Struct Component 

pub struct Component {
    pub id: ComponentId,
    pub name: String,
    pub version: Option<String>,
    pub ecosystem: Option<String>,
    pub supplier: Option<String>,
    pub description: Option<String>,
    pub purl: Option<String>,
    pub licenses: BTreeSet<String>,
    pub license_expression: Option<String>,
    pub hashes: BTreeMap<String, String>,
    pub source_ids: Vec<String>,
}

a software component (package, library, or application).

represents a single entry in the SBOM with all its metadata. components are identified by their ComponentId and can have relationships to other components via the dependency graph.

Fields

id: ComponentId

stable identifier for this component.

name: String

package name (e.g., “serde”, “lodash”).

version: Option<String>

package version (e.g., “1.0.0”, “4.17.21”).

ecosystem: Option<String>

package ecosystem (e.g., “cargo”, “npm”, “pypi”).

supplier: Option<String>

package supplier or publisher.

description: Option<String>

human-readable description.

purl: Option<String>

package URL per the purl spec.

licenses: BTreeSet<String>

SPDX license identifiers (e.g., “MIT”, “Apache-2.0”).

license_expression: Option<String>

the SPDX license expression the source document declared, when it declared one (e.g., “MIT OR Apache-2.0”).

licenses is the flattened identifier set of this expression and stays populated either way; policy decisions should go through licensing, which keeps the operators.

hashes: BTreeMap<String, String>

checksums keyed by algorithm (e.g., “sha256” -> “abc123…”).

source_ids: Vec<String>

original identifiers from the source document (e.g., SPDX SPDXRef, CycloneDX bom-ref).

Implementations

impl Component

pub fn new(name: String, version: Option<String>) -> Self

creates a new component with the given name and optional version.

the component ID is generated from a hash of the name and version. use this for simple cases; for full control, construct the struct directly.

pub fn licensing(&self) -> Licensing<'_>

returns the licensing this component declares, for policy evaluation.

impl Component

pub fn normalize(&mut self)

normalizes the component for deterministic comparison.

lowercases hash keys and values. licenses are stored as a BTreeSet so they’re already sorted and deduplicated.

Trait Implementations

impl Clone for Component

fn clone(&self) -> Component

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Component

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Component

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Component

impl PartialEq for Component

fn eq(&self, other: &Component) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Component

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Component