diff --git a/docs/adr/0012-sbom-resolved-dependency-components.md b/docs/adr/0012-sbom-resolved-dependency-components.md index ad6e9b9e9..ce89c4495 100644 --- a/docs/adr/0012-sbom-resolved-dependency-components.md +++ b/docs/adr/0012-sbom-resolved-dependency-components.md @@ -104,6 +104,80 @@ determine it statically**: - No other dependency-intent flag (`is_runtime`, `is_direct`, `is_pinned`) is invented for a component when it is not proven. +## Amendment (issue #1320): versioned purls and the vendored-license join + +The original decision keyed promotion and graph edges on the dependency's +_declared_ purl. For an ecosystem that resolves versions in a lockfile that is a +separate datasource from the manifest (npm, Cargo, PyPI, …), that produced two +shortcomings visible in a real scan: + +- A dependency promoted from a manifest requirement carried the **unversioned** + purl (`pkg:npm/leftpad`) even when the lockfile had already resolved it to a + version — the versioned coordinate that makes the purl a usable join key for + downstream license enrichment (deps.dev, ClearlyDefined, an SCA tool). +- When the dependency's source or metadata was on disk (`node_modules//`, + `*.dist-info/METADATA`, vendored source), Provenant detected and licensed it + as a package at its **versioned** purl, but the manifest requirement was + promoted as a **separate, unversioned, unlicensed** component. The same + dependency appeared twice, and the licensed copy was not the purl-keyed one. + +### Decision + +Resolve each dependency edge purl to its **versioned coordinate** before +promotion and edge resolution, using only static evidence already in the +document. An already-versioned edge keeps its purl. An unversioned edge is +upgraded only from proof about that same edge: + +1. the edge's own `resolved_package` purl (its actual resolution), else +2. a **single unambiguous** versioned sibling recorded under the **same owner** + (`for_package_uid`) and the same identity. + +`SbomInventory` builds that evidence as a per-owner version index keyed by +`(owner, version-less identity)` from dependency edges only — never from +detected packages, which are not owner-scoped. Two correctness rules make the +join safe: + +- **Owner-scoped.** A version is never borrowed across owners. Two packages can + resolve the same requirement to different versions; each edge takes its + version only from its own owner's resolution. An absent or empty owner is not + a shared bucket either: ownerless edges never contribute to or consult the + sibling index, so a bare hoisted requirement can only take a version from its + own `resolved_package`, never from an unrelated ownerless dependency. +- **Identity strips only the version.** Type, namespace, name, qualifiers, and + subpath are all preserved, so variants that differ by a qualifier (`?arch=`, + `?classifier=`, …) or subpath are distinct coordinates and never conflated. +- **A non-empty purl is never dropped.** When a purl cannot be parsed it cannot + be canonicalized or deduped, but it is a real coordinate the native output + keeps, so it is passed through unchanged as the component/edge purl rather + than erased. Only a genuinely empty purl is absent. + +When the owner has zero or multiple candidate versions for an identity, the edge +keeps its unversioned purl (honest-unknowns — Provenant does not guess which +version a range resolved to; e.g. a workspace member whose lockfile edges are +owned elsewhere, or a diamond that resolves two versions). Both promotion dedup +and `dependsOn`/`DEPENDS_ON` edge resolution route through the same resolver, so +a component and the edges that target it always agree and the graph stays +closed. + +This closes both gaps with the existing purl-dedup: once the unversioned +requirement is resolved to the coordinate, it dedups against the detected +package (vendored case → one licensed, versioned component) or against the +versioned lockfile edge (source-absent case → one versioned component, license +carried from `resolved_package` when present, otherwise unset). Nothing is +fetched; the license and version come only from what was scanned. + +Both formats render the versioned coordinate. CycloneDX components carry the +versioned purl as `bom-ref` and `purl`. SPDX packages (subject and promoted +dependency alike) now emit `PackageVersion` and a package-manager purl +`ExternalRef` — tag-value `ExternalRef: PACKAGE-MANAGER purl ` and RDF +`spdx:versionInfo` + `spdx:externalRef` (referenceCategory `packageManager`, +referenceType `purl`) — so the join key is usable from SPDX too. + +Still static and no-network: the change is purely a render-time join over data +already extracted. When neither a detected package nor a same-owner resolved +version exists for an identity, the component keeps its unversioned purl and +unset license. + ## Consequences ### Benefits @@ -147,6 +221,7 @@ determine it statically**: ## References - Issue #1319 +- Issue #1320 (versioned purls + vendored-license join amendment) - Promotion/dedup: `src/output/sbom.rs` - CycloneDX renderer: `src/output/cyclonedx.rs` - SPDX renderer: `src/output/spdx.rs` diff --git a/examples/sbom/README.md b/examples/sbom/README.md index e2aa1d891..2517b9cac 100644 --- a/examples/sbom/README.md +++ b/examples/sbom/README.md @@ -2,7 +2,7 @@ Real software bills of materials produced by [Provenant](https://github.com/getprovenant/provenant), one directory per target. Each target directory contains an SPDX tag-value document ([`sbom.spdx`](ripgrep/sbom.spdx)) and a CycloneDX JSON document ([`sbom.cdx.json`](ripgrep/sbom.cdx.json)), plus a short provenance README. -These examples are generated by Provenant scanning each project at a pinned commit with license, package, and copyright detection enabled. Every SBOM is a complete, closed inventory: each resolved dependency is promoted to a component with a package URL, and every dependency relationship resolves within the document. +These examples are generated by Provenant 1.0.1 (the current build) scanning each project at a pinned commit with license, package, and copyright detection enabled. Every SBOM is a complete, closed inventory: each resolved dependency is promoted to a component with a package URL, and every dependency relationship resolves within the document. ## Targets diff --git a/examples/sbom/express/sbom.cdx.json b/examples/sbom/express/sbom.cdx.json index 3ca4110f8..c2eb4d80d 100644 --- a/examples/sbom/express/sbom.cdx.json +++ b/examples/sbom/express/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:91ad61c4-42a1-4321-ad30-83a7bcbd583c", + "serialNumber": "urn:uuid:39c66028-e3ae-4e52-bf05-e69d7557065a", "version": 1, "metadata": { - "timestamp": "2026-07-23T22:12:14Z", + "timestamp": "2026-07-24T08:01:41Z", "tools": [ { "name": "Provenant", diff --git a/examples/sbom/express/sbom.spdx b/examples/sbom/express/sbom.spdx index 8187b2d9a..01c81b2b4 100644 --- a/examples/sbom/express/sbom.spdx +++ b/examples/sbom/express/sbom.spdx @@ -13,10 +13,11 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-23T22:12:13Z +Created: 2026-07-24T08:01:40Z ## Package Information PackageName: express SPDXID: SPDXRef-Package-1 +PackageVersion: 5.2.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: ea2aa897220d8ebe58a2faf63f08c3f2bc9421f6 @@ -29,6 +30,7 @@ Copyright (c) 2014-2015 Douglas Christopher Wilson Copyright(c) 2009-2013 TJ Holowaychuk Copyright(c) 2013 Roman Shtylman Copyright(c) 2014-2015 Douglas Christopher Wilson +ExternalRef: PACKAGE-MANAGER purl pkg:npm/express@5.2.1 ## File Information FileName: ./.editorconfig SPDXID: SPDXRef-1 @@ -1557,6 +1559,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/accepts ## Package Information PackageName: after SPDXID: SPDXRef-Package-Dependency-2 @@ -1565,6 +1568,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/after ## Package Information PackageName: body-parser SPDXID: SPDXRef-Package-Dependency-3 @@ -1573,6 +1577,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/body-parser ## Package Information PackageName: connect-redis SPDXID: SPDXRef-Package-Dependency-4 @@ -1581,6 +1586,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/connect-redis ## Package Information PackageName: content-disposition SPDXID: SPDXRef-Package-Dependency-5 @@ -1589,6 +1595,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/content-disposition ## Package Information PackageName: content-type SPDXID: SPDXRef-Package-Dependency-6 @@ -1597,6 +1604,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/content-type ## Package Information PackageName: cookie SPDXID: SPDXRef-Package-Dependency-7 @@ -1605,6 +1613,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/cookie ## Package Information PackageName: cookie-parser SPDXID: SPDXRef-Package-Dependency-8 @@ -1613,6 +1622,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/cookie-parser ## Package Information PackageName: cookie-session SPDXID: SPDXRef-Package-Dependency-9 @@ -1621,6 +1631,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/cookie-session ## Package Information PackageName: cookie-signature SPDXID: SPDXRef-Package-Dependency-10 @@ -1629,6 +1640,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/cookie-signature ## Package Information PackageName: debug SPDXID: SPDXRef-Package-Dependency-11 @@ -1637,6 +1649,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/debug ## Package Information PackageName: depd SPDXID: SPDXRef-Package-Dependency-12 @@ -1645,6 +1658,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/depd ## Package Information PackageName: ejs SPDXID: SPDXRef-Package-Dependency-13 @@ -1653,6 +1667,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/ejs ## Package Information PackageName: encodeurl SPDXID: SPDXRef-Package-Dependency-14 @@ -1661,6 +1676,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/encodeurl ## Package Information PackageName: escape-html SPDXID: SPDXRef-Package-Dependency-15 @@ -1669,6 +1685,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/escape-html ## Package Information PackageName: eslint SPDXID: SPDXRef-Package-Dependency-16 @@ -1677,6 +1694,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/eslint ## Package Information PackageName: etag SPDXID: SPDXRef-Package-Dependency-17 @@ -1685,6 +1703,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/etag ## Package Information PackageName: express-session SPDXID: SPDXRef-Package-Dependency-18 @@ -1693,6 +1712,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/express-session ## Package Information PackageName: finalhandler SPDXID: SPDXRef-Package-Dependency-19 @@ -1701,6 +1721,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/finalhandler ## Package Information PackageName: fresh SPDXID: SPDXRef-Package-Dependency-20 @@ -1709,6 +1730,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/fresh ## Package Information PackageName: hbs SPDXID: SPDXRef-Package-Dependency-21 @@ -1717,6 +1739,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/hbs ## Package Information PackageName: http-errors SPDXID: SPDXRef-Package-Dependency-22 @@ -1725,6 +1748,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/http-errors ## Package Information PackageName: marked SPDXID: SPDXRef-Package-Dependency-23 @@ -1733,6 +1757,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/marked ## Package Information PackageName: merge-descriptors SPDXID: SPDXRef-Package-Dependency-24 @@ -1741,6 +1766,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/merge-descriptors ## Package Information PackageName: method-override SPDXID: SPDXRef-Package-Dependency-25 @@ -1749,6 +1775,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/method-override ## Package Information PackageName: mime-types SPDXID: SPDXRef-Package-Dependency-26 @@ -1757,6 +1784,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/mime-types ## Package Information PackageName: mocha SPDXID: SPDXRef-Package-Dependency-27 @@ -1765,6 +1793,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/mocha ## Package Information PackageName: morgan SPDXID: SPDXRef-Package-Dependency-28 @@ -1773,6 +1802,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/morgan ## Package Information PackageName: nyc SPDXID: SPDXRef-Package-Dependency-29 @@ -1781,6 +1811,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/nyc ## Package Information PackageName: on-finished SPDXID: SPDXRef-Package-Dependency-30 @@ -1789,6 +1820,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/on-finished ## Package Information PackageName: once SPDXID: SPDXRef-Package-Dependency-31 @@ -1797,6 +1829,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/once ## Package Information PackageName: parseurl SPDXID: SPDXRef-Package-Dependency-32 @@ -1805,6 +1838,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/parseurl ## Package Information PackageName: pbkdf2-password SPDXID: SPDXRef-Package-Dependency-33 @@ -1813,6 +1847,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/pbkdf2-password ## Package Information PackageName: proxy-addr SPDXID: SPDXRef-Package-Dependency-34 @@ -1821,6 +1856,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/proxy-addr ## Package Information PackageName: qs SPDXID: SPDXRef-Package-Dependency-35 @@ -1829,6 +1865,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/qs ## Package Information PackageName: range-parser SPDXID: SPDXRef-Package-Dependency-36 @@ -1837,6 +1874,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/range-parser ## Package Information PackageName: router SPDXID: SPDXRef-Package-Dependency-37 @@ -1845,6 +1883,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/router ## Package Information PackageName: send SPDXID: SPDXRef-Package-Dependency-38 @@ -1853,6 +1892,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/send ## Package Information PackageName: serve-static SPDXID: SPDXRef-Package-Dependency-39 @@ -1861,6 +1901,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/serve-static ## Package Information PackageName: statuses SPDXID: SPDXRef-Package-Dependency-40 @@ -1869,6 +1910,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/statuses ## Package Information PackageName: supertest SPDXID: SPDXRef-Package-Dependency-41 @@ -1877,6 +1919,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/supertest ## Package Information PackageName: type-is SPDXID: SPDXRef-Package-Dependency-42 @@ -1885,6 +1928,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/type-is ## Package Information PackageName: vary SPDXID: SPDXRef-Package-Dependency-43 @@ -1893,6 +1937,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/vary ## Package Information PackageName: vhost SPDXID: SPDXRef-Package-Dependency-44 @@ -1901,6 +1946,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/vhost ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-1 diff --git a/examples/sbom/flask/README.md b/examples/sbom/flask/README.md index e70b14f7a..69f40322d 100644 --- a/examples/sbom/flask/README.md +++ b/examples/sbom/flask/README.md @@ -11,8 +11,8 @@ SPDX tag-value ([`sbom.spdx`](sbom.spdx)) and CycloneDX JSON ([`sbom.cdx.json`]( ## What's inside -- **54 components** — the project plus every resolved dependency, each with a package URL (purl). -- **54 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). +- **53 components** — the project plus every resolved dependency, each with a package URL (purl). +- **52 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). ## How it compares diff --git a/examples/sbom/flask/sbom.cdx.json b/examples/sbom/flask/sbom.cdx.json index d722407fd..d8fe82ff4 100644 --- a/examples/sbom/flask/sbom.cdx.json +++ b/examples/sbom/flask/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:4d23bf82-3939-4f54-b4e2-e1a2a4c59ee8", + "serialNumber": "urn:uuid:8d6c4efc-89ee-4220-8f62-3e58f370f2e9", "version": 1, "metadata": { - "timestamp": "2026-07-23T22:12:16Z", + "timestamp": "2026-07-24T08:01:46Z", "tools": [ { "name": "Provenant", @@ -198,14 +198,6 @@ "scope": "required", "purl": "pkg:pypi/blinker@1.6.2" }, - { - "type": "library", - "bom-ref": "pkg:pypi/celery", - "name": "celery", - "version": "unknown", - "scope": "required", - "purl": "pkg:pypi/celery" - }, { "type": "library", "bom-ref": "pkg:pypi/celery@5.2.7", @@ -264,19 +256,19 @@ }, { "type": "library", - "bom-ref": "pkg:pypi/flask", + "bom-ref": "pkg:pypi/flask@2.3.2", "name": "flask", - "version": "unknown", + "version": "2.3.2", "scope": "required", - "purl": "pkg:pypi/flask" + "purl": "pkg:pypi/flask@2.3.2" }, { "type": "library", - "bom-ref": "pkg:pypi/flask@2.3.2", + "bom-ref": "pkg:pypi/flask", "name": "flask", - "version": "2.3.2", + "version": "unknown", "scope": "required", - "purl": "pkg:pypi/flask@2.3.2" + "purl": "pkg:pypi/flask" }, { "type": "library", @@ -576,10 +568,6 @@ "ref": "pkg:pypi/blinker@1.6.2", "dependsOn": [] }, - { - "ref": "pkg:pypi/celery", - "dependsOn": [] - }, { "ref": "pkg:pypi/celery@5.2.7", "dependsOn": [] @@ -619,13 +607,11 @@ "pkg:pypi/async-timeout@4.0.2", "pkg:pypi/billiard@3.6.4.0", "pkg:pypi/blinker@1.6.2", - "pkg:pypi/celery", "pkg:pypi/celery@5.2.7", "pkg:pypi/click-didyoumean@0.3.0", "pkg:pypi/click-plugins@1.1.1", "pkg:pypi/click-repl@0.2.0", "pkg:pypi/click@8.1.3", - "pkg:pypi/flask", "pkg:pypi/flask@2.3.2", "pkg:pypi/itsdangerous@2.1.2", "pkg:pypi/jinja2@3.1.2", diff --git a/examples/sbom/flask/sbom.spdx b/examples/sbom/flask/sbom.spdx index d5c1caa88..d852a4bdf 100644 --- a/examples/sbom/flask/sbom.spdx +++ b/examples/sbom/flask/sbom.spdx @@ -13,10 +13,11 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-23T22:12:15Z +Created: 2026-07-24T08:01:46Z ## Package Information PackageName: flask-example-celery SPDXID: SPDXRef-Package-1 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 94e723dc305f28b58ba1aba04e14aade037baa95 @@ -24,9 +25,11 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/flask-example-celery@1.0.0 ## Package Information PackageName: Flask SPDXID: SPDXRef-Package-2 +PackageVersion: 3.1.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 10a34637ad661d98ba3344717656fcc76209c2f8 @@ -35,9 +38,11 @@ PackageLicenseInfoFromFiles: BSD-3-Clause PackageLicenseInfoFromFiles: LicenseRef-scancode-unknown-license-reference PackageLicenseDeclared: BSD-3-Clause PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/flask@3.1.3 ## Package Information PackageName: flaskr SPDXID: SPDXRef-Package-3 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 10a34637ad661d98ba3344717656fcc76209c2f8 @@ -46,9 +51,11 @@ PackageLicenseInfoFromFiles: BSD-3-Clause PackageLicenseInfoFromFiles: LicenseRef-scancode-unknown-license-reference PackageLicenseDeclared: BSD-3-Clause PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/flaskr@1.0.0 ## Package Information PackageName: js_example SPDXID: SPDXRef-Package-4 +PackageVersion: 1.1.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 10a34637ad661d98ba3344717656fcc76209c2f8 @@ -57,6 +64,7 @@ PackageLicenseInfoFromFiles: BSD-3-Clause PackageLicenseInfoFromFiles: LicenseRef-scancode-unknown-license-reference PackageLicenseDeclared: BSD-3-Clause PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/js-example@1.1.0 ## Package Information PackageName: flask SPDXID: SPDXRef-Package-unassigned @@ -1701,11 +1709,13 @@ FileCopyrightText: NONE ## Package Information PackageName: amqp SPDXID: SPDXRef-Package-Dependency-1 +PackageVersion: 5.1.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/amqp@5.1.1 ## Package Information PackageName: asgiref SPDXID: SPDXRef-Package-Dependency-2 @@ -1714,22 +1724,27 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/asgiref ## Package Information PackageName: async-timeout SPDXID: SPDXRef-Package-Dependency-3 +PackageVersion: 4.0.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/async-timeout@4.0.2 ## Package Information PackageName: billiard SPDXID: SPDXRef-Package-Dependency-4 +PackageVersion: 3.6.4.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/billiard@3.6.4.0 ## Package Information PackageName: blinker SPDXID: SPDXRef-Package-Dependency-5 @@ -1738,78 +1753,95 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/blinker ## Package Information PackageName: blinker SPDXID: SPDXRef-Package-Dependency-6 +PackageVersion: 1.6.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/blinker@1.6.2 ## Package Information PackageName: celery SPDXID: SPDXRef-Package-Dependency-7 +PackageVersion: 5.2.7 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/celery@5.2.7 ## Package Information -PackageName: celery +PackageName: click SPDXID: SPDXRef-Package-Dependency-8 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/click ## Package Information -PackageName: click +PackageName: click-didyoumean SPDXID: SPDXRef-Package-Dependency-9 +PackageVersion: 0.3.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/click-didyoumean@0.3.0 ## Package Information -PackageName: click-didyoumean +PackageName: click-plugins SPDXID: SPDXRef-Package-Dependency-10 +PackageVersion: 1.1.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/click-plugins@1.1.1 ## Package Information -PackageName: click-plugins +PackageName: click-repl SPDXID: SPDXRef-Package-Dependency-11 +PackageVersion: 0.2.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/click-repl@0.2.0 ## Package Information -PackageName: click-repl +PackageName: click SPDXID: SPDXRef-Package-Dependency-12 +PackageVersion: 8.1.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/click@8.1.3 ## Package Information -PackageName: click +PackageName: cryptography SPDXID: SPDXRef-Package-Dependency-13 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/cryptography ## Package Information -PackageName: cryptography +PackageName: flask SPDXID: SPDXRef-Package-Dependency-14 +PackageVersion: 2.3.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/flask@2.3.2 ## Package Information PackageName: flask SPDXID: SPDXRef-Package-Dependency-15 @@ -1818,286 +1850,324 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/flask ## Package Information -PackageName: flask +PackageName: gha-update SPDXID: SPDXRef-Package-Dependency-16 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/gha-update ## Package Information -PackageName: gha-update +PackageName: greenlet SPDXID: SPDXRef-Package-Dependency-17 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/greenlet ## Package Information -PackageName: greenlet +PackageName: importlib-metadata SPDXID: SPDXRef-Package-Dependency-18 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/importlib-metadata ## Package Information -PackageName: importlib-metadata +PackageName: itsdangerous SPDXID: SPDXRef-Package-Dependency-19 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/itsdangerous ## Package Information PackageName: itsdangerous SPDXID: SPDXRef-Package-Dependency-20 +PackageVersion: 2.1.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/itsdangerous@2.1.2 ## Package Information -PackageName: itsdangerous +PackageName: jinja2 SPDXID: SPDXRef-Package-Dependency-21 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/jinja2 ## Package Information PackageName: jinja2 SPDXID: SPDXRef-Package-Dependency-22 +PackageVersion: 3.1.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/jinja2@3.1.2 ## Package Information -PackageName: jinja2 +PackageName: kombu SPDXID: SPDXRef-Package-Dependency-23 +PackageVersion: 5.2.4 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/kombu@5.2.4 ## Package Information -PackageName: kombu +PackageName: markupsafe SPDXID: SPDXRef-Package-Dependency-24 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/markupsafe ## Package Information PackageName: markupsafe SPDXID: SPDXRef-Package-Dependency-25 +PackageVersion: 2.1.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/markupsafe@2.1.2 ## Package Information -PackageName: markupsafe +PackageName: mypy SPDXID: SPDXRef-Package-Dependency-26 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/mypy ## Package Information -PackageName: mypy +PackageName: pallets-sphinx-themes SPDXID: SPDXRef-Package-Dependency-27 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pallets-sphinx-themes ## Package Information -PackageName: pallets-sphinx-themes +PackageName: pre-commit SPDXID: SPDXRef-Package-Dependency-28 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pre-commit ## Package Information -PackageName: pre-commit +PackageName: pre-commit-uv SPDXID: SPDXRef-Package-Dependency-29 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pre-commit-uv ## Package Information -PackageName: pre-commit-uv +PackageName: prompt-toolkit SPDXID: SPDXRef-Package-Dependency-30 +PackageVersion: 3.0.38 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/prompt-toolkit@3.0.38 ## Package Information -PackageName: prompt-toolkit +PackageName: pyright SPDXID: SPDXRef-Package-Dependency-31 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pyright ## Package Information -PackageName: pyright +PackageName: pytest SPDXID: SPDXRef-Package-Dependency-32 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pytest ## Package Information -PackageName: pytest +PackageName: python-dotenv SPDXID: SPDXRef-Package-Dependency-33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/python-dotenv ## Package Information -PackageName: python-dotenv +PackageName: pytz SPDXID: SPDXRef-Package-Dependency-34 +PackageVersion: 2023.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/pytz@2023.3 ## Package Information -PackageName: pytz +PackageName: redis SPDXID: SPDXRef-Package-Dependency-35 +PackageVersion: 4.5.4 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/redis@4.5.4 ## Package Information -PackageName: redis +PackageName: ruff SPDXID: SPDXRef-Package-Dependency-36 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/ruff ## Package Information -PackageName: ruff +PackageName: six SPDXID: SPDXRef-Package-Dependency-37 +PackageVersion: 1.16.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/six@1.16.0 ## Package Information -PackageName: six +PackageName: sphinx SPDXID: SPDXRef-Package-Dependency-38 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/sphinx ## Package Information -PackageName: sphinx +PackageName: sphinx-autobuild SPDXID: SPDXRef-Package-Dependency-39 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/sphinx-autobuild ## Package Information -PackageName: sphinx-autobuild +PackageName: sphinx-tabs SPDXID: SPDXRef-Package-Dependency-40 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/sphinx-tabs ## Package Information -PackageName: sphinx-tabs +PackageName: sphinxcontrib-log-cabinet SPDXID: SPDXRef-Package-Dependency-41 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/sphinxcontrib-log-cabinet ## Package Information -PackageName: sphinxcontrib-log-cabinet +PackageName: tox SPDXID: SPDXRef-Package-Dependency-42 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/tox ## Package Information -PackageName: tox +PackageName: tox-uv SPDXID: SPDXRef-Package-Dependency-43 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/tox-uv ## Package Information -PackageName: tox-uv +PackageName: types-contextvars SPDXID: SPDXRef-Package-Dependency-44 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/types-contextvars ## Package Information -PackageName: types-contextvars +PackageName: types-dataclasses SPDXID: SPDXRef-Package-Dependency-45 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/types-dataclasses ## Package Information -PackageName: types-dataclasses +PackageName: vine SPDXID: SPDXRef-Package-Dependency-46 +PackageVersion: 5.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/vine@5.0.0 ## Package Information -PackageName: vine +PackageName: wcwidth SPDXID: SPDXRef-Package-Dependency-47 +PackageVersion: 0.2.6 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/wcwidth@0.2.6 ## Package Information -PackageName: wcwidth +PackageName: werkzeug SPDXID: SPDXRef-Package-Dependency-48 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/werkzeug ## Package Information PackageName: werkzeug SPDXID: SPDXRef-Package-Dependency-49 +PackageVersion: 2.3.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE -## Package Information -PackageName: werkzeug -SPDXID: SPDXRef-Package-Dependency-50 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:pypi/werkzeug@2.3.3 ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-106 @@ -2340,41 +2410,40 @@ Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-1 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-10 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-11 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-12 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-13 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-15 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-16 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-21 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-14 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-20 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-22 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-23 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-24 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-26 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-25 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-3 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-31 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-30 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-34 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-36 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-38 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-37 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-4 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-46 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-47 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-48 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-50 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-49 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-6 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-7 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-8 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-14 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-9 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-13 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-16 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-17 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-18 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-19 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-2 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-20 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-22 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-25 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-21 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-24 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-26 