Struct Sbom 

pub struct Sbom {
    pub metadata: Metadata,
    pub components: IndexMap<ComponentId, Component>,
    pub dependencies: BTreeMap<ComponentId, BTreeSet<ComponentId>>,
}

Format-agnostic SBOM (Software Bill of Materials) representation.

This is the central type that holds all components and their relationships. It abstracts over format-specific details from CycloneDX, SPDX, and other formats.

Example

use sbom_model::{Sbom, Component};

let mut sbom = Sbom::default();
let component = Component::new("serde".into(), Some("1.0.0".into()));
sbom.components.insert(component.id.clone(), component);

Fields

metadata: Metadata

Document-level metadata (creation time, tools, authors).

components: IndexMap<ComponentId, Component>

All components indexed by their stable identifier.

dependencies: BTreeMap<ComponentId, BTreeSet<ComponentId>>

Dependency graph as adjacency list: parent -> set of children.

Implementations

impl Sbom

pub fn normalize(&mut self)

Normalizes the SBOM for deterministic comparison.

This method:

• Sorts components by ID
• Deduplicates and sorts licenses within each component
• Lowercases hash algorithms and values
• Clears volatile metadata (timestamps, tools, authors)

Call this before comparing two SBOMs to ignore irrelevant differences.

pub fn roots(&self) -> Vec<ComponentId>

Returns root components (those not depended on by any other component).

These are typically the top-level packages or applications in the SBOM.

pub fn deps(&self, id: &ComponentId) -> Vec<ComponentId>

Returns direct dependencies of the given component.

pub fn rdeps(&self, id: &ComponentId) -> Vec<ComponentId>

Returns reverse dependencies (components that depend on the given component).

pub fn transitive_deps(&self, id: &ComponentId) -> BTreeSet<ComponentId>

Returns all transitive dependencies of the given component.

Traverses the dependency graph depth-first and returns all reachable components.

pub fn ecosystems(&self) -> BTreeSet<String>

Returns all unique ecosystems present in the SBOM.

pub fn licenses(&self) -> BTreeSet<String>

Returns all unique licenses present across all components.

pub fn missing_hashes(&self) -> Vec<ComponentId>

Returns components that have no checksums/hashes.

Useful for identifying components that may need integrity verification.

pub fn by_purl(&self, purl: &str) -> Option<&Component>

Finds a component by its package URL.

Trait Implementations

impl Clone for Sbom

fn clone(&self) -> Sbom

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Sbom

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Sbom

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Sbom

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for Sbom

fn eq(&self, other: &Sbom) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Sbom

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for Sbom

impl StructuralPartialEq for Sbom