Module model 

Intermediate representation for normalized SBOMs.

This module defines the canonical data structures used for format-agnostic SBOM comparison. Both CycloneDX and SPDX formats are normalized to these structures before diff operations.

Index Support

For efficient TUI operations on large SBOMs, use NormalizedSbomIndex to precompute lookups:

let sbom = parse_sbom(&path)?;
let index = NormalizedSbomIndex::build(&sbom);

// O(1) dependency lookup instead of O(edges)
let deps = index.dependencies_of(&component_id, &sbom.edges);

Structs

AffirmationSignatory

A declarations.affirmation.signatories[] entry.

AlgorithmClassification

Structured result of classify_algorithm: canonical family name, extracted parameter/size, and coarse security class.

AlgorithmProperties

Properties of a cryptographic algorithm asset.

Annotation

Annotation/comment

AttestationAssertion

A declarations.attestations[] entry: an assessor’s mapping of standard requirements to claims.

AttestationDeclarations

Normalized CDXA evidence: CycloneDX 1.6 declarations plus the definitions.standards encodings its attestations map into.

AttestationMapEntry

One attestations[].map[] entry: requirement → claims, with the attestor’s declared conformance and confidence.

CanonicalId

Canonical identifier for a component.

CanonicalIdResult

Result of canonical ID generation, including stability information

CdxaRef

A CDXA refLink with its parse-time resolution.

CertificateProperties

Properties of a digital certificate asset.

CipherSuite

A cipher suite within a protocol.

Component

Component in the normalized SBOM

ComponentExtensions

Component-level extensions

ComponentIdentifiers

Component identifiers from various sources

ComponentRef

A lightweight reference to a component, combining its stable ID with a human-readable display name.

ComponentSortKey

Pre-computed lowercase strings for sorting without repeated allocations.

Contact

Contact information

ControlAssertion

A manufacturer-supplied assertion that a specific Annex I Part I control is satisfied. Surfaced verbatim in the cra-docs technical-documentation dossier and cross-checked by ComplianceChecker (a control claimed satisfied = true without an evidence_url is flagged as a Warning).

CraSidecarMetadata

CRA sidecar metadata that supplements SBOM information

Creator

Creator information

CryptoProperties

Cryptographic properties for a component of type cryptographic-asset.

CvssScore

CVSS score information

DatasetInfo

Dataset component metadata (CycloneDX 1.5+ data type)

DatasetRef

Reference to a dataset used for training or evaluation

DeclarationTarget

One entry of declarations.targets (organization, component, or service listed as a claim target). These are NOT part of the BOM inventory; only their identity is retained so claim targets can resolve to them.

DeclarationTargets

The declarations.targets object.

DeclaredAffirmation

The declarations.affirmation object.

DeclaredAssessor

A declarations.assessors[] entry.

DeclaredClaim

A declarations.claims[] entry: a statement about a target.

DeclaredEvidence

A declarations.evidence[] entry.

DefinedRequirement

One definitions.standards[].requirements[] entry.

DefinedStandard

One definitions.standards[] entry: a machine-readable standard encoding. (levels are not normalized in phase 1.)

DependencyEdge

Dependency edge between components

DocumentMetadata

Document-level metadata

EolInfo

End-of-life information for a component

EthicalConsideration

An ethical consideration for an ML model. Normalized from CycloneDX structured objects ({ name, mitigationStrategy }) and SPDX free-text strings alike.

EvidenceDataItem

One evidence[].data[] entry: output or analysis that supports claims.

ExternalReference

External reference

FairnessAssessment

A fairness assessment for an ML model (CycloneDX 1.5+ considerations.fairnessAssessments[]).

FormatExtensions

Format-specific extensions that don’t map to the canonical model

Hash

Cryptographic hash.

Ikev2TransformTypes

IKEv2 transform types for IPsec protocols (RFC 9370).

KevInfo

CISA Known Exploited Vulnerabilities (KEV) catalog information

LicenseEvidence

License evidence from source scanning

LicenseExpression

License expression following SPDX license expression syntax

LicenseInfo

License information for a component

MetricEntry

A single quantitative performance metric (CycloneDX quantitativeAnalysis.performanceMetrics[]).

MlModelInfo

Machine learning model metadata (CycloneDX 1.5+)

NormalizedSbom

Normalized SBOM document - the canonical intermediate representation.

NormalizedSbomIndex

Precomputed index for efficient SBOM queries.

Organization

Organization/supplier information

Property

Key-value property

ProtocolProperties

Properties of a cryptographic protocol asset.

RelatedCryptoMaterialProperties

Properties of a cryptographic key or related material asset.

Remediation

Remediation information

SbomIndexBuilder

Builder for creating indexes with optional features.

