mikronova/modgunn

sbom — guide

Class: guide · audience: someone emitting a CycloneDX SBOM. The what is in sbom-design.md.

f0 — emit a CycloneDX 1.5 document

use modgunn::sbom::{to_cyclonedx, SbomComponent, SbomInput, SbomVuln};

let input = SbomInput {
    subject: "my-app".into(),
    components: vec![
        SbomComponent { ecosystem: "cargo".into(), name: "serde".into(),
                        version: "1.0.0".into(), license: Some("MIT".into()) },
    ],
    vulns: vec![
        SbomVuln { ecosystem: "cargo".into(), name: "some-crate".into(), version: "1.2.3".into(),
                   ids: vec!["RUSTSEC-2024-0001".into()], summary: "use-after-free".into() },
    ],
};

let doc = to_cyclonedx(&input);                 // serde_json::Value (CycloneDX 1.5)
println!("{}", serde_json::to_string_pretty(&doc)?);

f1 — build a purl directly

let p = modgunn::sbom::purl("cargo", "serde", "1.0.0");   // "pkg:cargo/serde@1.0.0"

Gotchas

• This is the emit side only; to read the resolved component set for a repo use Warehouse::read_sbom_components (see warehouse-guide.md).
• Output is byte-compatible with nornir's prior cargo SBOM — nornir's to_cyclonedx delegates here, so keep the field shapes stable.