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-27 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-28 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-29 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-30 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-31 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-32 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-33 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-34 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-37 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-36 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-38 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-39 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-40 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-41 @@ -2382,14 +2451,13 @@ Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-42 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-43 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-44 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-45 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-46 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-49 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-48 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-5 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-9 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-8 Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-15 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-32 Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-15 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-32 ## License Information LicenseID: LicenseRef-scancode-unknown-license-reference ExtractedText: See details at https://github.com/aboutcode-org/scancode-toolkit/tree/develop/src/licensedcode/data/rules/unknown-license-reference_see_license_at_manifest_2.RULE diff --git a/examples/sbom/ripgrep/README.md b/examples/sbom/ripgrep/README.md index aec7b044b..f3e2e7c7a 100644 --- a/examples/sbom/ripgrep/README.md +++ b/examples/sbom/ripgrep/README.md @@ -11,8 +11,8 @@ SPDX tag-value ([`sbom.spdx`](sbom.spdx)) and CycloneDX JSON ([`sbom.cdx.json`]( ## What's inside -- **114 components** — the project plus every resolved dependency, each with a package URL (purl). -- **149 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). +- **107 components** — the project plus every resolved dependency, each with a package URL (purl). +- **135 dependency relationships**, fully resolved: every `dependsOn` edge points to a component in this same document (no dangling references). A packages-only SBOM lists just the top-level package(s). ## How it compares diff --git a/examples/sbom/ripgrep/sbom.cdx.json b/examples/sbom/ripgrep/sbom.cdx.json index b477e2d9d..4f628ac04 100644 --- a/examples/sbom/ripgrep/sbom.cdx.json +++ b/examples/sbom/ripgrep/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:25e50a03-8450-46b0-b06a-42b0ff0b606c", + "serialNumber": "urn:uuid:97629256-60c7-481d-ada9-0cce9f7deb94", "version": 1, "metadata": { - "timestamp": "2026-07-23T22:12:12Z", + "timestamp": "2026-07-24T08:01:39Z", "tools": [ { "name": "Provenant", @@ -462,19 +462,12 @@ "version": "1.1.4", "purl": "pkg:cargo/aho-corasick@1.1.4" }, - { - "type": "library", - "bom-ref": "pkg:cargo/anyhow", - "name": "anyhow", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/anyhow" - }, { "type": "library", "bom-ref": "pkg:cargo/anyhow@1.0.103", "name": "anyhow", "version": "1.0.103", + "scope": "required", "purl": "pkg:cargo/anyhow@1.0.103" }, { @@ -512,6 +505,7 @@ "bom-ref": "pkg:cargo/bstr@1.13.0", "name": "bstr", "version": "1.13.0", + "scope": "required", "purl": "pkg:cargo/bstr@1.13.0" }, { @@ -659,28 +653,21 @@ "version": "0.3.3", "purl": "pkg:cargo/glob@0.3.3" }, - { - "type": "library", - "bom-ref": "pkg:cargo/globset", - "name": "globset", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/globset" - }, { "type": "library", "bom-ref": "pkg:cargo/globset@0.4.16", "name": "globset", "version": "0.4.16", + "scope": "required", "purl": "pkg:cargo/globset@0.4.16" }, { "type": "library", - "bom-ref": "pkg:cargo/grep", - "name": "grep", + "bom-ref": "pkg:cargo/globset", + "name": "globset", "version": "unknown", "scope": "required", - "purl": "pkg:cargo/grep" + "purl": "pkg:cargo/globset" }, { "type": "library", @@ -730,14 +717,6 @@ "scope": "required", "purl": "pkg:cargo/grep-searcher" }, - { - "type": "library", - "bom-ref": "pkg:cargo/ignore", - "name": "ignore", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/ignore" - }, { "type": "library", "bom-ref": "pkg:cargo/itoa@1.0.18", @@ -759,19 +738,12 @@ "version": "0.1.35", "purl": "pkg:cargo/jobserver@0.1.35" }, - { - "type": "library", - "bom-ref": "pkg:cargo/lexopt", - "name": "lexopt", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/lexopt" - }, { "type": "library", "bom-ref": "pkg:cargo/lexopt@0.3.2", "name": "lexopt", "version": "0.3.2", + "scope": "required", "purl": "pkg:cargo/lexopt@0.3.2" }, { @@ -788,19 +760,12 @@ "version": "0.2.186", "purl": "pkg:cargo/libc@0.2.186" }, - { - "type": "library", - "bom-ref": "pkg:cargo/libfuzzer-sys", - "name": "libfuzzer-sys", - "version": "unknown", - "scope": "required", - "purl": "pkg:cargo/libfuzzer-sys" - }, { "type": "library", "bom-ref": "pkg:cargo/libfuzzer-sys@0.4.7", "name": "libfuzzer-sys", "version": "0.4.7", + "scope": "required", "purl": "pkg:cargo/libfuzzer-sys@0.4.7" }, { @@ -813,17 +778,18 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/log@0.4.20", + "bom-ref": "pkg:cargo/log@0.4.33", "name": "log", - "version": "0.4.20", - "purl": "pkg:cargo/log@0.4.20" + "version": "0.4.33", + "scope": "required", + "purl": "pkg:cargo/log@0.4.33" }, { "type": "library", - "bom-ref": "pkg:cargo/log@0.4.33", + "bom-ref": "pkg:cargo/log@0.4.20", "name": "log", - "version": "0.4.33", - "purl": "pkg:cargo/log@0.4.33" + "version": "0.4.20", + "purl": "pkg:cargo/log@0.4.20" }, { "type": "library", @@ -1012,22 +978,23 @@ "bom-ref": "pkg:cargo/serde", "name": "serde", "version": "unknown", - "scope": "required", + "scope": "optional", "purl": "pkg:cargo/serde" }, { "type": "library", - "bom-ref": "pkg:cargo/serde@1.0.195", + "bom-ref": "pkg:cargo/serde@1.0.228", "name": "serde", - "version": "1.0.195", - "purl": "pkg:cargo/serde@1.0.195" + "version": "1.0.228", + "scope": "required", + "purl": "pkg:cargo/serde@1.0.228" }, { "type": "library", - "bom-ref": "pkg:cargo/serde@1.0.228", + "bom-ref": "pkg:cargo/serde@1.0.195", "name": "serde", - "version": "1.0.228", - "purl": "pkg:cargo/serde@1.0.228" + "version": "1.0.195", + "purl": "pkg:cargo/serde@1.0.195" }, { "type": "library", @@ -1038,11 +1005,11 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/serde_derive", + "bom-ref": "pkg:cargo/serde_derive@1.0.228", "name": "serde_derive", - "version": "unknown", + "version": "1.0.228", "scope": "required", - "purl": "pkg:cargo/serde_derive" + "purl": "pkg:cargo/serde_derive@1.0.228" }, { "type": "library", @@ -1051,13 +1018,6 @@ "version": "1.0.195", "purl": "pkg:cargo/serde_derive@1.0.195" }, - { - "type": "library", - "bom-ref": "pkg:cargo/serde_derive@1.0.228", - "name": "serde_derive", - "version": "1.0.228", - "purl": "pkg:cargo/serde_derive@1.0.228" - }, { "type": "library", "bom-ref": "pkg:cargo/serde_json", @@ -1071,6 +1031,7 @@ "bom-ref": "pkg:cargo/serde_json@1.0.150", "name": "serde_json", "version": "1.0.150", + "scope": "required", "purl": "pkg:cargo/serde_json@1.0.150" }, { @@ -1107,21 +1068,15 @@ "bom-ref": "pkg:cargo/termcolor@1.4.1", "name": "termcolor", "version": "1.4.1", - "purl": "pkg:cargo/termcolor@1.4.1" - }, - { - "type": "library", - "bom-ref": "pkg:cargo/textwrap", - "name": "textwrap", - "version": "unknown", "scope": "required", - "purl": "pkg:cargo/textwrap" + "purl": "pkg:cargo/termcolor@1.4.1" }, { "type": "library", "bom-ref": "pkg:cargo/textwrap@0.16.2", "name": "textwrap", "version": "0.16.2", + "scope": "required", "purl": "pkg:cargo/textwrap@0.16.2" }, { @@ -1154,18 +1109,19 @@ }, { "type": "library", - "bom-ref": "pkg:cargo/walkdir", + "bom-ref": "pkg:cargo/walkdir@2.5.0", "name": "walkdir", - "version": "unknown", + "version": "2.5.0", "scope": "required", - "purl": "pkg:cargo/walkdir" + "purl": "pkg:cargo/walkdir@2.5.0" }, { "type": "library", - "bom-ref": "pkg:cargo/walkdir@2.5.0", + "bom-ref": "pkg:cargo/walkdir", "name": "walkdir", - "version": "2.5.0", - "purl": "pkg:cargo/walkdir@2.5.0" + "version": "unknown", + "scope": "required", + "purl": "pkg:cargo/walkdir" }, { "type": "library", @@ -1209,10 +1165,6 @@ "ref": "pkg:cargo/aho-corasick@1.1.4", "dependsOn": [] }, - { - "ref": "pkg:cargo/anyhow", - "dependsOn": [] - }, { "ref": "pkg:cargo/anyhow@1.0.103", "dependsOn": [] @@ -1313,11 +1265,9 @@ "pkg:cargo/bstr@1.9.0", "pkg:cargo/cc@1.0.83", "pkg:cargo/derive_arbitrary@1.3.2", - "pkg:cargo/globset", "pkg:cargo/globset@0.4.16", "pkg:cargo/jobserver@0.1.27", "pkg:cargo/libc@0.2.152", - "pkg:cargo/libfuzzer-sys", "pkg:cargo/libfuzzer-sys@0.4.7", "pkg:cargo/log@0.4.20", "pkg:cargo/memchr@2.7.1", @@ -1366,10 +1316,6 @@ "pkg:cargo/serde_json" ] }, - { - "ref": "pkg:cargo/grep", - "dependsOn": [] - }, { "ref": "pkg:cargo/grep-cli", "dependsOn": [] @@ -1468,10 +1414,6 @@ "pkg:cargo/walkdir" ] }, - { - "ref": "pkg:cargo/ignore", - "dependsOn": [] - }, { "ref": "pkg:cargo/ignore@0.4.29", "dependsOn": [ @@ -1498,10 +1440,6 @@ "ref": "pkg:cargo/jobserver@0.1.35", "dependsOn": [] }, - { - "ref": "pkg:cargo/lexopt", - "dependsOn": [] - }, { "ref": "pkg:cargo/lexopt@0.3.2", "dependsOn": [] @@ -1514,10 +1452,6 @@ "ref": "pkg:cargo/libc@0.2.186", "dependsOn": [] }, - { - "ref": "pkg:cargo/libfuzzer-sys", - "dependsOn": [] - }, { "ref": "pkg:cargo/libfuzzer-sys@0.4.7", "dependsOn": [] @@ -1630,10 +1564,8 @@ "ref": "pkg:cargo/ripgrep@15.2.0", "dependsOn": [ "pkg:cargo/aho-corasick@1.1.4", - "pkg:cargo/anyhow", "pkg:cargo/anyhow@1.0.103", "pkg:cargo/arbitrary@1.4.2", - "pkg:cargo/bstr", "pkg:cargo/bstr@1.13.0", "pkg:cargo/cc@1.2.67", "pkg:cargo/cfg-if@1.0.4", @@ -1648,7 +1580,6 @@ "pkg:cargo/getrandom@0.4.3", "pkg:cargo/glob@0.3.3", "pkg:cargo/globset@0.4.19", - "pkg:cargo/grep", "pkg:cargo/grep-cli@0.1.12", "pkg:cargo/grep-matcher@0.1.9", "pkg:cargo/grep-pcre2@0.1.10", @@ -1656,14 +1587,11 @@ "pkg:cargo/grep-regex@0.1.14", "pkg:cargo/grep-searcher@0.1.17", "pkg:cargo/grep@0.4.1", - "pkg:cargo/ignore", "pkg:cargo/ignore@0.4.29", "pkg:cargo/itoa@1.0.18", "pkg:cargo/jobserver@0.1.35", - "pkg:cargo/lexopt", "pkg:cargo/lexopt@0.3.2", "pkg:cargo/libc@0.2.186", - "pkg:cargo/log", "pkg:cargo/log@0.4.33", "pkg:cargo/memchr@2.8.3", "pkg:cargo/memmap2@0.9.11", @@ -1677,23 +1605,17 @@ "pkg:cargo/regex-syntax@0.8.11", "pkg:cargo/regex@1.13.0", "pkg:cargo/same-file@1.0.6", - "pkg:cargo/serde", "pkg:cargo/serde@1.0.228", "pkg:cargo/serde_core@1.0.228", - "pkg:cargo/serde_derive", "pkg:cargo/serde_derive@1.0.228", - "pkg:cargo/serde_json", "pkg:cargo/serde_json@1.0.150", "pkg:cargo/shlex@2.0.1", "pkg:cargo/syn@2.0.119", - "pkg:cargo/termcolor", "pkg:cargo/termcolor@1.4.1", - "pkg:cargo/textwrap", "pkg:cargo/textwrap@0.16.2", "pkg:cargo/tikv-jemalloc-sys@0.7.1%2B5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8", "pkg:cargo/tikv-jemallocator@0.7.0", "pkg:cargo/unicode-ident@1.0.24", - "pkg:cargo/walkdir", "pkg:cargo/walkdir@2.5.0", "pkg:cargo/winapi-util@0.1.11", "pkg:cargo/windows-link@0.2.1", @@ -1725,10 +1647,6 @@ "ref": "pkg:cargo/serde_core@1.0.228", "dependsOn": [] }, - { - "ref": "pkg:cargo/serde_derive", - "dependsOn": [] - }, { "ref": "pkg:cargo/serde_derive@1.0.195", "dependsOn": [] @@ -1765,10 +1683,6 @@ "ref": "pkg:cargo/termcolor@1.4.1", "dependsOn": [] }, - { - "ref": "pkg:cargo/textwrap", - "dependsOn": [] - }, { "ref": "pkg:cargo/textwrap@0.16.2", "dependsOn": [] diff --git a/examples/sbom/ripgrep/sbom.spdx b/examples/sbom/ripgrep/sbom.spdx index 3246e378e..1bae8d031 100644 --- a/examples/sbom/ripgrep/sbom.spdx +++ b/examples/sbom/ripgrep/sbom.spdx @@ -13,10 +13,11 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-23T22:12:12Z +Created: 2026-07-24T08:01:38Z ## Package Information PackageName: fuzz SPDXID: SPDXRef-Package-1 +PackageVersion: 0.0.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 2e0767dbc9bb91ae59bf5f4297e72f9c2874882f @@ -24,9 +25,11 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/fuzz@0.0.1 ## Package Information PackageName: globset SPDXID: SPDXRef-Package-2 +PackageVersion: 0.4.19 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: a4641fc7440f9435dd38377ec029842221bf09f2 @@ -35,9 +38,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/globset@0.4.19 ## Package Information PackageName: grep-cli SPDXID: SPDXRef-Package-3 +PackageVersion: 0.1.12 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 0daec6527430984dfbfdcfa3a357a12e1b5d0eca @@ -46,9 +51,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-cli@0.1.12 ## Package Information PackageName: grep-matcher SPDXID: SPDXRef-Package-4 +PackageVersion: 0.1.9 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 01472b4d18bdd34567f7f2edc91523083ff525ef @@ -57,9 +64,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-matcher@0.1.9 ## Package Information PackageName: grep-pcre2 SPDXID: SPDXRef-Package-5 +PackageVersion: 0.1.10 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 4a55ed8385f20049c341a93c614634ab225c3506 @@ -68,9 +77,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-pcre2@0.1.10 ## Package Information PackageName: grep-printer SPDXID: SPDXRef-Package-6 +PackageVersion: 0.3.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 016a80314935f80eae19154c6bf99520ba63eff3 @@ -79,9 +90,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-printer@0.3.1 ## Package Information PackageName: grep-regex SPDXID: SPDXRef-Package-7 +PackageVersion: 0.1.14 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: a6eebff08f9c03fe260145837a6e59a0ca67570a @@ -90,9 +103,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-regex@0.1.14 ## Package Information PackageName: grep-searcher SPDXID: SPDXRef-Package-8 +PackageVersion: 0.1.17 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 835822eb40ce254ad0cf4cb1df89c814613d47ea @@ -101,9 +116,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-searcher@0.1.17 ## Package Information PackageName: grep SPDXID: SPDXRef-Package-9 +PackageVersion: 0.4.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 4a55ed8385f20049c341a93c614634ab225c3506 @@ -112,9 +129,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep@0.4.1 ## Package Information PackageName: ignore SPDXID: SPDXRef-Package-10 +PackageVersion: 0.4.29 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: ff7a120ddcac30925f40819e3f4254c91d372057 @@ -127,9 +146,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseInfoFromFiles: Unlicense PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/ignore@0.4.29 ## Package Information PackageName: ripgrep SPDXID: SPDXRef-Package-11 +PackageVersion: 15.2.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 5da12ee7757ca1904c357805da062b8b7da23282 @@ -148,6 +169,7 @@ PackageLicenseDeclared: MIT OR Unlicense PackageCopyrightText: Copyright (c) 2011 Github Copyright (c) 2011 Github zsh-users - http://github.com/zsh-users Copyright (c) 2015 Andrew Gallant +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/ripgrep@15.2.0 ## File Information FileName: ./.cargo/config.toml SPDXID: SPDXRef-1 @@ -1723,238 +1745,290 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/aho-corasick ## Package Information PackageName: aho-corasick SPDXID: SPDXRef-Package-Dependency-2 +PackageVersion: 1.1.