Crate sbom_model_spdx 

sbom-model-spdx

spdx adapter for sbom-model.

parses spdx 2.x documents (json, xml, and tag-value) into the format-agnostic Sbom type.

usage

use sbom_model::Sbom;
use sbom_model_spdx::SpdxReader;

let json = r#"{
    "spdxVersion": "SPDX-2.3",
    "dataLicense": "CC0-1.0",
    "SPDXID": "SPDXRef-DOCUMENT",
    "name": "example",
    "documentNamespace": "https://example.com/sbom",
    "creationInfo": {
        "creators": ["Tool: example"],
        "created": "2024-01-01T00:00:00Z"
    },
    "packages": [
        {
            "name": "serde",
            "SPDXID": "SPDXRef-serde",
            "downloadLocation": "https://crates.io/crates/serde",
            "licenseConcluded": "MIT"
        }
    ],
    "relationships": []
}"#;

let sbom: Sbom = SpdxReader::read_json(json.as_bytes()).unwrap();

assert_eq!(sbom.components.len(), 1);
assert_eq!(sbom.components[0].name, "serde");

supported features

• spdx 2.x json (read_json), xml (read_xml), and tag-value (read_tag_value); rdf is not supported
• xml accepts both <Document> and <SpdxDocument> as the root element
• packages with name, version, licenses, checksums
• supplier information
• purl extraction from external references
• relationship-based dependency graph with forward types (DEPENDS_ON, CONTAINS, DESCRIBES, HAS_PREREQUISITE) and inverse types (DEPENDENCY_OF, CONTAINED_BY, DESCRIBED_BY, PREREQUISITE_FOR, RUNTIME_DEPENDENCY_OF, DEV_DEPENDENCY_OF, BUILD_DEPENDENCY_OF, OPTIONAL_DEPENDENCY_OF, PROVIDED_DEPENDENCY_OF, TEST_DEPENDENCY_OF)
• creation info (timestamps, tools, authors)

error handling

use sbom_model_spdx::{SpdxReader, Error};

fn parse(data: &[u8]) -> Result<(), Error> {
    let sbom = SpdxReader::read_json(data)?;
    // ...
    Ok(())
}

the Error type wraps parse errors from serde_json, the tag-value parser, and the xml reader, and reports an unsupported spec version (spdx 3.x) separately for every input format.

related crates

• sbom-model - the core data model
• sbom-model-cyclonedx - cyclonedx format adapter
• sbom-diff - diff engine and cli

Structs

SpdxReader

parser for SPDX documents.

Enums

Error

errors that can occur when parsing SPDX documents.