licence_audit/sbom

Types

EmbeddedVulnerability

An OSV advisory paired with the component bom-refs (purls) it affects, ready to be emitted into the CycloneDX vulnerabilities array. An empty list of these on SbomInput omits the array entirely.

pub type EmbeddedVulnerability {
  EmbeddedVulnerability(
    vuln: osv.Vulnerability,
    affects: List(String),
  )
}

Constructors

EmbeddedVulnerability(
  vuln: osv.Vulnerability,
  affects: List(String),
)

LicenseEntry

</>

pub type LicenseEntry {
  LicenseId(id: String)
  LicenseName(name: String)
  LicenseExpression(expression: String)
}

Constructors

```
LicenseId(id: String)
```
```
LicenseName(name: String)
```
```
LicenseExpression(expression: String)
```

RootComponent

</>

pub type RootComponent {
  RootComponent(
    name: String,
    version: String,
    description: option.Option(String),
    licences: List(String),
    repository: option.Option(String),
  )
}

Constructors

```
RootComponent(
  name: String,
  version: String,
  description: option.Option(String),
  licences: List(String),
  repository: option.Option(String),
)
```
Arguments

description

Project summary from the root gleam.toml description, if any.

licences

Declared licences from the root gleam.toml licences array.

repository

Project source URL (e.g. derived from a repository github table).

SbomInput

</>

pub type SbomInput {
  SbomInput(
    manifest: manifest.SbomManifest,
    root: RootComponent,
    tool_version: String,
    serial_number: SerialNumber,
    timestamp: String,
    package_metadata: dict.Dict(String, hex.PackageMetadata),
    scopes: dict.Dict(String, manifest.Scope),
    vulnerabilities: List(EmbeddedVulnerability),
    license_texts: dict.Dict(String, String),
  )
}

Constructors

SbomInput(
  manifest: manifest.SbomManifest,
  root: RootComponent,
  tool_version: String,
  serial_number: SerialNumber,
  timestamp: String,
  package_metadata: dict.Dict(String, hex.PackageMetadata),
  scopes: dict.Dict(String, manifest.Scope),
  vulnerabilities: List(EmbeddedVulnerability),
  license_texts: dict.Dict(String, String),
)

Arguments

vulnerabilities: Vulnerabilities to embed (CycloneDX vulnerabilities); empty omits it.
license_texts: Canonical SPDX text by licence ID; empty preserves the default output.

SerialNumber

</>

How the BOM serialNumber is produced.

pub type SerialNumber {
  FixedSerial(String)
  ContentDerivedSerial
}

Constructors

```
FixedSerial(String)
```
Use this exact urn:uuid string (a random v4 in normal runs).
```
ContentDerivedSerial
```
Derive a deterministic urn:uuid from a hash of the BOM content, so the same content and timestamp always yield the same serial number.

Values

license_entries

</>

pub fn license_entries(
  licences: List(String),
) -> List(LicenseEntry)

Map a single compound SPDX declaration to an expression choice. Otherwise emit one licence entry per declaration. Multiple declarations remain separate: Hex does not record whether the relationship is conjunctive (“AND”) or disjunctive (“OR”), so we do not synthesise an SPDX expression that would assert an operator we cannot verify.

purl_for

</>

pub fn purl_for(
  entry: manifest.SbomEntry,
) -> Result(String, error.Error)

try_render

</>

pub fn try_render(
  input: SbomInput,
) -> Result(String, error.Error)

Returns the rendered JSON, or an Error if any entry has an unsupported source for purl generation.