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/aho-corasick@1.1.2 ## Package Information PackageName: aho-corasick SPDXID: SPDXRef-Package-Dependency-3 +PackageVersion: 1.1.4 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/aho-corasick@1.1.4 ## Package Information PackageName: anyhow SPDXID: SPDXRef-Package-Dependency-4 +PackageVersion: 1.0.103 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/anyhow@1.0.103 ## Package Information -PackageName: anyhow +PackageName: arbitrary SPDXID: SPDXRef-Package-Dependency-5 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/arbitrary ## Package Information PackageName: arbitrary SPDXID: SPDXRef-Package-Dependency-6 +PackageVersion: 1.3.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/arbitrary@1.3.2 ## Package Information PackageName: arbitrary SPDXID: SPDXRef-Package-Dependency-7 +PackageVersion: 1.4.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/arbitrary@1.4.2 ## Package Information -PackageName: arbitrary +PackageName: bstr SPDXID: SPDXRef-Package-Dependency-8 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/bstr ## Package Information PackageName: bstr SPDXID: SPDXRef-Package-Dependency-9 +PackageVersion: 1.13.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/bstr@1.13.0 ## Package Information PackageName: bstr SPDXID: SPDXRef-Package-Dependency-10 +PackageVersion: 1.9.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/bstr@1.9.0 ## Package Information -PackageName: bstr +PackageName: cc SPDXID: SPDXRef-Package-Dependency-11 +PackageVersion: 1.0.83 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/cc@1.0.83 ## Package Information PackageName: cc SPDXID: SPDXRef-Package-Dependency-12 +PackageVersion: 1.2.67 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/cc@1.2.67 ## Package Information -PackageName: cc +PackageName: cfg-if SPDXID: SPDXRef-Package-Dependency-13 +PackageVersion: 1.0.4 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/cfg-if@1.0.4 ## Package Information -PackageName: cfg-if +PackageName: crossbeam-channel SPDXID: SPDXRef-Package-Dependency-14 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-channel ## Package Information PackageName: crossbeam-channel SPDXID: SPDXRef-Package-Dependency-15 +PackageVersion: 0.5.16 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-channel@0.5.16 ## Package Information -PackageName: crossbeam-channel +PackageName: crossbeam-deque SPDXID: SPDXRef-Package-Dependency-16 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-deque ## Package Information PackageName: crossbeam-deque SPDXID: SPDXRef-Package-Dependency-17 +PackageVersion: 0.8.7 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-deque@0.8.7 ## Package Information -PackageName: crossbeam-deque +PackageName: crossbeam-epoch SPDXID: SPDXRef-Package-Dependency-18 +PackageVersion: 0.9.20 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-epoch@0.9.20 ## Package Information -PackageName: crossbeam-epoch +PackageName: crossbeam-utils SPDXID: SPDXRef-Package-Dependency-19 +PackageVersion: 0.8.22 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/crossbeam-utils@0.8.22 ## Package Information -PackageName: crossbeam-utils +PackageName: derive_arbitrary SPDXID: SPDXRef-Package-Dependency-20 +PackageVersion: 1.3.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/derive_arbitrary@1.3.2 ## Package Information PackageName: derive_arbitrary SPDXID: SPDXRef-Package-Dependency-21 +PackageVersion: 1.4.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/derive_arbitrary@1.4.2 ## Package Information -PackageName: derive_arbitrary +PackageName: encoding_rs SPDXID: SPDXRef-Package-Dependency-22 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/encoding_rs ## Package Information PackageName: encoding_rs SPDXID: SPDXRef-Package-Dependency-23 +PackageVersion: 0.8.35 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/encoding_rs@0.8.35 ## Package Information -PackageName: encoding_rs +PackageName: encoding_rs_io SPDXID: SPDXRef-Package-Dependency-24 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/encoding_rs_io ## Package Information PackageName: encoding_rs_io SPDXID: SPDXRef-Package-Dependency-25 +PackageVersion: 0.1.7 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/encoding_rs_io@0.1.7 ## Package Information -PackageName: encoding_rs_io +PackageName: find-msvc-tools SPDXID: SPDXRef-Package-Dependency-26 +PackageVersion: 0.1.9 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/find-msvc-tools@0.1.9 ## Package Information -PackageName: find-msvc-tools +PackageName: getrandom SPDXID: SPDXRef-Package-Dependency-27 +PackageVersion: 0.4.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/getrandom@0.4.3 ## Package Information -PackageName: getrandom +PackageName: glob SPDXID: SPDXRef-Package-Dependency-28 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/glob ## Package Information PackageName: glob SPDXID: SPDXRef-Package-Dependency-29 +PackageVersion: 0.3.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/glob@0.3.3 ## Package Information -PackageName: glob +PackageName: globset SPDXID: SPDXRef-Package-Dependency-30 +PackageVersion: 0.4.16 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/globset@0.4.16 ## Package Information PackageName: globset SPDXID: SPDXRef-Package-Dependency-31 @@ -1963,582 +2037,639 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE -## Package Information -PackageName: globset -SPDXID: SPDXRef-Package-Dependency-32 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: grep -SPDXID: SPDXRef-Package-Dependency-33 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/globset ## Package Information PackageName: grep-cli -SPDXID: SPDXRef-Package-Dependency-34 +SPDXID: SPDXRef-Package-Dependency-32 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-cli ## Package Information PackageName: grep-matcher -SPDXID: SPDXRef-Package-Dependency-35 +SPDXID: SPDXRef-Package-Dependency-33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-matcher ## Package Information PackageName: grep-pcre2 -SPDXID: SPDXRef-Package-Dependency-36 +SPDXID: SPDXRef-Package-Dependency-34 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-pcre2 ## Package Information PackageName: grep-printer -SPDXID: SPDXRef-Package-Dependency-37 +SPDXID: SPDXRef-Package-Dependency-35 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-printer ## Package Information PackageName: grep-regex -SPDXID: SPDXRef-Package-Dependency-38 +SPDXID: SPDXRef-Package-Dependency-36 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-regex ## Package Information PackageName: grep-searcher -SPDXID: SPDXRef-Package-Dependency-39 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: ignore -SPDXID: SPDXRef-Package-Dependency-40 +SPDXID: SPDXRef-Package-Dependency-37 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/grep-searcher ## Package Information PackageName: itoa -SPDXID: SPDXRef-Package-Dependency-41 +SPDXID: SPDXRef-Package-Dependency-38 +PackageVersion: 1.0.18 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/itoa@1.0.18 ## Package Information PackageName: jobserver -SPDXID: SPDXRef-Package-Dependency-42 +SPDXID: SPDXRef-Package-Dependency-39 +PackageVersion: 0.1.27 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/jobserver@0.1.27 ## Package Information PackageName: jobserver -SPDXID: SPDXRef-Package-Dependency-43 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: lexopt -SPDXID: SPDXRef-Package-Dependency-44 +SPDXID: SPDXRef-Package-Dependency-40 +PackageVersion: 0.1.35 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/jobserver@0.1.35 ## Package Information PackageName: lexopt -SPDXID: SPDXRef-Package-Dependency-45 +SPDXID: SPDXRef-Package-Dependency-41 +PackageVersion: 0.3.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/lexopt@0.3.2 ## Package Information PackageName: libc -SPDXID: SPDXRef-Package-Dependency-46 +SPDXID: SPDXRef-Package-Dependency-42 +PackageVersion: 0.2.152 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/libc@0.2.152 ## Package Information PackageName: libc -SPDXID: SPDXRef-Package-Dependency-47 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: libfuzzer-sys -SPDXID: SPDXRef-Package-Dependency-48 +SPDXID: SPDXRef-Package-Dependency-43 +PackageVersion: 0.2.186 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/libc@0.2.186 ## Package Information PackageName: libfuzzer-sys -SPDXID: SPDXRef-Package-Dependency-49 +SPDXID: SPDXRef-Package-Dependency-44 +PackageVersion: 0.4.7 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/libfuzzer-sys@0.4.7 ## Package Information PackageName: log -SPDXID: SPDXRef-Package-Dependency-50 +SPDXID: SPDXRef-Package-Dependency-45 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/log ## Package Information PackageName: log -SPDXID: SPDXRef-Package-Dependency-51 +SPDXID: SPDXRef-Package-Dependency-46 +PackageVersion: 0.4.33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/log@0.4.33 ## Package Information PackageName: log -SPDXID: SPDXRef-Package-Dependency-52 +SPDXID: SPDXRef-Package-Dependency-47 +PackageVersion: 0.4.20 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/log@0.4.20 ## Package Information PackageName: memchr -SPDXID: SPDXRef-Package-Dependency-53 +SPDXID: SPDXRef-Package-Dependency-48 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/memchr ## Package Information PackageName: memchr -SPDXID: SPDXRef-Package-Dependency-54 +SPDXID: SPDXRef-Package-Dependency-49 +PackageVersion: 2.7.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/memchr@2.7.1 ## Package Information PackageName: memchr -SPDXID: SPDXRef-Package-Dependency-55 +SPDXID: SPDXRef-Package-Dependency-50 +PackageVersion: 2.8.3 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/memchr@2.8.3 ## Package Information PackageName: memmap -SPDXID: SPDXRef-Package-Dependency-56 +SPDXID: SPDXRef-Package-Dependency-51 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/memmap ## Package Information PackageName: memmap2 -SPDXID: SPDXRef-Package-Dependency-57 +SPDXID: SPDXRef-Package-Dependency-52 +PackageVersion: 0.9.11 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/memmap2@0.9.11 ## Package Information PackageName: once_cell -SPDXID: SPDXRef-Package-Dependency-58 +SPDXID: SPDXRef-Package-Dependency-53 +PackageVersion: 1.19.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/once_cell@1.19.0 ## Package Information PackageName: pcre2 -SPDXID: SPDXRef-Package-Dependency-59 +SPDXID: SPDXRef-Package-Dependency-54 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/pcre2 ## Package Information PackageName: pcre2-sys -SPDXID: SPDXRef-Package-Dependency-60 +SPDXID: SPDXRef-Package-Dependency-55 +PackageVersion: 0.2.10 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/pcre2-sys@0.2.10 ## Package Information PackageName: pcre2 -SPDXID: SPDXRef-Package-Dependency-61 +SPDXID: SPDXRef-Package-Dependency-56 +PackageVersion: 0.2.11 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/pcre2@0.2.11 ## Package Information PackageName: pkg-config -SPDXID: SPDXRef-Package-Dependency-62 +SPDXID: SPDXRef-Package-Dependency-57 +PackageVersion: 0.3.33 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/pkg-config@0.3.33 ## Package Information PackageName: proc-macro2 -SPDXID: SPDXRef-Package-Dependency-63 +SPDXID: SPDXRef-Package-Dependency-58 +PackageVersion: 1.0.106 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/proc-macro2@1.0.106 ## Package Information PackageName: proc-macro2 -SPDXID: SPDXRef-Package-Dependency-64 +SPDXID: SPDXRef-Package-Dependency-59 +PackageVersion: 1.0.78 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/proc-macro2@1.0.78 ## Package Information PackageName: quote -SPDXID: SPDXRef-Package-Dependency-65 +SPDXID: SPDXRef-Package-Dependency-60 +PackageVersion: 1.0.35 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/quote@1.0.35 ## Package Information PackageName: quote -SPDXID: SPDXRef-Package-Dependency-66 +SPDXID: SPDXRef-Package-Dependency-61 +PackageVersion: 1.0.46 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/quote@1.0.46 ## Package Information PackageName: r-efi -SPDXID: SPDXRef-Package-Dependency-67 +SPDXID: SPDXRef-Package-Dependency-62 +PackageVersion: 6.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/r-efi@6.0.0 ## Package Information PackageName: regex -SPDXID: SPDXRef-Package-Dependency-68 +SPDXID: SPDXRef-Package-Dependency-63 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex ## Package Information PackageName: regex-automata -SPDXID: SPDXRef-Package-Dependency-69 +SPDXID: SPDXRef-Package-Dependency-64 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-automata ## Package Information PackageName: regex-automata -SPDXID: SPDXRef-Package-Dependency-70 +SPDXID: SPDXRef-Package-Dependency-65 +PackageVersion: 0.4.15 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-automata@0.4.15 ## Package Information PackageName: regex-automata -SPDXID: SPDXRef-Package-Dependency-71 +SPDXID: SPDXRef-Package-Dependency-66 +PackageVersion: 0.4.4 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-automata@0.4.4 ## Package Information PackageName: regex-syntax -SPDXID: SPDXRef-Package-Dependency-72 +SPDXID: SPDXRef-Package-Dependency-67 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-syntax ## Package Information PackageName: regex-syntax -SPDXID: SPDXRef-Package-Dependency-73 +SPDXID: SPDXRef-Package-Dependency-68 +PackageVersion: 0.8.11 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-syntax@0.8.11 ## Package Information PackageName: regex-syntax -SPDXID: SPDXRef-Package-Dependency-74 +SPDXID: SPDXRef-Package-Dependency-69 +PackageVersion: 0.8.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex-syntax@0.8.2 ## Package Information PackageName: regex -SPDXID: SPDXRef-Package-Dependency-75 +SPDXID: SPDXRef-Package-Dependency-70 +PackageVersion: 1.13.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/regex@1.13.0 ## Package Information PackageName: same-file -SPDXID: SPDXRef-Package-Dependency-76 +SPDXID: SPDXRef-Package-Dependency-71 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/same-file ## Package Information PackageName: same-file -SPDXID: SPDXRef-Package-Dependency-77 +SPDXID: SPDXRef-Package-Dependency-72 +PackageVersion: 1.0.6 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/same-file@1.0.6 ## Package Information PackageName: serde -SPDXID: SPDXRef-Package-Dependency-78 +SPDXID: SPDXRef-Package-Dependency-73 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde ## Package Information PackageName: serde -SPDXID: SPDXRef-Package-Dependency-79 +SPDXID: SPDXRef-Package-Dependency-74 +PackageVersion: 1.0.228 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde@1.0.228 ## Package Information PackageName: serde -SPDXID: SPDXRef-Package-Dependency-80 +SPDXID: SPDXRef-Package-Dependency-75 +PackageVersion: 1.0.195 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde@1.0.195 ## Package Information PackageName: serde_core -SPDXID: SPDXRef-Package-Dependency-81 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: serde_derive -SPDXID: SPDXRef-Package-Dependency-82 +SPDXID: SPDXRef-Package-Dependency-76 +PackageVersion: 1.0.228 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_core@1.0.228 ## Package Information PackageName: serde_derive -SPDXID: SPDXRef-Package-Dependency-83 +SPDXID: SPDXRef-Package-Dependency-77 +PackageVersion: 1.0.228 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_derive@1.0.228 ## Package Information PackageName: serde_derive -SPDXID: SPDXRef-Package-Dependency-84 +SPDXID: SPDXRef-Package-Dependency-78 +PackageVersion: 1.0.195 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_derive@1.0.195 ## Package Information PackageName: serde_json -SPDXID: SPDXRef-Package-Dependency-85 +SPDXID: SPDXRef-Package-Dependency-79 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_json ## Package Information PackageName: serde_json -SPDXID: SPDXRef-Package-Dependency-86 +SPDXID: SPDXRef-Package-Dependency-80 +PackageVersion: 1.0.150 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_json@1.0.150 ## Package Information PackageName: shlex -SPDXID: SPDXRef-Package-Dependency-87 +SPDXID: SPDXRef-Package-Dependency-81 +PackageVersion: 2.0.