Struct HashQualityMetrics 

pub struct HashQualityMetrics {
    pub components_with_any_hash: usize,
    pub components_with_strong_hash: usize,
    pub components_with_weak_only: usize,
    pub algorithm_distribution: BTreeMap<String, usize>,
    pub total_hashes: usize,
    pub vendor_components_total: usize,
    pub vendor_components_with_hash: usize,
    pub vendor_components_with_strong_hash: usize,
}

Hash/integrity quality metrics

Fields

components_with_any_hash: usize

Components with any hash

components_with_strong_hash: usize

Components with at least one strong hash (SHA-256+, SHA-3, BLAKE, Blake3)

components_with_weak_only: usize

Components with only weak hashes (MD5, SHA-1) and no strong backup

algorithm_distribution: BTreeMap<String, usize>

Distribution of hash algorithms across all components

total_hashes: usize

Total hash entries across all components

vendor_components_total: usize

Vendor-supplied components — supplier or author set AND a non-synthetic canonical identifier (PURL/CPE/SWHID/SWID). Tracks how many such “upstream” components exist, used to verify CRA prEN 40000-1-3 [PRE-7-RQ-07-RE] (carry-through of vendor hashes).

vendor_components_with_hash: usize

Vendor components that carry at least one hash entry.

vendor_components_with_strong_hash: usize

Vendor components that carry at least one strong hash (SHA-256+).

Implementations

impl HashQualityMetrics

pub fn from_sbom(sbom: &NormalizedSbom) -> Self

Calculate hash quality metrics from an SBOM

pub fn vendor_hash_coverage(&self) -> Option<f64>

Vendor-hash coverage (fraction of vendor-supplied components carrying at least one hash). Returns None when there are no vendor components, so the caller can suppress the violation rather than divide by zero.

pub fn vendor_strong_hash_coverage(&self) -> Option<f64>

Vendor strong-hash coverage (fraction with at least one SHA-256+ hash).

pub fn quality_score(&self, total_components: usize) -> f32

Calculate integrity quality score (0-100)

Base 60% for any-hash coverage + 40% bonus for strong-hash coverage, with a penalty for weak-only components.

Trait Implementations

impl Clone for HashQualityMetrics

fn clone(&self) -> HashQualityMetrics

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HashQualityMetrics

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for HashQualityMetrics

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for HashQualityMetrics

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.