Struct NormalizedSbom 

pub struct NormalizedSbom {
    pub document: DocumentMetadata,
    pub components: IndexMap<CanonicalId, Component>,
    pub edges: Vec<DependencyEdge>,
    pub extensions: FormatExtensions,
    pub content_hash: u64,
    pub primary_component_id: Option<CanonicalId>,
    pub collision_count: usize,
}

Normalized SBOM document - the canonical intermediate representation.

This structure represents an SBOM in a format-agnostic way, allowing comparison between CycloneDX and SPDX documents.

Fields

document: DocumentMetadata

Document-level metadata

components: IndexMap<CanonicalId, Component>

Components indexed by canonical ID

edges: Vec<DependencyEdge>

Dependency edges

extensions: FormatExtensions

Format-specific extensions

content_hash: u64

Content hash for quick equality checks

primary_component_id: Option<CanonicalId>

Primary/root product component (CycloneDX metadata.component or SPDX documentDescribes) This identifies the main product that this SBOM describes, important for CRA compliance.

collision_count: usize

Number of canonical ID collisions encountered during parsing

Implementations

impl NormalizedSbom

pub fn new(document: DocumentMetadata) -> Self

Create a new empty normalized SBOM

pub fn add_component(&mut self, component: Component) -> bool

Add a component to the SBOM.

Returns true if a collision occurred (a component with the same canonical ID was already present and has been overwritten). Collisions are logged as warnings.

pub fn log_collision_summary(&self)

Log a single summary line if any canonical ID collisions occurred during parsing.

pub fn add_edge(&mut self, edge: DependencyEdge)

Add a dependency edge

pub fn get_component(&self, id: &CanonicalId) -> Option<&Component>

Get a component by canonical ID

pub fn get_dependencies(&self, id: &CanonicalId) -> Vec<&DependencyEdge>

Get dependencies of a component

pub fn get_dependents(&self, id: &CanonicalId) -> Vec<&DependencyEdge>

Get dependents of a component

pub fn calculate_content_hash(&mut self)

Calculate and update the content hash

pub fn component_count(&self) -> usize

Get total component count

pub fn primary_component(&self) -> Option<&Component>

Get the primary/root product component if set

pub fn set_primary_component(&mut self, id: CanonicalId)

Set the primary component by its canonical ID

pub fn ecosystems(&self) -> Vec<&Ecosystem>

Get all unique ecosystems in the SBOM

pub fn all_vulnerabilities(&self) -> Vec<(&Component, &VulnerabilityRef)>

Get all vulnerabilities across all components

pub fn vulnerability_counts(&self) -> VulnerabilityCounts

Count vulnerabilities by severity

pub fn build_index(&self) -> NormalizedSbomIndex

Build an index for this SBOM.

The index provides O(1) lookups for dependencies, dependents, and name-based searches. Build once and reuse for multiple operations.

Example

let sbom = parse_sbom(&path)?;
let index = sbom.build_index();

// Fast dependency lookup
let deps = index.dependencies_of(&component_id, &sbom.edges);

pub fn get_dependencies_indexed<'a>( &'a self, id: &CanonicalId, index: &NormalizedSbomIndex, ) -> Vec<&'a DependencyEdge>

Get dependencies using an index (O(k) instead of O(edges)).

Use this when you have a prebuilt index for repeated lookups.

pub fn get_dependents_indexed<'a>( &'a self, id: &CanonicalId, index: &NormalizedSbomIndex, ) -> Vec<&'a DependencyEdge>

Get dependents using an index (O(k) instead of O(edges)).

Use this when you have a prebuilt index for repeated lookups.

pub fn find_by_name_indexed( &self, name: &str, index: &NormalizedSbomIndex, ) -> Vec<&Component>

Find components by name (case-insensitive) using an index.

Returns components whose lowercased name exactly matches the query.

pub fn search_by_name_indexed( &self, query: &str, index: &NormalizedSbomIndex, ) -> Vec<&Component>

Search components by name (case-insensitive substring) using an index.

Returns components whose name contains the query substring.

pub fn apply_cra_sidecar(&mut self, sidecar: &CraSidecarMetadata)

Apply CRA sidecar metadata to supplement SBOM fields.

Sidecar values only override SBOM fields if the SBOM field is None/empty. This ensures SBOM data takes precedence when available.

Trait Implementations

impl Clone for NormalizedSbom

fn clone(&self) -> NormalizedSbom

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NormalizedSbom

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for NormalizedSbom

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for NormalizedSbom

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for NormalizedSbom

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.