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/shlex@2.0.1 ## Package Information PackageName: syn -SPDXID: SPDXRef-Package-Dependency-88 +SPDXID: SPDXRef-Package-Dependency-82 +PackageVersion: 2.0.119 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/syn@2.0.119 ## Package Information PackageName: syn -SPDXID: SPDXRef-Package-Dependency-89 +SPDXID: SPDXRef-Package-Dependency-83 +PackageVersion: 2.0.48 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/syn@2.0.48 ## Package Information PackageName: termcolor -SPDXID: SPDXRef-Package-Dependency-90 +SPDXID: SPDXRef-Package-Dependency-84 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/termcolor ## Package Information PackageName: termcolor -SPDXID: SPDXRef-Package-Dependency-91 -PackageDownloadLocation: NOASSERTION -FilesAnalyzed: false -PackageLicenseConcluded: NOASSERTION -PackageLicenseDeclared: NOASSERTION -PackageCopyrightText: NONE -## Package Information -PackageName: textwrap -SPDXID: SPDXRef-Package-Dependency-92 +SPDXID: SPDXRef-Package-Dependency-85 +PackageVersion: 1.4.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/termcolor@1.4.1 ## Package Information PackageName: textwrap -SPDXID: SPDXRef-Package-Dependency-93 +SPDXID: SPDXRef-Package-Dependency-86 +PackageVersion: 0.16.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/textwrap@0.16.2 ## Package Information PackageName: tikv-jemalloc-sys -SPDXID: SPDXRef-Package-Dependency-94 +SPDXID: SPDXRef-Package-Dependency-87 +PackageVersion: 0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tikv-jemalloc-sys@0.7.1%2B5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8 ## Package Information PackageName: tikv-jemallocator -SPDXID: SPDXRef-Package-Dependency-95 +SPDXID: SPDXRef-Package-Dependency-88 +PackageVersion: 0.7.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tikv-jemallocator@0.7.0 ## Package Information PackageName: unicode-ident -SPDXID: SPDXRef-Package-Dependency-96 +SPDXID: SPDXRef-Package-Dependency-89 +PackageVersion: 1.0.12 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/unicode-ident@1.0.12 ## Package Information PackageName: unicode-ident -SPDXID: SPDXRef-Package-Dependency-97 +SPDXID: SPDXRef-Package-Dependency-90 +PackageVersion: 1.0.24 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/unicode-ident@1.0.24 ## Package Information PackageName: walkdir -SPDXID: SPDXRef-Package-Dependency-98 +SPDXID: SPDXRef-Package-Dependency-91 +PackageVersion: 2.5.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/walkdir@2.5.0 ## Package Information PackageName: walkdir -SPDXID: SPDXRef-Package-Dependency-99 +SPDXID: SPDXRef-Package-Dependency-92 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/walkdir ## Package Information PackageName: winapi-util -SPDXID: SPDXRef-Package-Dependency-100 +SPDXID: SPDXRef-Package-Dependency-93 +PackageVersion: 0.1.11 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/winapi-util@0.1.11 ## Package Information PackageName: windows-link -SPDXID: SPDXRef-Package-Dependency-101 +SPDXID: SPDXRef-Package-Dependency-94 +PackageVersion: 0.2.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/windows-link@0.2.1 ## Package Information PackageName: windows-sys -SPDXID: SPDXRef-Package-Dependency-102 +SPDXID: SPDXRef-Package-Dependency-95 +PackageVersion: 0.61.2 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/windows-sys@0.61.2 ## Package Information PackageName: zmij -SPDXID: SPDXRef-Package-Dependency-103 +SPDXID: SPDXRef-Package-Dependency-96 +PackageVersion: 1.0.23 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/zmij@1.0.23 ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-192 @@ -2883,37 +3014,35 @@ Relationship: SPDXRef-Package-11 CONTAINS SPDXRef-216 Relationship: SPDXRef-Package-11 CONTAINS SPDXRef-217 Relationship: SPDXRef-Package-11 CONTAINS SPDXRef-218 Relationship: SPDXRef-Package-11 CONTAINS SPDXRef-219 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-10 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-11 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-12 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-2 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-21 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-31 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-20 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-30 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-39 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-42 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-46 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-48 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-44 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-47 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-49 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-51 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-54 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-58 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-64 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-65 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-7 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-71 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-74 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-79 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-53 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-59 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-6 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-60 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-66 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-69 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-75 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-78 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-83 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-89 -Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-96 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-15 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-17 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-14 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-16 Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-31 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-53 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-69 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-76 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-98 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-48 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-64 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-71 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-10 DEPENDS_ON SPDXRef-Package-Dependency-92 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-10 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-2 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-3 @@ -2923,53 +3052,44 @@ Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-6 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-7 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-8 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-9 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-10 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-100 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-101 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-102 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-103 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-12 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-13 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-14 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-16 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-15 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-17 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-18 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-19 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-20 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-22 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-24 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-21 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-23 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-25 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-26 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-27 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-28 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-29 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-3 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-30 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-38 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-4 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-40 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-41 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-43 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-44 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-45 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-47 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-5 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-46 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-50 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-52 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-55 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-56 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-57 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-60 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-58 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-61 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-62 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-63 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-66 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-67 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-65 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-68 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-7 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-70 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-73 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-75 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-72 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-74 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-76 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-77 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-78 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-8 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-80 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-81 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-82 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-84 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-85 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-86 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-87 @@ -2977,61 +3097,58 @@ Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-88 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-9 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-90 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-91 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-92 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-93 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-94 Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-95 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-97 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-98 -Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-99 +Relationship: SPDXRef-Package-11 DEPENDS_ON SPDXRef-Package-Dependency-96 Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-1 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-29 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-6 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-69 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-72 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-78 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-85 -Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-9 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-28 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-5 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-64 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-67 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-73 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-79 +Relationship: SPDXRef-Package-2 DEPENDS_ON SPDXRef-Package-Dependency-8 Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-31 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-90 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-53 -Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-68 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-59 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-38 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-39 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-78 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-85 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-90 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-69 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-72 -Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-9 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-23 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-25 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-35 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-38 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-50 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-53 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-56 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-68 -Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-9 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-3 DEPENDS_ON SPDXRef-Package-Dependency-84 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-48 +Relationship: SPDXRef-Package-4 DEPENDS_ON SPDXRef-Package-Dependency-63 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-5 DEPENDS_ON SPDXRef-Package-Dependency-54 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-36 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-37 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-73 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-79 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-6 DEPENDS_ON SPDXRef-Package-Dependency-84 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-64 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-67 +Relationship: SPDXRef-Package-7 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-22 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-24 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-33 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-36 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-45 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-48 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-51 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-63 +Relationship: SPDXRef-Package-8 DEPENDS_ON SPDXRef-Package-Dependency-8 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-32 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-33 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-34 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-35 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-36 Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-37 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-38 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-39 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-90 -Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-98 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-84 +Relationship: SPDXRef-Package-9 DEPENDS_ON SPDXRef-Package-Dependency-92 ## License Information LicenseID: LicenseRef-scancode-unknown-license-reference ExtractedText: See details at https://github.com/aboutcode-org/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lead-in_unknown_30.RULE diff --git a/examples/sbom/tokio/sbom.cdx.json b/examples/sbom/tokio/sbom.cdx.json index dc75b3558..571527508 100644 --- a/examples/sbom/tokio/sbom.cdx.json +++ b/examples/sbom/tokio/sbom.cdx.json @@ -1,10 +1,10 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:8c52a871-dde8-4702-aa98-ffbbb205c6a9", + "serialNumber": "urn:uuid:abc23e86-21fc-45d2-aa08-5ffe58efb2e9", "version": 1, "metadata": { - "timestamp": "2026-07-23T22:12:18Z", + "timestamp": "2026-07-24T08:01:51Z", "tools": [ { "name": "Provenant", diff --git a/examples/sbom/tokio/sbom.spdx b/examples/sbom/tokio/sbom.spdx index 37f2216a0..cb512a085 100644 --- a/examples/sbom/tokio/sbom.spdx +++ b/examples/sbom/tokio/sbom.spdx @@ -13,10 +13,11 @@ Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information Creator: Tool: Provenant-1.0.1 -Created: 2026-07-23T22:12:17Z +Created: 2026-07-24T08:01:50Z ## Package Information PackageName: benches SPDXID: SPDXRef-Package-1 +PackageVersion: 0.