Struct ProvenanceMetrics 

pub struct ProvenanceMetrics {

    pub has_tool_creator: bool,
    pub has_tool_version: bool,
    pub has_org_creator: bool,
    pub has_contact_email: bool,
    pub has_serial_number: bool,
    pub has_document_name: bool,
    pub timestamp_age_days: u32,
    pub timestamp_known: bool,
    pub is_fresh: bool,
    pub has_primary_component: bool,
    pub lifecycle_phase: Option<String>,
    pub completeness_declaration: CompletenessDeclaration,
    pub has_signature: bool,
    pub has_citations: bool,
    pub citations_count: usize,
}

Document provenance and authorship quality metrics

Fields

has_tool_creator: bool

Whether the SBOM was created by an identified tool

has_tool_version: bool

Whether the tool creator includes version information

has_org_creator: bool

Whether an organization is identified as creator

has_contact_email: bool

Whether any creator has a contact email

has_serial_number: bool

Whether the document has a serial number / namespace

has_document_name: bool

Whether the document has a name

timestamp_age_days: u32

Age of the SBOM in days (since creation timestamp). Meaningful only when timestamp_known is true; a missing timestamp is not “very old”.

timestamp_known: bool

Whether the document carries a real creation timestamp (vs. the epoch sentinel parsers substitute for a missing/invalid one).

is_fresh: bool

Whether the SBOM is considered fresh (< 90 days old). False when the timestamp is unknown — a missing timestamp is not fresh.

has_primary_component: bool

Whether a primary/described component is identified

lifecycle_phase: Option<String>

SBOM lifecycle phase (from CycloneDX 1.5+ metadata)

completeness_declaration: CompletenessDeclaration

Self-declared completeness level of the SBOM

has_signature: bool

Whether the SBOM has a digital signature

has_citations: bool

Whether the SBOM has data provenance citations (CycloneDX 1.7+)

citations_count: usize

Number of data provenance citations

Implementations

impl ProvenanceMetrics

pub fn from_sbom(sbom: &NormalizedSbom) -> Self

Calculate provenance metrics from an SBOM

pub fn quality_score(&self, is_cyclonedx: bool) -> f32

Calculate provenance quality score (0-100)

Weighted checklist: tool creator (15%), tool version (5%), org creator (12%), contact email (8%), serial number (8%), document name (5%), primary component (12%), completeness declaration (8%), signature (5%), lifecycle phase (10% CDX-only).

Freshness (is_fresh) is deliberately NOT scored: it is computed from the live wall clock, so identical SBOM bytes would score differently across days (and flip at midnight). It remains available as display metadata; the score itself is a pure function of the document.

Trait Implementations

impl Clone for ProvenanceMetrics

fn clone(&self) -> ProvenanceMetrics

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProvenanceMetrics

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProvenanceMetrics

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ProvenanceMetrics

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.