mod sbom

module sbom

Planned CycloneDX 1.5 SBOM from a stack lock (pre-install inventory).

Built with the official cyclonedx_bom crate (same models as cargo-cyclonedx / CycloneDX Rust Cargo). Documents are serialized as JSON 1.5 with serial numbers, tool metadata, lifecycle phase, and declared dependency edges — not a post-build compliance scan.

Functions

fn build_dep_map_from_universe(lock: &StackLock, universe: &Universe) -> HashMap<String, Vec<String>>

Build dep map name -> build-time dependency names (builddependencies) from universe candidates matching the lock.

fn dep_map_from_universe(lock: &StackLock, universe: &Universe) -> HashMap<String, Vec<String>>

Build dep map name -> runtime dependency names from universe candidates matching the lock. Build-time deps are intentionally omitted here so SBOM dependsOn edges stay role-specific; use build_dep_map_from_universe for the build-time list (same shape, separate map).

fn lock_to_bom(lock: &StackLock, runtime_dep_map: Option<&HashMap<String, Vec<String>>>, build_dep_map: Option<&HashMap<String, Vec<String>>>) -> Bom

Typed CycloneDX BOM (1.5 models) — preferred when callers want validation.

fn lock_to_cyclonedx(lock: &StackLock) -> Value

Build a CycloneDX JSON document from a lock only (no dependency map).

Without declared edges each component gets an empty dependsOn list — never all-to-all co-stack edges (those create invalid cyclic BOMs).

fn lock_to_cyclonedx_with_deps(lock: &StackLock, selected_dep_map: Option<&HashMap<String, Vec<String>>>) -> Value

Preferred: when the selected candidates (or full universe selection map) are known, emit dependsOn from each package’s declared EasyBuild-style dependency list intersected with co-selected lock members. When selected_dep_map is None, each package’s dependsOn is empty (unknown), not all-to-all.

fn lock_to_cyclonedx_with_runtime_and_build(lock: &StackLock, runtime_dep_map: Option<&HashMap<String, Vec<String>>>, build_dep_map: Option<&HashMap<String, Vec<String>>>) -> Value

Like lock_to_cyclonedx_with_deps, also records build-time edges as a component property (eb_stack:buildDependsOn) while runtime edges fill the CycloneDX dependencies graph.