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 5a81fff35ef5c81e42ebcbcef9537afcde153a5a @@ -26,9 +27,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/benches@0.0.0 ## Package Information PackageName: examples SPDXID: SPDXRef-Package-2 +PackageVersion: 0.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 39464e61fe27a50459cd14ae93d09e177b0542b7 @@ -38,9 +41,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/examples@0.0.0 ## Package Information PackageName: stress-test SPDXID: SPDXRef-Package-3 +PackageVersion: 0.1.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 30fd08be04f99aadba1d69d7a35b492a7645482e @@ -50,9 +55,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/stress-test@0.1.0 ## Package Information PackageName: tests-build SPDXID: SPDXRef-Package-4 +PackageVersion: 0.1.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 39464e61fe27a50459cd14ae93d09e177b0542b7 @@ -62,9 +69,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tests-build@0.1.0 ## Package Information PackageName: tests-integration SPDXID: SPDXRef-Package-5 +PackageVersion: 0.1.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 43e08c01a8b8a3c516f98e6ef7b1083a92536974 @@ -74,9 +83,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tests-integration@0.1.0 ## Package Information PackageName: tokio-fuzz SPDXID: SPDXRef-Package-6 +PackageVersion: 0.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 94e723dc305f28b58ba1aba04e14aade037baa95 @@ -84,9 +95,11 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-fuzz@0.0.0 ## Package Information PackageName: tokio-macros SPDXID: SPDXRef-Package-7 +PackageVersion: 2.7.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: f55b97d80aed21c1644c24c49e35cc86aa8c9bb9 @@ -97,9 +110,11 @@ PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) 2019 Yoshua Wuyts Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-macros@2.7.1 ## Package Information PackageName: tokio-stream-fuzz SPDXID: SPDXRef-Package-8 +PackageVersion: 0.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 94e723dc305f28b58ba1aba04e14aade037baa95 @@ -107,9 +122,11 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-stream-fuzz@0.0.0 ## Package Information PackageName: tokio-stream SPDXID: SPDXRef-Package-9 +PackageVersion: 0.1.18 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 8fa7072d1e15a3e9a6c95d428b2b954294d58e5e @@ -119,9 +136,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-stream@0.1.18 ## Package Information PackageName: tokio-test SPDXID: SPDXRef-Package-10 +PackageVersion: 0.4.5 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 1836b8628c3230a8677fcb87ad28bad263e7eb94 @@ -131,9 +150,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-test@0.4.5 ## Package Information PackageName: tokio-util SPDXID: SPDXRef-Package-11 +PackageVersion: 0.7.18 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: f852916d00afee02b0e8a70733712d23e8323ebe @@ -143,9 +164,11 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-util@0.7.18 ## Package Information PackageName: tokio SPDXID: SPDXRef-Package-12 +PackageVersion: 1.53.1 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 9688db982320e1d79a81501339bc4593b0c3099a @@ -155,6 +178,7 @@ PackageLicenseInfoFromFiles: LicenseRef-scancode-generic-cla PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: Copyright (c) Tokio Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio@1.53.1 ## File Information FileName: ./.github/FUNDING.yml SPDXID: SPDXRef-1 @@ -6211,6 +6235,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/async-stream ## Package Information PackageName: bytes SPDXID: SPDXRef-Package-Dependency-2 @@ -6219,6 +6244,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/bytes ## Package Information PackageName: criterion SPDXID: SPDXRef-Package-Dependency-3 @@ -6227,6 +6253,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/criterion ## Package Information PackageName: doc-comment SPDXID: SPDXRef-Package-Dependency-4 @@ -6235,6 +6262,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/doc-comment ## Package Information PackageName: futures SPDXID: SPDXRef-Package-Dependency-5 @@ -6243,6 +6271,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures ## Package Information PackageName: futures-concurrency SPDXID: SPDXRef-Package-Dependency-6 @@ -6251,6 +6280,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-concurrency ## Package Information PackageName: futures-core SPDXID: SPDXRef-Package-Dependency-7 @@ -6259,6 +6289,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-core ## Package Information PackageName: futures-io SPDXID: SPDXRef-Package-Dependency-8 @@ -6267,6 +6298,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-io ## Package Information PackageName: futures-sink SPDXID: SPDXRef-Package-Dependency-9 @@ -6275,6 +6307,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-sink ## Package Information PackageName: futures-test SPDXID: SPDXRef-Package-Dependency-10 @@ -6283,6 +6316,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-test ## Package Information PackageName: futures-util SPDXID: SPDXRef-Package-Dependency-11 @@ -6291,6 +6325,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/futures-util ## Package Information PackageName: hashbrown SPDXID: SPDXRef-Package-Dependency-12 @@ -6299,6 +6334,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/hashbrown ## Package Information PackageName: http SPDXID: SPDXRef-Package-Dependency-13 @@ -6307,6 +6343,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/http ## Package Information PackageName: httparse SPDXID: SPDXRef-Package-Dependency-14 @@ -6315,6 +6352,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/httparse ## Package Information PackageName: httpdate SPDXID: SPDXRef-Package-Dependency-15 @@ -6323,6 +6361,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/httpdate ## Package Information PackageName: libfuzzer-sys SPDXID: SPDXRef-Package-Dependency-16 @@ -6331,6 +6370,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/libfuzzer-sys ## Package Information PackageName: mio SPDXID: SPDXRef-Package-Dependency-17 @@ -6339,6 +6379,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/mio ## Package Information PackageName: mockall SPDXID: SPDXRef-Package-Dependency-18 @@ -6347,6 +6388,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/mockall ## Package Information PackageName: once_cell SPDXID: SPDXRef-Package-Dependency-19 @@ -6355,6 +6397,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/once_cell ## Package Information PackageName: parking_lot SPDXID: SPDXRef-Package-Dependency-20 @@ -6363,6 +6406,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/parking_lot ## Package Information PackageName: pin-project-lite SPDXID: SPDXRef-Package-Dependency-21 @@ -6371,6 +6415,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/pin-project-lite ## Package Information PackageName: proc-macro2 SPDXID: SPDXRef-Package-Dependency-22 @@ -6379,6 +6424,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/proc-macro2 ## Package Information PackageName: quote SPDXID: SPDXRef-Package-Dependency-23 @@ -6387,6 +6433,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/quote ## Package Information PackageName: rand SPDXID: SPDXRef-Package-Dependency-24 @@ -6395,6 +6442,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/rand ## Package Information PackageName: rand_chacha SPDXID: SPDXRef-Package-Dependency-25 @@ -6403,6 +6451,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/rand_chacha ## Package Information PackageName: serde SPDXID: SPDXRef-Package-Dependency-26 @@ -6411,6 +6460,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde ## Package Information PackageName: serde_derive SPDXID: SPDXRef-Package-Dependency-27 @@ -6419,6 +6469,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_derive ## Package Information PackageName: serde_json SPDXID: SPDXRef-Package-Dependency-28 @@ -6427,6 +6478,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/serde_json ## Package Information PackageName: slab SPDXID: SPDXRef-Package-Dependency-29 @@ -6435,6 +6487,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/slab ## Package Information PackageName: syn SPDXID: SPDXRef-Package-Dependency-30 @@ -6443,6 +6496,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/syn ## Package Information PackageName: tempfile SPDXID: SPDXRef-Package-Dependency-31 @@ -6451,6 +6505,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tempfile ## Package Information PackageName: tokio SPDXID: SPDXRef-Package-Dependency-32 @@ -6459,6 +6514,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio ## Package Information PackageName: tokio-macros SPDXID: SPDXRef-Package-Dependency-33 @@ -6467,6 +6523,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-macros ## Package Information PackageName: tokio-stream SPDXID: SPDXRef-Package-Dependency-34 @@ -6475,6 +6532,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-stream ## Package Information PackageName: tokio-test SPDXID: SPDXRef-Package-Dependency-35 @@ -6483,6 +6541,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-test ## Package Information PackageName: tokio-util SPDXID: SPDXRef-Package-Dependency-36 @@ -6491,6 +6550,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tokio-util ## Package Information PackageName: tracing SPDXID: SPDXRef-Package-Dependency-37 @@ -6499,6 +6559,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tracing ## Package Information PackageName: tracing-subscriber SPDXID: SPDXRef-Package-Dependency-38 @@ -6507,6 +6568,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/tracing-subscriber ## Package Information PackageName: trybuild SPDXID: SPDXRef-Package-Dependency-39 @@ -6515,6 +6577,7 @@ FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:cargo/trybuild ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-1 diff --git a/src/output/sbom.rs b/src/output/sbom.rs index 402ab59ab..4d3421fd5 100644 --- a/src/output/sbom.rs +++ b/src/output/sbom.rs @@ -66,6 +66,12 @@ impl<'a> InventoryEntry<'a> { /// The identical component/package inventory used by CycloneDX and SPDX. pub(crate) struct SbomInventory<'a> { pub entries: Vec>, + /// Per-owner version evidence: `(owner package_uid, version-less purl + /// identity)` → the versioned purls that owner's own dependency edges + /// resolved that identity to. Scoped by owner so an unversioned requirement + /// under one package never inherits a version another package resolved the + /// same name to. See ADR 0012. + version_index: VersionIndex, } impl<'a> SbomInventory<'a> { @@ -76,25 +82,43 @@ impl<'a> SbomInventory<'a> { pub(crate) fn packages(&self) -> impl Iterator { self.entries.iter().map(InventoryEntry::package) } + + /// Resolve a dependency edge to the purl its component and graph edges use. + /// An already-versioned edge keeps its purl; an unversioned one is upgraded + /// only from that edge's own `resolved_package`, or from a single + /// unambiguous versioned sibling under the **same owner** — never across + /// owners and never by guessing among multiple versions. Promotion and + /// graph-edge resolution both route through this so a versioned component + /// and the edges that target it stay consistent and the graph stays closed. + pub(crate) fn resolve_edge_purl(&self, dep: &TopLevelDependency) -> Option { + resolve_edge_purl(dep, &self.version_index) + } } /// Build the shared inventory: detected packages, then every resolved /// dependency promoted and deduped by purl (ADR 0012). pub(crate) fn build_inventory(output: &Output) -> SbomInventory<'_> { + let version_index = build_version_index(&output.dependencies); + let mut entries: Vec> = output .packages .iter() .map(|package| InventoryEntry::Detected { package }) .collect(); - for (package, is_optional) in promote_dependencies(&output.packages, &output.dependencies) { + for (package, is_optional) in + promote_dependencies(&output.packages, &output.dependencies, &version_index) + { entries.push(InventoryEntry::Promoted { package: Box::new(package), is_optional, }); } - SbomInventory { entries } + SbomInventory { + entries, + version_index, + } } /// Resolve owner→child dependency edges among inventory members. @@ -128,7 +152,7 @@ pub(crate) fn dependency_edges( let Some(owner_id) = uid_to_id.get(owner_uid).copied() else { continue; }; - let Some(purl) = dependency_edge_purl(dep) else { + let Some(purl) = inventory.resolve_edge_purl(dep) else { continue; }; let Some(child_ids) = purl_to_ids.get(purl.as_str()) else { @@ -156,6 +180,127 @@ pub(crate) fn dependency_edge_purl(dep: &TopLevelDependency) -> Option { .filter(|purl| !purl.is_empty()) } +/// Per-owner version evidence keyed by `(owner package_uid, version-less purl +/// identity)`. The value is the set of distinct versioned purls that owner's +/// dependency edges resolved that identity to. +type VersionIndex = HashMap<(String, String), BTreeSet>; + +/// A purl's version-less identity and whether it carries a version. `None` when +/// the string does not parse as a purl. +/// +/// The identity strips **only** the version: type, namespace, name, +/// qualifiers, and subpath are all preserved (rebuilt through `PackageUrl` so +/// the