uv-sbom 2.3.0

SBOM generation tool for uv projects - Generate CycloneDX SBOMs from uv.lock files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

use super::super::component_view::ComponentView;
use super::super::dependency_view::DependencyView;
use crate::sbom_generation::domain::DependencyGraph;
use std::collections::HashMap;

pub(super) fn build_dependencies(
    graph: &DependencyGraph,
    components: &[ComponentView],
) -> DependencyView {
    // Create a lookup map from package name to bom-ref
    let name_to_bom_ref: HashMap<&str, &str> = components
        .iter()
        .map(|c| (c.name.as_str(), c.bom_ref.as_str()))
        .collect();

    // Map direct dependencies to bom-refs
    let direct: Vec<String> = graph
        .direct_dependencies()
        .iter()
        .filter_map(|dep| name_to_bom_ref.get(dep.as_str()).map(|s| s.to_string()))
        .collect();

    // Build transitive dependency map
    let transitive: HashMap<String, Vec<String>> = graph
        .transitive_dependencies()
        .iter()
        .filter_map(|(parent, children)| {
            let parent_bom_ref = name_to_bom_ref.get(parent.as_str())?;
            let child_bom_refs: Vec<String> = children
                .iter()
                .filter_map(|child| name_to_bom_ref.get(child.as_str()).map(|s| s.to_string()))
                .collect();
            if child_bom_refs.is_empty() {
                None
            } else {
                Some((parent_bom_ref.to_string(), child_bom_refs))
            }
        })
        .collect();

    DependencyView { direct, transitive }
}

#[cfg(test)]
mod tests {
    use super::super::component_builder;
    use super::super::test_helpers as th;
    use super::*;
    use crate::sbom_generation::domain::{DependencyGraph, PackageName};
    use std::collections::HashMap;

    #[test]
    fn test_build_dependencies_maps_direct_to_bom_refs() {
        let packages = vec![
            th::package("requests", "2.31.0"),
            th::package("urllib3", "2.0.0"),
        ];
        let components = component_builder::build_components(&packages, None);

        let direct_deps = vec![
            PackageName::new("requests".to_string()).unwrap(),
            PackageName::new("urllib3".to_string()).unwrap(),
        ];
        let graph = DependencyGraph::new(direct_deps, HashMap::new(), HashMap::new());

        let deps = build_dependencies(&graph, &components);

        assert_eq!(deps.direct.len(), 2);
        assert!(deps.direct.contains(&"requests-2.31.0".to_string()));
        assert!(deps.direct.contains(&"urllib3-2.0.0".to_string()));
    }

    #[test]
    fn test_build_dependencies_builds_transitive_map() {
        let packages = vec![
            th::package("requests", "2.31.0"),
            th::package("urllib3", "2.0.0"),
            th::package("certifi", "2023.7.22"),
        ];
        let components = component_builder::build_components(&packages, None);

        let direct_deps = vec![PackageName::new("requests".to_string()).unwrap()];
        let mut transitive = HashMap::new();
        transitive.insert(
            PackageName::new("requests".to_string()).unwrap(),
            vec![
                PackageName::new("urllib3".to_string()).unwrap(),
                PackageName::new("certifi".to_string()).unwrap(),
            ],
        );
        let graph = DependencyGraph::new(direct_deps, transitive, HashMap::new());

        let deps = build_dependencies(&graph, &components);

        assert_eq!(deps.direct.len(), 1);
        assert!(deps.transitive.contains_key("requests-2.31.0"));
        let requests_deps = deps.transitive.get("requests-2.31.0").unwrap();
        assert_eq!(requests_deps.len(), 2);
        assert!(requests_deps.contains(&"urllib3-2.0.0".to_string()));
        assert!(requests_deps.contains(&"certifi-2023.7.22".to_string()));
    }

    #[test]
    fn test_build_dependencies_filters_unknown_packages() {
        let packages = vec![th::package("requests", "2.31.0")];
        let components = component_builder::build_components(&packages, None);

        // unknown-pkg is not in components
        let direct_deps = vec![
            PackageName::new("requests".to_string()).unwrap(),
            PackageName::new("unknown-pkg".to_string()).unwrap(),
        ];
        let graph = DependencyGraph::new(direct_deps, HashMap::new(), HashMap::new());

        let deps = build_dependencies(&graph, &components);

        assert_eq!(deps.direct.len(), 1);
        assert!(deps.direct.contains(&"requests-2.31.0".to_string()));
    }

    #[test]
    fn test_build_dependencies_empty_graph() {
        let packages = vec![th::package("requests", "2.31.0")];
        let components = component_builder::build_components(&packages, None);
        let graph = DependencyGraph::new(vec![], HashMap::new(), HashMap::new());

        let deps = build_dependencies(&graph, &components);

        assert!(deps.direct.is_empty());
        assert!(deps.transitive.is_empty());
    }
}