + dependency_owned(Some("pkg:npm/multi@1.0.0"), None, "v1", "owner-1"), + dependency_owned(Some("pkg:npm/multi@2.0.0"), None, "v2", "owner-1"), ]; let output = output_with(vec![], deps); let inventory = build_inventory(&output); From b443ed5c6938db5a140d3eb78ee2ab84be05d4ac Mon Sep 17 00:00:00 2001 From: Maxim Stykow Date: Fri, 24 Jul 2026 10:55:32 +0200 Subject: [PATCH 4/4] fix(output): retain unparseable dependency purls in the SBOM instead of dropping them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PackageUrl-based version-less identity rebuild made `resolve_edge_purl` return None whenever a dependency's non-empty purl failed to parse, so promotion AND graph construction skipped it — the component and its owner relationship vanished from both CycloneDX and SPDX even though the native output preserves that coordinate (a silent, dishonest inventory loss). A non-empty purl is now never dropped: when it cannot be parsed it cannot be canonicalized or deduped, so it is passed through unchanged as the component coordinate and graph-edge ref. Only a genuinely empty purl is absent, matching prior behavior. The retained component's bom-ref and the edge ref are the same original string, so the graph stays closed. Added regression test `unparseable_purl_is_retained_as_component_and_edge`: a dependency with a non-empty malformed purl still appears as a promoted component with its original coordinate and its owner→dep edge; the graph stays closed with no dangling refs. Updated ADR 0012. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Maxim Stykow --- ...012-sbom-resolved-dependency-components.md | 4 ++ src/output/sbom.rs | 62 ++++++++++++++++++- 2 files changed, 65 insertions(+), 1 deletion(-) diff --git a/docs/adr/0012-sbom-resolved-dependency-components.md b/docs/adr/0012-sbom-resolved-dependency-components.md index 8151ac555..ce89c4495 100644 --- a/docs/adr/0012-sbom-resolved-dependency-components.md +++ b/docs/adr/0012-sbom-resolved-dependency-components.md @@ -146,6 +146,10 @@ join safe: - **Identity strips only the version.** Type, namespace, name, qualifiers, and subpath are all preserved, so variants that differ by a qualifier (`?arch=`, `?classifier=`, …) or subpath are distinct coordinates and never conflated. +- **A non-empty purl is never dropped.** When a purl cannot be parsed it cannot + be canonicalized or deduped, but it is a real coordinate the native output + keeps, so it is passed through unchanged as the component/edge purl rather + than erased. Only a genuinely empty purl is absent. When the owner has zero or multiple candidate versions for an identity, the edge keeps its unversioned purl (honest-unknowns — Provenant does not guess which diff --git a/src/output/sbom.rs b/src/output/sbom.rs index d29b09e5e..4d3421fd5 100644 --- a/src/output/sbom.rs +++ b/src/output/sbom.rs @@ -265,7 +265,13 @@ fn build_version_index(dependencies: &[TopLevelDependency]) -> VersionIndex { /// different owner or pooled across ownerless contexts. fn resolve_edge_purl(dep: &TopLevelDependency, version_index: &VersionIndex) -> Option { let declared = dependency_edge_purl(dep)?; - let (identity, versioned) = purl_version_less_identity(&declared)?; + // A non-empty purl must never be dropped. If it does not parse we cannot + // canonicalize or dedup it, but the coordinate is still real — the native + // output keeps it — so pass it through unchanged rather than erase the + // component and its graph edge (only a genuinely empty purl is absent). + let Some((identity, versioned)) = purl_version_less_identity(&declared) else { + return Some(declared); + }; if versioned { return Some(declared); } @@ -1141,6 +1147,60 @@ mod tests { } } + // P1 (unparseable purl): a non-empty purl the `PackageUrl` parser rejects + // must never erase the dependency. The component keeps its original + // coordinate and its owner→dep edge, so both CycloneDX and SPDX still emit + // it and the graph stays closed. Only a genuinely empty purl may be absent. + #[test] + fn unparseable_purl_is_retained_as_component_and_edge() { + let malformed = "not-a-purl"; + assert!( + PackageUrl::from_str(malformed).is_err(), + "test requires a genuinely unparseable purl" + ); + + let mut owner = detected_package("pkg:npm/app@1.0.0"); + owner.package_uid = "owner-1".to_string(); + let dep = dependency_owned(Some(malformed), None, "d1", "owner-1"); + let output = output_with(vec![owner], vec![dep]); + let inventory = build_inventory(&output); + + let promoted: Vec<&str> = inventory + .entries + .iter() + .filter(|entry| entry.is_promoted()) + .filter_map(|entry| entry.package().purl.as_deref()) + .collect(); + assert_eq!( + promoted, + vec![malformed], + "an unparseable but non-empty purl is retained as a component" + ); + + // bom-ref/id per entry: purl when present, else package_uid — the same + // scheme the renderers use, so the edge ref must equal the retained purl. + let ids: Vec = inventory + .packages() + .map(|pkg| pkg.purl.clone().unwrap_or_else(|| pkg.package_uid.clone())) + .collect(); + let owner_id = &ids[0]; + let edges = dependency_edges(&inventory, &output.dependencies, &ids); + assert!( + edges + .get(owner_id) + .is_some_and(|children| children.contains(malformed)), + "the owner→dep edge to the unparseable coordinate is retained" + ); + for children in edges.values() { + for child in children { + assert!( + ids.contains(child), + "every edge resolves within the document (graph closed)" + ); + } + } + } + // Versioned-purl gap (issue #1320): the resolved version lives only on a // sibling lockfile edge. An unversioned requirement edge with no detected // package must still be promoted at the resolved coordinate and pick up the