string is canonical, with qualifiers sorted). Two purls therefore share +/// an identity only when they are the same coordinate at different versions — +/// variants that differ by a qualifier (`?arch=`, `?classifier=`, …) or subpath +/// stay distinct and are never conflated. +fn purl_version_less_identity(purl: &str) -> Option<(String, bool)> { + let parsed = PackageUrl::from_str(purl).ok()?; + let versioned = parsed.version().is_some(); + + let mut identity = PackageUrl::new(parsed.ty().to_string(), parsed.name().to_string()).ok()?; + if let Some(namespace) = parsed.namespace() { + identity.with_namespace(namespace.to_string()).ok()?; + } + for (key, value) in parsed.qualifiers() { + identity + .add_qualifier(key.to_string(), value.to_string()) + .ok()?; + } + if let Some(subpath) = parsed.subpath() { + identity.with_subpath(subpath.to_string()).ok()?; + } + Some((identity.to_string(), versioned)) +} + +/// The concrete owner (`for_package_uid`) of a dependency edge, if any. An +/// absent or empty owner is **not** a shared coalescing bucket: distinct +/// ownerless (e.g. hoisted, or from separate workspaces/datafiles) edges must +/// never pool their versions, so such edges have no sibling-index key at all. +fn concrete_owner(dep: &TopLevelDependency) -> Option<&str> { + dep.for_package_uid + .as_deref() + .filter(|owner| !owner.is_empty()) +} + +/// Build per-owner version evidence from dependency edges only. Each edge with a +/// concrete owner records the versioned purls it carries (its own purl and its +/// resolved package's purl) under `(owner, version-less identity)`. Ownerless +/// edges are excluded so they can never pool versions with each other, and +/// detected packages are excluded because they are not owner-scoped — either +/// could otherwise assign one context's resolved version to another's +/// requirement. +fn build_version_index(dependencies: &[TopLevelDependency]) -> VersionIndex { + let mut index: VersionIndex = HashMap::new(); + for dep in dependencies { + let Some(owner) = concrete_owner(dep) else { + continue; + }; + let purls = [ + dep.purl.as_deref(), + dep.resolved_package + .as_ref() + .and_then(|rp| rp.purl.as_deref()), + ]; + for purl in purls.into_iter().flatten() { + if let Some((identity, true)) = purl_version_less_identity(purl) { + index + .entry((owner.to_string(), identity)) + .or_default() + .insert(purl.to_string()); + } + } + } + index +} + +/// Resolve a dependency edge to the purl its component and graph edges use. +/// +/// An already-versioned edge keeps its purl. An unversioned edge is upgraded +/// only from proof about that same edge — first its own `resolved_package` +/// purl, then a single unambiguous versioned sibling recorded under the **same +/// concrete owner** and identity. When the edge is ownerless, or its owner has +/// zero or several candidate versions for the identity, the edge keeps its +/// unversioned purl (honest-unknown); a version is never borrowed from a +/// different owner or pooled across ownerless contexts. +fn resolve_edge_purl(dep: &TopLevelDependency, version_index: &VersionIndex) -> Option { + let declared = dependency_edge_purl(dep)?; + // A non-empty purl must never be dropped. If it does not parse we cannot + // canonicalize or dedup it, but the coordinate is still real — the native + // output keeps it — so pass it through unchanged rather than erase the + // component and its graph edge (only a genuinely empty purl is absent). + let Some((identity, versioned)) = purl_version_less_identity(&declared) else { + return Some(declared); + }; + if versioned { + return Some(declared); + } + + // The edge's own resolved-package purl is its actual resolution — trust it + // when it is versioned and the same coordinate. + if let Some(resolved_purl) = dep + .resolved_package + .as_ref() + .and_then(|rp| rp.purl.as_deref()) + && let Some((resolved_identity, true)) = purl_version_less_identity(resolved_purl) + && resolved_identity == identity + { + return Some(resolved_purl.to_string()); + } + + // Same-owner sibling evidence, only for a concrete owner and only when + // unambiguous. Ownerless edges never consult the index. + if let Some(owner) = concrete_owner(dep) + && let Some(candidates) = version_index.get(&(owner.to_string(), identity)) + && candidates.len() == 1 + && let Some(only) = candidates.iter().next() + { + return Some(only.clone()); + } + + Some(declared) +} + /// Promote resolved dependencies, deduped by purl. /// /// A dependency whose purl a detected package already owns is skipped (the @@ -167,6 +312,7 @@ pub(crate) fn dependency_edge_purl(dep: &TopLevelDependency) -> Option { fn promote_dependencies( packages: &[OutputPackage], dependencies: &[TopLevelDependency], + version_index: &VersionIndex, ) -> Vec<(OutputPackage, Option)> { let existing_purls: HashSet<&str> = packages .iter() @@ -177,7 +323,10 @@ fn promote_dependencies( let mut promoted: Vec<(OutputPackage, Option)> = Vec::new(); for dep in dependencies { - let Some(purl) = dependency_edge_purl(dep) else { + // Upgrade an unversioned requirement edge to its resolved coordinate so + // it dedups against the detected package or lockfile-resolved component + // for the same dependency instead of becoming a second, unversioned one. + let Some(purl) = resolve_edge_purl(dep, version_index) else { continue; }; if existing_purls.contains(purl.as_str()) { @@ -507,6 +656,30 @@ mod tests { }) } + fn dependency_owned( + purl: Option<&str>, + resolved: Option, + uid: &str, + owner: &str, + ) -> TopLevelDependency { + TopLevelDependency::from(&crate::models::TopLevelDependency { + purl: purl.map(str::to_string), + extracted_requirement: None, + scope: None, + is_runtime: None, + is_optional: Some(false), + is_pinned: None, + is_direct: None, + resolved_package: resolved.map(Box::new), + extra_data: None, + dependency_uid: crate::models::DependencyUid::from_raw(uid.to_string()), + for_package_uid: Some(crate::models::PackageUid::from_raw(owner.to_string())), + datafile_path: "package-lock.json".to_string(), + datasource_id: DatasourceId::NpmPackageLockJson, + namespace: None, + }) + } + fn promoted_optional(entries: &[InventoryEntry<'_>]) -> Option { match entries.iter().find(|e| e.is_promoted()) { Some(InventoryEntry::Promoted { is_optional, .. }) => *is_optional, @@ -776,4 +949,320 @@ mod tests { "an edge whose target is not in inventory must not be emitted" ); } + + fn output_with(packages: Vec, deps: Vec) -> Output { + Output { + summary: None, + tallies: None, + tallies_of_key_files: None, + tallies_by_facet: None, + headers: vec![], + packages, + dependencies: deps, + license_detections: vec![], + files: vec![], + license_references: vec![], + license_rule_references: vec![], + } + } + + fn licensed_detected_package(purl: &str, spdx: &str) -> OutputPackage { + let tail = purl.rsplit('/').next().unwrap_or("pkg"); + let (name, version) = tail + .split_once('@') + .map(|(n, v)| (n.to_string(), Some(v.to_string()))) + .unwrap_or_else(|| (tail.to_string(), None)); + OutputPackage::from(&crate::models::Package::from_package_data( + &PackageData { + package_type: Some(PackageType::Npm), + name: Some(name), + version, + purl: Some(purl.to_string()), + declared_license_expression: Some(spdx.to_lowercase()), + declared_license_expression_spdx: Some(spdx.to_string()), + ..Default::default() + }, + "package.json".to_string(), + )) + } + + // Vendored join (issue #1320): with `node_modules//package.json` on + // disk the dependency is a detected, licensed package at its versioned purl. + // The manifest yields an unversioned requirement edge and the lockfile a + // versioned resolution — both under the same owner. The unversioned edge + // resolves onto the detected package, leaving ONE licensed, versioned + // component — never a second bare `pkg:npm/leftpad`. + #[test] + fn unversioned_requirement_merges_into_vendored_detected_package() { + let packages = vec![licensed_detected_package("pkg:npm/leftpad@1.0.0", "MIT")]; + let deps = vec![ + dependency_owned(Some("pkg:npm/leftpad"), None, "req", "owner-1"), + dependency_owned(Some("pkg:npm/leftpad@1.0.0"), None, "lock", "owner-1"), + ]; + let output = output_with(packages, deps); + let inventory = build_inventory(&output); + + assert_eq!( + inventory.entries.len(), + 1, + "must not add a second component" + ); + assert!(!inventory.entries[0].is_promoted()); + let package = inventory.entries[0].package(); + assert_eq!(package.purl.as_deref(), Some("pkg:npm/leftpad@1.0.0")); + assert_eq!( + package.declared_license_expression_spdx.as_deref(), + Some("MIT") + ); + } + + // P1 (cross-owner): two packages can resolve the same requirement to + // different versions. An unversioned edge must take its version only from + // its own owner's resolution — never from another owner's. + #[test] + fn unversioned_requirement_never_inherits_version_across_owners() { + let deps = vec![ + // owner A: requirement + its own resolution to 1.0.0 + dependency_owned(Some("pkg:npm/lib"), None, "a-req", "owner-a"), + dependency_owned(Some("pkg:npm/lib@1.0.0"), None, "a-lock", "owner-a"), + // owner B: requirement + its own resolution to 2.0.0 + dependency_owned(Some("pkg:npm/lib"), None, "b-req", "owner-b"), + dependency_owned(Some("pkg:npm/lib@2.0.0"), None, "b-lock", "owner-b"), + ]; + let index = build_version_index(&deps); + // Each owner's unversioned requirement resolves to that owner's version. + assert_eq!( + resolve_edge_purl(&deps[0], &index).as_deref(), + Some("pkg:npm/lib@1.0.0"), + "owner A keeps its own 1.0.0" + ); + assert_eq!( + resolve_edge_purl(&deps[2], &index).as_deref(), + Some("pkg:npm/lib@2.0.0"), + "owner B keeps its own 2.0.0 — no cross-owner assignment" + ); + + // Both versioned components still exist and the graph stays closed. + let output = output_with(vec![], deps); + let inventory = build_inventory(&output); + let purls: BTreeSet<&str> = inventory + .packages() + .filter_map(|pkg| pkg.purl.as_deref()) + .collect(); + assert_eq!( + purls, + BTreeSet::from(["pkg:npm/lib@1.0.0", "pkg:npm/lib@2.0.0"]) + ); + let ids: Vec = (0..inventory.entries.len()) + .map(|i| format!("id-{i}")) + .collect(); + let edges = dependency_edges(&inventory, &output.dependencies, &ids); + for children in edges.values() { + for child in children { + assert!( + ids.contains(child), + "every edge resolves within the document" + ); + } + } + } + + // P1 (qualifiers/subpath): purls that differ only by a qualifier or subpath + // are DIFFERENT coordinates. An unversioned edge for one must not be rewritten + // to a versioned sibling that carries a different qualifier/subpath. + #[test] + fn qualifier_and_subpath_variants_are_not_conflated() { + let deps = vec![ + // A versioned candidate that carries a qualifier. + dependency_owned( + Some("pkg:maven/g/a@1.0.0?classifier=sources"), + None, + "v", + "owner-1", + ), + // An unversioned requirement WITHOUT that qualifier — different identity. + dependency_owned(Some("pkg:maven/g/a"), None, "req", "owner-1"), + ]; + let index = build_version_index(&deps); + assert_eq!( + resolve_edge_purl(&deps[1], &index).as_deref(), + Some("pkg:maven/g/a"), + "a qualifier-bearing sibling must not version a bare requirement" + ); + + // And a subpath variant is likewise its own identity. + let subpath_deps = vec![ + dependency_owned(Some("pkg:golang/ex.com/m@1.0.0#sub"), None, "v", "owner-1"), + dependency_owned(Some("pkg:golang/ex.com/m"), None, "req", "owner-1"), + ]; + let subpath_index = build_version_index(&subpath_deps); + assert_eq!( + resolve_edge_purl(&subpath_deps[1], &subpath_index).as_deref(), + Some("pkg:golang/ex.com/m"), + "a subpath-bearing sibling must not version a bare requirement" + ); + } + + // P1 (ownerless): an absent owner is not a shared coalescing bucket. Two + // ownerless dependencies from different contexts (e.g. separate workspaces + // or datafiles) must not pool versions — a bare ownerless requirement stays + // unversioned rather than borrow an unrelated ownerless sibling's version. + #[test] + fn ownerless_requirement_does_not_borrow_sibling_version() { + let deps = vec![ + // A versioned ownerless dependency from one context. + dependency(Some("pkg:npm/lib@1.0.0"), Some(false), None, "ctx-a"), + // A bare ownerless requirement from an unrelated context. + dependency(Some("pkg:npm/lib"), Some(false), None, "ctx-b"), + ]; + let index = build_version_index(&deps); + assert_eq!( + resolve_edge_purl(&deps[1], &index).as_deref(), + Some("pkg:npm/lib"), + "an ownerless requirement must not borrow an unrelated ownerless version" + ); + + let output = output_with(vec![], deps); + let inventory = build_inventory(&output); + let purls: BTreeSet<&str> = inventory + .packages() + .filter_map(|pkg| pkg.purl.as_deref()) + .collect(); + assert_eq!( + purls, + BTreeSet::from(["pkg:npm/lib", "pkg:npm/lib@1.0.0"]), + "both components present; the bare requirement stays unversioned" + ); + let ids: Vec = (0..inventory.entries.len()) + .map(|i| format!("id-{i}")) + .collect(); + let edges = dependency_edges(&inventory, &output.dependencies, &ids); + for children in edges.values() { + for child in children { + assert!( + ids.contains(child), + "every edge resolves within the document" + ); + } + } + } + + // P1 (unparseable purl): a non-empty purl the `PackageUrl` parser rejects + // must never erase the dependency. The component keeps its original + // coordinate and its owner→dep edge, so both CycloneDX and SPDX still emit + // it and the graph stays closed. Only a genuinely empty purl may be absent. + #[test] + fn unparseable_purl_is_retained_as_component_and_edge() { + let malformed = "not-a-purl"; + assert!( + PackageUrl::from_str(malformed).is_err(), + "test requires a genuinely unparseable purl" + ); + + let mut owner = detected_package("pkg:npm/app@1.0.0"); + owner.package_uid = "owner-1".to_string(); + let dep = dependency_owned(Some(malformed), None, "d1", "owner-1"); + let output = output_with(vec![owner], vec![dep]); + let inventory = build_inventory(&output); + + let promoted: Vec<&str> = inventory + .entries + .iter() + .filter(|entry| entry.is_promoted()) + .filter_map(|entry| entry.package().purl.as_deref()) + .collect(); + assert_eq!( + promoted, + vec![malformed], + "an unparseable but non-empty purl is retained as a component" + ); + + // bom-ref/id per entry: purl when present, else package_uid — the same + // scheme the renderers use, so the edge ref must equal the retained purl. + let ids: Vec = inventory + .packages() + .map(|pkg| pkg.purl.clone().unwrap_or_else(|| pkg.package_uid.clone())) + .collect(); + let owner_id = &ids[0]; + let edges = dependency_edges(&inventory, &output.dependencies, &ids); + assert!( + edges + .get(owner_id) + .is_some_and(|children| children.contains(malformed)), + "the owner→dep edge to the unparseable coordinate is retained" + ); + for children in edges.values() { + for child in children { + assert!( + ids.contains(child), + "every edge resolves within the document (graph closed)" + ); + } + } + } + + // Versioned-purl gap (issue #1320): the resolved version lives only on a + // sibling lockfile edge. An unversioned requirement edge with no detected + // package must still be promoted at the resolved coordinate and pick up the + // license the sibling's resolved package carries. + #[test] + fn unversioned_requirement_coalesces_to_versioned_sibling_edge() { + let mut resolved = ResolvedPackage::new( + PackageType::Npm, + String::new(), + "left-pad".to_string(), + "1.3.0".to_string(), + ); + resolved.purl = Some("pkg:npm/left-pad@1.3.0".to_string()); + resolved.declared_license_expression_spdx = Some("MIT".to_string()); + + let deps = vec![ + dependency_owned(Some("pkg:npm/left-pad"), None, "req", "owner-1"), + dependency_owned( + Some("pkg:npm/left-pad@1.3.0"), + Some(resolved), + "lock", + "owner-1", + ), + ]; + let output = output_with(vec![], deps); + let inventory = build_inventory(&output); + + assert_eq!(inventory.entries.len(), 1, "the two edges collapse to one"); + let package = inventory.entries[0].package(); + assert_eq!(package.purl.as_deref(), Some("pkg:npm/left-pad@1.3.0")); + assert_eq!(package.version.as_deref(), Some("1.3.0")); + assert_eq!( + package.declared_license_expression_spdx.as_deref(), + Some("MIT") + ); + } + + // Honest-unknowns: when one owner's requirement could match more than one + // resolved version, Provenant must not guess. The edge keeps its unversioned + // purl and each resolved version remains its own component. + #[test] + fn ambiguous_versions_leave_unversioned_requirement_unresolved() { + let deps = vec![ + dependency_owned(Some("pkg:npm/multi"), None, "req", "owner-1"), + dependency_owned(Some("pkg:npm/multi@1.0.0"), None, "v1", "owner-1"), + dependency_owned(Some("pkg:npm/multi@2.0.0"), None, "v2", "owner-1"), + ]; + let output = output_with(vec![], deps); + let inventory = build_inventory(&output); + + let purls: BTreeSet<&str> = inventory + .packages() + .filter_map(|pkg| pkg.purl.as_deref()) + .collect(); + assert_eq!( + purls, + BTreeSet::from([ + "pkg:npm/multi", + "pkg:npm/multi@1.0.0", + "pkg:npm/multi@2.0.0", + ]), + "an ambiguous unversioned requirement stays unversioned" + ); + } } diff --git a/src/output/spdx.rs b/src/output/spdx.rs index 043b69044..ecb2f704f 100644 --- a/src/output/spdx.rs +++ b/src/output/spdx.rs @@ -222,6 +222,9 @@ fn write_spdx_tag_value_package( writeln!(writer, "## Package Information")?; writeln!(writer, "PackageName: {}", plan.name)?; writeln!(writer, "SPDXID: {}", plan.spdx_id)?; + if let Some(version) = spdx_package_version(plan.package) { + writeln!(writer, "PackageVersion: {version}")?; + } writeln!(writer, "PackageDownloadLocation: NOASSERTION")?; writeln!(writer, "FilesAnalyzed: {}", plan.role.files_analyzed())?; // SPDX 2.2: a package verification code and per-file license info are @@ -262,9 +265,30 @@ fn write_spdx_tag_value_package( "PackageCopyrightText: {}", format_spdx_text_field(&package_copyright_text) )?; + // The purl is the join key for downstream license enrichment; emit it as a + // package-manager ExternalRef (ADR 0012, issue #1320). + if let Some(purl) = spdx_package_purl(plan.package) { + writeln!(writer, "ExternalRef: PACKAGE-MANAGER purl {purl}")?; + } Ok(()) } +/// The package version for an SPDX package, when the inventory package carries a +/// non-empty one. Promoted-dependency packages carry the resolved version from +/// their versioned purl (issue #1320). +fn spdx_package_version(package: Option<&OutputPackage>) -> Option<&str> { + package + .and_then(|package| package.version.as_deref()) + .filter(|version| !version.is_empty()) +} + +/// The package purl for an SPDX package, when present and non-empty. +fn spdx_package_purl(package: Option<&OutputPackage>) -> Option<&str> { + package + .and_then(|package| package.purl.as_deref()) + .filter(|purl| !purl.is_empty()) +} + pub(crate) fn write_spdx_rdf_xml( output: &Output, writer: &mut dyn Write, @@ -450,6 +474,24 @@ pub(crate) fn write_spdx_rdf_xml( xml.push_str(" "); xml.push_str(&package_name); xml.push_str("\n"); + if let Some(version) = spdx_package_version(plan.package) { + xml.push_str(" "); + xml.push_str(&xml_escape(version)); + xml.push_str("\n"); + } + // Purl as a package-manager ExternalRef — the downstream join key + // (ADR 0012, issue #1320). + if let Some(purl) = spdx_package_purl(plan.package) { + xml.push_str(" "); + xml.push_str(""); + xml.push_str( + "", + ); + xml.push_str(""); + xml.push_str(&xml_escape(purl)); + xml.push_str(""); + xml.push_str("\n"); + } xml.push_str(" \n"); } diff --git a/testdata/output-formats/cyclonedx-dependencies-expected.json b/testdata/output-formats/cyclonedx-dependencies-expected.json index 9669e475e..fc3bc9b55 100644 --- a/testdata/output-formats/cyclonedx-dependencies-expected.json +++ b/testdata/output-formats/cyclonedx-dependencies-expected.json @@ -1,14 +1,14 @@ { "bomFormat": "CycloneDX", "specVersion": "1.3", - "serialNumber": "urn:uuid:ce548f93-c5aa-499a-834c-a0233495928f", + "serialNumber": "urn:uuid:4504b45a-f05a-47e3-81c8-5080f4eecd2b", "version": 1, "metadata": { - "timestamp": "2023-03-31T10:36:22Z", + "timestamp": "2026-01-01T00:00:01Z", "tools": [ { "name": "Provenant", - "version": "0.0.5" + "version": "1.0.1" } ], "component": { @@ -42,6 +42,19 @@ "version": "2.0.0", "scope": "required", "purl": "pkg:npm/dep@2.0.0" + }, + { + "type": "library", + "bom-ref": "pkg:npm/left-pad@1.3.0", + "name": "left-pad", + "version": "1.3.0", + "scope": "required", + "purl": "pkg:npm/left-pad@1.3.0", + "licenses": [ + { + "expression": "MIT" + } + ] } ], "dependencies": [ @@ -49,13 +62,17 @@ "ref": "pkg:npm/dep@2.0.0", "dependsOn": [] }, + { + "ref": "pkg:npm/left-pad@1.3.0", + "dependsOn": [] + }, { "ref": "pkg:npm/other@1.0.0", "dependsOn": ["pkg:npm/dep@2.0.0"] }, { "ref": "pkg:npm/root@1.0.0", - "dependsOn": ["pkg:npm/dep@2.0.0"] + "dependsOn": ["pkg:npm/dep@2.0.0", "pkg:npm/left-pad@1.3.0"] } ] } diff --git a/testdata/output-formats/cyclonedx-dependencies-expected.xml b/testdata/output-formats/cyclonedx-dependencies-expected.xml index 2a01a4b4c..43be6f1d6 100644 --- a/testdata/output-formats/cyclonedx-dependencies-expected.xml +++ b/testdata/output-formats/cyclonedx-dependencies-expected.xml @@ -1,13 +1,9 @@ - + - 2023-03-31T10:36:22Z + 2026-01-01T00:00:01Z - - Provenant - Provenant - 0.0.5 - + ProvenantProvenant1.0.1 root @@ -34,15 +30,25 @@ required pkg:npm/dep@2.0.0 + + left-pad + 1.3.0 + required + MIT + pkg:npm/left-pad@1.3.0 + + + + diff --git a/testdata/output-formats/spdx-dependencies-expected.tv b/testdata/output-formats/spdx-dependencies-expected.tv index 6d93fe1b4..dfe2f0ef3 100644 --- a/testdata/output-formats/spdx-dependencies-expected.tv +++ b/testdata/output-formats/spdx-dependencies-expected.tv @@ -12,11 +12,12 @@ Provenant is a free software code scanning tool. Visit https://github.com/getprovenant/provenant/ for support and download. SPDX License List: 3.27 ## Creation Information -Creator: Tool: Provenant-1.0.1-g934b1ca7-dirty +Creator: Tool: Provenant-1.0.1 Created: 2026-01-01T00:00:00Z ## Package Information PackageName: root SPDXID: SPDXRef-Package-1 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 2a4976b2c9ac8e1fc0747dba6f0c5588b1318680 @@ -24,6 +25,7 @@ PackageLicenseConcluded: MIT PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: MIT PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/root@1.0.0 ## File Information FileName: ./index.js SPDXID: SPDXRef-1 @@ -42,13 +44,26 @@ FileCopyrightText: NONE ## Package Information PackageName: dep SPDXID: SPDXRef-Package-Dependency-1 +PackageVersion: 2.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: false PackageLicenseConcluded: NOASSERTION PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/dep@2.0.0 +## Package Information +PackageName: left-pad +SPDXID: SPDXRef-Package-Dependency-2 +PackageVersion: 1.3.0 +PackageDownloadLocation: NOASSERTION +FilesAnalyzed: false +PackageLicenseConcluded: MIT +PackageLicenseDeclared: MIT +PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/left-pad@1.3.0 ## Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-1 Relationship: SPDXRef-Package-1 CONTAINS SPDXRef-2 Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-1 +Relationship: SPDXRef-Package-1 DEPENDS_ON SPDXRef-Package-Dependency-2 diff --git a/testdata/output-formats/spdx-licensed-expected.tv b/testdata/output-formats/spdx-licensed-expected.tv index 79bb60ee3..01b514f3c 100644 --- a/testdata/output-formats/spdx-licensed-expected.tv +++ b/testdata/output-formats/spdx-licensed-expected.tv @@ -17,6 +17,7 @@ Created: 2026-01-01T00:00:00Z ## Package Information PackageName: widget-mit SPDXID: SPDXRef-Package-1 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 0a05a9e69e5757ac71c75a50418622624f042c97 @@ -24,9 +25,11 @@ PackageLicenseConcluded: MIT PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: MIT PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/widget-mit@1.0.0 ## Package Information PackageName: widget-other SPDXID: SPDXRef-Package-2 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 4ef6c88cdec9dbcc9bd8b7fa0fdfe4cc43bfed4f @@ -34,6 +37,7 @@ PackageLicenseConcluded: Apache-2.0 PackageLicenseInfoFromFiles: NONE PackageLicenseDeclared: NOASSERTION PackageCopyrightText: NONE +ExternalRef: PACKAGE-MANAGER purl pkg:npm/widget-other@1.0.0 ## File Information FileName: ./widget-mit/package.json SPDXID: SPDXRef-1 diff --git a/testdata/output-formats/spdx-multi-package-expected.tv b/testdata/output-formats/spdx-multi-package-expected.tv index 7d46e7cb0..36eeac17e 100644 --- a/testdata/output-formats/spdx-multi-package-expected.tv +++ b/testdata/output-formats/spdx-multi-package-expected.tv @@ -17,6 +17,7 @@ Created: 2026-01-01T00:00:00Z ## Package Information PackageName: widget-a SPDXID: SPDXRef-Package-1 +PackageVersion: 1.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: c361e706434ebcd03e8857c6c8dd2786adaeb3ef @@ -24,9 +25,11 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: MIT PackageLicenseDeclared: NOASSERTION PackageCopyrightText: Copyright 2024 Widget A Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:npm/widget-a@1.0.0 ## Package Information PackageName: widget-b SPDXID: SPDXRef-Package-2 +PackageVersion: 2.0.0 PackageDownloadLocation: NOASSERTION FilesAnalyzed: true PackageVerificationCode: 8fe04df3f4570c5b3840493e6159d69afa80ed7d @@ -34,6 +37,7 @@ PackageLicenseConcluded: NOASSERTION PackageLicenseInfoFromFiles: Apache-2.0 PackageLicenseDeclared: NOASSERTION PackageCopyrightText: Copyright 2024 Widget B Contributors +ExternalRef: PACKAGE-MANAGER purl pkg:npm/widget-b@2.0.0 ## Package Information PackageName: workspace SPDXID: SPDXRef-Package-unassigned diff --git a/tests/output_format_golden.rs b/tests/output_format_golden.rs index 239109a34..b474028c4 100644 --- a/tests/output_format_golden.rs +++ b/tests/output_format_golden.rs @@ -2477,11 +2477,63 @@ fn sample_cyclonedx_dependency_output() -> Output { namespace: None, }; + // Versioned-purl + vendored-license join (issue #1320): the manifest declares + // an *unversioned* requirement while the lockfile resolves the same + // dependency to a version and carries its license. The two must collapse into + // one licensed, versioned component (`pkg:npm/left-pad@1.3.0` / MIT), not a + // bare `pkg:npm/left-pad` plus a separate versioned one. + let leftpad_requirement = TopLevelDependency { + purl: Some("pkg:npm/left-pad".to_string()), + extracted_requirement: Some("^1.3.0".to_string()), + scope: Some("dependencies".to_string()), + is_runtime: Some(true), + is_optional: Some(false), + is_pinned: Some(false), + is_direct: Some(true), + resolved_package: None, + extra_data: None, + dependency_uid: DependencyUid::from_raw( + "pkg:npm/left-pad?uuid=00000000-0000-0000-0000-000000000003".to_string(), + ), + for_package_uid: Some(root_uid.clone()), + datafile_path: "scan/package.json".to_string(), + datasource_id: DatasourceId::NpmPackageJson, + namespace: None, + }; + let leftpad_resolved = TopLevelDependency { + purl: Some("pkg:npm/left-pad@1.3.0".to_string()), + extracted_requirement: Some("1.3.0".to_string()), + scope: Some("dependencies".to_string()), + is_runtime: Some(true), + is_optional: Some(false), + is_pinned: Some(true), + is_direct: Some(false), + resolved_package: Some(Box::new(ResolvedPackage { + purl: Some("pkg:npm/left-pad@1.3.0".to_string()), + declared_license_expression: Some("mit".to_string()), + declared_license_expression_spdx: Some("MIT".to_string()), + ..ResolvedPackage::new( + PackageType::Npm, + String::new(), + "left-pad".to_string(), + "1.3.0".to_string(), + ) + })), + extra_data: None, + dependency_uid: DependencyUid::from_raw( + "pkg:npm/left-pad@1.3.0?uuid=00000000-0000-0000-0000-000000000004".to_string(), + ), + for_package_uid: Some(root_uid), + datafile_path: "scan/package-lock.json".to_string(), + datasource_id: DatasourceId::NpmPackageLockJson, + namespace: None, + }; + sample_output_with_sections( 0, 0, vec![root_pkg, other_pkg], - vec![owned_dep, shared_dep], + vec![owned_dep, shared_dep, leftpad_requirement, leftpad_resolved], vec![], ) } @@ -2537,6 +2589,57 @@ fn sample_spdx_dependency_output() -> Output { namespace: None, }; + // Versioned-purl + vendored-license join (issue #1320): an unversioned + // manifest requirement and the lockfile's versioned, licensed resolution of + // the same dependency collapse to one `pkg:npm/left-pad@1.3.0` package + // carrying MIT. + let leftpad_requirement = TopLevelDependency { + purl: Some("pkg:npm/left-pad".to_string()), + extracted_requirement: Some("^1.3.0".to_string()), + scope: Some("dependencies".to_string()), + is_runtime: Some(true), + is_optional: Some(false), + is_pinned: Some(false), + is_direct: Some(true), + resolved_package: None, + extra_data: None, + dependency_uid: DependencyUid::from_raw( + "pkg:npm/left-pad?uuid=00000000-0000-0000-0000-000000000003".to_string(), + ), + for_package_uid: Some(root_uid.clone()), + datafile_path: "scan/package.json".to_string(), + datasource_id: DatasourceId::NpmPackageJson, + namespace: None, + }; + let leftpad_resolved = TopLevelDependency { + purl: Some("pkg:npm/left-pad@1.3.0".to_string()), + extracted_requirement: Some("1.3.0".to_string()), + scope: Some("dependencies".to_string()), + is_runtime: Some(true), + is_optional: Some(false), + is_pinned: Some(true), + is_direct: Some(false), + resolved_package: Some(Box::new(ResolvedPackage { + purl: Some("pkg:npm/left-pad@1.3.0".to_string()), + declared_license_expression: Some("mit".to_string()), + declared_license_expression_spdx: Some("MIT".to_string()), + ..ResolvedPackage::new( + PackageType::Npm, + String::new(), + "left-pad".to_string(), + "1.3.0".to_string(), + ) + })), + extra_data: None, + dependency_uid: DependencyUid::from_raw( + "pkg:npm/left-pad@1.3.0?uuid=00000000-0000-0000-0000-000000000004".to_string(), + ), + for_package_uid: Some(root_uid.clone()), + datafile_path: "scan/package-lock.json".to_string(), + datasource_id: DatasourceId::NpmPackageLockJson, + namespace: None, + }; + let mut manifest = sample_plain_text_file( "package.json", "package", @@ -2562,7 +2665,7 @@ fn sample_spdx_dependency_output() -> Output { 2, 0, vec![root_pkg], - vec![owned_dep], + vec![owned_dep, leftpad_requirement, leftpad_resolved], vec![manifest, source], ) } @@ -2613,7 +2716,10 @@ fn test_spdx_tag_value_emits_promoted_dependency_packages_after_file_section() { let expected = fs::read_to_string("testdata/output-formats/spdx-dependencies-expected.tv") .expect("spdx dependency fixture should be readable"); - assert_eq!(actual, expected); + // Normalize away the build-specific Creator/Created lines like every other + // SPDX tag-value golden; the ordering assertions above already cover the + // section layout this fixture is here to protect. + assert_eq!(normalize_spdx_tv(&actual), normalize_spdx_tv(&expected)); } fn empty_output() -> Output {