SecuredBy

How a cryptographic material is secured/protected.

SignatureInfo

Digital signature information for the SBOM document

SignaturePresence

Structural record that a JSF (JSON Signature Format) signature object was present, and what it names.

StalenessInfo

Staleness information for a component

SupportedRequirement

A standard requirement that resolved CDXA evidence fully supports at the evaluation instant (see AttestationDeclarations::supported_requirements for the fail-closed criteria). Borrows from the declarations it was computed over; a query result, not a serialized artifact.

SwhidObject

A structured Software Heritage persistent identifier.

VexStatus

VEX (Vulnerability Exploitability eXchange) status

VulnerabilityCounts

Vulnerability counts by severity

VulnerabilityRef

Reference to a vulnerability affecting a component

VulnerabilityRef2

A reference to a vulnerability with its associated component

Enums

AlgorithmClass

Coarse security class produced by classify_algorithm.

AttestationRuleFamily

Engine rule families that CDXA evidence can strengthen. Requirements whose (standard, identifier) pair classifies into none of these are recorded but satisfy nothing (unknown-content handling: fail-open for recognition, fail-closed for satisfaction).

BomProfile

BOM profile — determines mode-specific behavior across TUI and CLI.

CdxaResolution

Where a CDXA refLink resolved at parse time.

CertificationLevel

Certification or validation level achieved.

CompletenessDeclaration

Self-declared completeness level of the SBOM

ComponentType

Component type classification

ConformityRoute

Conformity-assessment module per CRA Annex VIII.

CraProductClass

CRA product class per Regulation (EU) 2024/2847 Annex III/IV.

CraSidecarError

Errors that can occur when loading sidecar metadata

CreatorType

Type of creator

CryptoAssetType

Type of cryptographic asset.

CryptoFunction

Cryptographic function capability.

CryptoMaterialState

Lifecycle state of cryptographic material.

CryptoMaterialType

Type of cryptographic key material.

CryptoMode

Block cipher mode of operation.

CryptoPadding

Padding scheme.

CryptoPrimitive

Cryptographic primitive type.

CvssVersion

CVSS version

DependencyScope

Dependency scope

DependencyType

Dependency relationship type

Ecosystem

Ecosystem/package manager type

EolStatus

End-of-life status classification for components

EvidenceLevel

How strongly a piece of compliance evidence is attested.

ExecutionEnvironment

Execution environment for the cryptographic implementation.

ExternalRefType

External reference types

HashAlgorithm

Hash algorithm types

HashProvenance

Where a hash came from — determines whether integrity verification trusts it as an EXPECTED baseline. Runtime-only, never serialized: a hash parsed from an SBOM is author-attested (Authored); one this tool added during enrichment (fetched from a registry / served from cache) is Enriched and must NOT be used as the baseline to verify local files against — that would be circular (the tool checks a file against a hash it fetched from the same source that could host the file).

IdReliability

Reliability level of component identification

IdSource

Source of the canonical identifier, ordered by reliability

ImplementationPlatform

Hardware/software platform of the implementation.

LicenseFamily

License family classification

PqcKind

NIST-standardized (or SP 800-208) post-quantum algorithm kind.

ProtocolType

Cryptographic protocol type.

RemediationType

Remediation type

SbomFormat

SBOM format type

Severity

Severity level

StalenessLevel

Staleness level classification for dependencies

SwhidKind

Software Heritage persistent identifier kind.

SwhidParseError

Errors returned when parsing a SWHID string.

VexJustification

VEX justification for not_affected status

VexResponse

VEX response type

VexState

VEX state

VulnerabilitySource

Vulnerability database source

Functions

classify_algorithm

Classify a cryptographic algorithm from whatever identity a CBOM provides.

classify_algorithm_names

Extract every recognizable algorithm mention from a free-form name using word-boundary token matching (never bare substrings). Used for cipher-suite names (“TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256”) and as the guarded name-based fallback for assets without algorithmFamily/OID.

classify_algorithm_names_guarded

Like classify_algorithm_names, but drops the riskiest bare aliases (“SEED”, “EC”/“ECC”) that collide with everyday words — “seed-expander” is a DRBG utility, not the SEED block cipher, and “ec2” is not elliptic curve crypto. Used for the name-only fallback and raw bom-ref scans, where no structured identity backs the token; declared algorithmFamily strings and cipher-suite names (where bare “SEED” really is the cipher) keep the full alias table.

is_valid_swhid

Validate a SWHID string (convenience predicate over SwhidObject::parse).

worst_classification

The most severe classification among mentions (first wins on ties), per AlgorithmClass::severity_rank. Callers that must reduce a multi-algorithm identity (“sha384-rsa-cert-chain”) to one verdict use this so the worst algorithm is reported, never whichever token happened to appear first.