feat(cyclonedx): emit CycloneDX 1.7 with license acknowledgement and evidence

[mstykow]

Summary

• Bump the CycloneDX renderer from spec 1.3 to 1.7.
• Populate licenses[].acknowledgement (declared vs concluded) — the declared-vs-concluded distinction Provenant already expresses in SPDX (PackageLicenseDeclared / PackageLicenseConcluded), mapped from the same package fields. A parser-declared expression is declared; a license concluded from source/file detection is concluded.
• Populate component.evidence — the file-content license detections of the files each component owns become evidence.licenses (distinct observed SPDX expressions) + evidence.occurrences (file + line), using the file.for_packages ownership assembly already computes. Only detected packages own scanned files, so promoted resolved dependencies carry no evidence.
• CycloneDX renderer only: JSON specVersion/$schema and the XML bom namespace move to 1.7. SPDX and the native ScanCode-compatible JSON are byte-unchanged.

Issues

• Closes: SBOM: emit CycloneDX 1.7 with license acknowledgement (declared/concluded) + evidence #1328

Scope and exclusions

• Included: spec-version bump (JSON specVersion + $schema, XML namespace), licenses[].acknowledgement, component.evidence (licenses + occurrences), validator switch to SchemaVersion.V1_7, regenerated CycloneDX goldens + a dedicated evidence golden + the four examples/sbom, ADR 0012 amendment.
• Explicit exclusions: 1.7 crypto/CBOM/formulation additions (not Provenant's use case); SPDX and native ScanCode-compatible JSON (unchanged).

How to verify

• Beyond CI: set up a venv from scripts/requirements-output-format-validators.txt, then run python scripts/validate_output_format_fixtures.py (with the venv bin on PATH so pyspdxtools resolves). All CycloneDX goldens — including the new cyclonedx-evidence-expected.{json,xml} — validate against the official 1.7 JSON schema + XSD, and SPDX tag-value still validates. The four examples/sbom/*/sbom.cdx.json (now carrying evidence) also validate against 1.7 and their sbom.spdx against pyspdxtools.

Intentional differences from Python

• N/A — this is CycloneDX spec-conformance work, not a ScanCode-parity surface.

Follow-up work

• None. Component license evidence, originally floated as a possible split, landed here.

Expected-output fixture changes

• Files changed: testdata/output-formats/cyclonedx-expected.{json,xml}, cyclonedx-dependencies-expected.{json,xml}, cyclonedx-expected-without-packages.json; new cyclonedx-evidence-expected.{json,xml}; regenerated examples/sbom/*/sbom.cdx.json (and sbom.spdx re-stamped, version/timestamp-only).
• Why the new expected output is correct: the CycloneDX fixtures gain $schema, specVersion: 1.7 / the 1.7 XML namespace, acknowledgement on each license, and (for components that own detected files) evidence; all validate clean against the official CycloneDX 1.7 schema + XSD. The examples/sbom sbom.spdx files differ only in the Creator/Created version+timestamp lines, confirming SPDX output is substantively unchanged. Examples are stamped for the upcoming release (the version that first ships this output), per the generator's convention.

Before / after — component license

// before (1.3)
"licenses": [{ "expression": "MIT" }]

// after (1.7): acknowledgement + source-observed evidence
"licenses": [{ "expression": "MIT", "acknowledgement": "declared" }],
"evidence": {
  "occurrences": [
    { "location": "scan/LICENSE", "line": 1 },
    { "location": "scan/src/main.js", "line": 5 }
  ],
  "licenses": [{ "expression": "Apache-2.0" }, { "expression": "MIT" }]
}

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

Updates CycloneDX output to version 1.7.

• Adds declared/concluded license acknowledgement metadata and component-level license evidence.
• Updates JSON schema identifiers, XML namespaces, validation tooling, tests, fixtures, examples, and ADR documentation.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failures remain.

Important Files Changed

Filename	Overview
src/output/cyclonedx.rs	Upgrades CycloneDX serialization to 1.7 and adds license acknowledgement and component evidence generation.
scripts/validate_output_format_fixtures.py	Switches fixture validation to CycloneDX 1.7 and includes the new evidence fixtures.
tests/output_format_golden.rs	Extends golden coverage for the revised CycloneDX output and license evidence.
docs/adr/0012-sbom-resolved-dependency-components.md	Documents the CycloneDX license acknowledgement and evidence behavior.

_{Reviews (2): Last reviewed commit: "feat(cyclonedx): add component license e..." | Re-trigger Greptile}