Class SbomGraph

java.lang.Object

org.cyclonedx.gradle.model.SbomGraph

All Implemented Interfaces:

Serializable

public class SbomGraph
extends Object
implements Serializable

Represents the aggregated dependency graph across all the configurations of the projects in scope. It is fully serializable to support the build cache.

See Also:

• Serialized Form

Constructor Summary

Constructors

Constructor	Description
SbomGraph(Map<SbomComponentId, SbomComponent> graph, SbomComponent rootComponent)
SbomGraph(Map<SbomComponentId, SbomComponent> graph, SbomComponent rootComponent, Set<File> pomFiles)

Method Summary

Modifier and Type	Method	Description
Map<SbomComponentId, SbomComponent>	getGraph()
Map<String,String>	getMetadataEnrichment()	What metadata enrichment contributed to each component, as one canonical line per component keyed by its coordinates: licenses, publisher, description, external references and the unresolved-metadata value.
Set<File>	getPomFiles()	Every POM read while enriching the components of this graph: the component POMs, and the parent and imported POMs the effective models were built from.
SbomComponent	getRootComponent()

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SbomGraph

public SbomGraph(Map<SbomComponentId, SbomComponent> graph,
 SbomComponent rootComponent)

SbomGraph

public SbomGraph(Map<SbomComponentId, SbomComponent> graph,
 SbomComponent rootComponent,
 Set<File> pomFiles)

Method Details

getGraph

public Map<SbomComponentId, SbomComponent> getGraph()

getRootComponent

public SbomComponent getRootComponent()

getPomFiles

public Set<File> getPomFiles()

Every POM read while enriching the components of this graph: the component POMs, and the parent and imported POMs the effective models were built from. Together with the artifacts they are the evidence the SBOM was produced from, so the task declares them as inputs.

getMetadataEnrichment

public Map<String,String> getMetadataEnrichment()

What metadata enrichment contributed to each component, as one canonical line per component keyed by its coordinates: licenses, publisher, description, external references and the unresolved-metadata value. This is what the document is written from, so the task declares it as an input beside the POM files it was read from: a document is then only ever served to a build whose metadata is the same, even where the files and the metadata were read at different moments. Components that were not looked up, project components among them, have no entry, so the map is empty when metadata resolution is disabled. Every value is written with its length in front and an absent value is marked as such, so two different enrichment results never encode alike, whatever the values contain: this line is what tells a stale document from a current one when both fingerprint the same files, so nothing else may be relied on to separate them.