Skip to content

SBOM: attach CycloneDX component license evidence (evidence.licenses / evidence.occurrences) #1330

Description

@mstykow

Context

Follow-up split out of #1328. That PR bumped Provenant's CycloneDX output to 1.7 and landed the primary license-expressiveness win — licenses[].acknowledgement (declared vs concluded). The second feature scoped in #1328, component-level license evidence, was explicitly allowed to be deferred if a clean file-to-component mapping turned out to be more than a moderate change. It did, so it is tracked here.

Target

Populate CycloneDX 1.7 component.evidence.licenses (and/or evidence.occurrences with file + line) for each component, using the file-to-component ownership Provenant already has.

Provenant knows the file and line where each license was detected (file.license_detections[].matches[] carry from_file, start_line, end_line). The SPDX renderer already maps files to their owning package via file.for_packages in src/output/spdx_plan.rs (plan_spdx_packages). The CycloneDX renderer (src/output/cyclonedx.rs) currently does not consume output.files at all, so this needs:

  • Threading file ownership into the CycloneDX renderer (reuse or generalize the spdx_plan ownership mapping so both formats agree).
  • Emitting evidence.licenses (observed licenses, acknowledgement omitted or set appropriately) and/or evidence.occurrences (file + line) on the owning component; promoted resolved-dependency components own no scanned files and get no evidence.
  • Golden coverage (JSON + XML), and the official 1.7 schema/XSD validator must stay green (scripts/validate_output_format_fixtures.py).
  • Confirm the XML evidence element ordering against the 1.7 XSD.

Out of scope

References

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions