{"header":{"message":"sbom: U2(b) full lean — CycloneDX only; drop SPDX serialisers, elpe sbom cmd, lock -sbom","description":null,"timestamp":"2026-08-04T20:23:33.429747783Z","authors":[{}]},"hash":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC","authors":[{"login":"pmeunier","key":"AAAAC3NzaC1lZDI1NTE5AAAAILagOJFgwaMNhBWQINinKOXmqS4Gh5NgxgriXwdOoINJ"}],"deps":{"hashes":[["JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC","sbom: U2(b) full lean — CycloneDX only; drop SPDX serialisers, elpe sbom cmd, lock -sbom"],["AA",null],["UWQB743KR36X6A6JVNK3VH6KMEFUHOUT6ZS2Y2SWIJR55JSF5WQAC","First working shell (with ocaml code)"],["ODUDDQRY373JMDR6W2BHUWSKEU6TEICQMNZIAIFKJPNUA5UN3C4QC","Adding the OCaml interface"],["P27ILID2JNRMIXJNW47AWFYDU37BXQETA63W742HWVWGAXEET4QQC","Frontend: starting the connection before linking"],["WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC","elpe frontend: SBOM (SPDX 2.3 / CycloneDX 1.5) from lockfile; Darwin/Homebrew source & Mach-O target + lock; mccs solver wiring"],["RQCTKMTOLLSGTRF2LTCUG4S5N22MAPDPIBFSH3CM5WWJ2MQYUB6QC","B.3 frontend: elpe update writes output pins, elpe build pushes+enforces them"],["JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC","sbom: U2(a) emit declarative dep graph in of_lock exports (SPDX DEPENDS_ON + CycloneDX dependencies)"],["SBP3QVZTNOJZKCUCZW4CZ6F3U3MGX26P5YWPHAMNKNV3RQY2L6VQC","module: closed activation ADT + pure sysusers.d reader (typed module system, roadmap §3.7)"],["VBIPPARBBU7DHGMVT534RNQINXU7LRWLOF6OJZM74IV2XA25NA4QC","lock: the lockfile is now a CycloneDX 1.5 BOM (single source of truth)"]],"deps":["UWQB743KR36X6A6JVNK3VH6KMEFUHOUT6ZS2Y2SWIJR55JSF5WQAC","ODUDDQRY373JMDR6W2BHUWSKEU6TEICQMNZIAIFKJPNUA5UN3C4QC","P27ILID2JNRMIXJNW47AWFYDU37BXQETA63W742HWVWGAXEET4QQC","WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC","RQCTKMTOLLSGTRF2LTCUG4S5N22MAPDPIBFSH3CM5WWJ2MQYUB6QC","JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC"],"known":["SBP3QVZTNOJZKCUCZW4CZ6F3U3MGX26P5YWPHAMNKNV3RQY2L6VQC","VBIPPARBBU7DHGMVT534RNQINXU7LRWLOF6OJZM74IV2XA25NA4QC"]},"hunks":[{"Replacement":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":1,"ins":{"up_context":[{"change":5,"pos":254344}],"down_context":[{"change":5,"pos":254388}],"flag":"BLOCK","start":0,"end":39,"inode":{"change":5,"pos":254344}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":254344},"to":{"change":5,"start":254345,"end":254388},"introduced_by":5}],"inode":{"change":5,"pos":254344}},"ins_contents":[{"Add":{"text":"(** CycloneDX SBOM of an Elpe *build*.","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:38"}}],"del_contents":[{"Del":{"text":"(** SBOM generation from an Elpe lockfile.","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:254387"}}]}},{"Replacement":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":3,"ins":{"up_context":[{"change":5,"pos":254389}],"down_context":[{"change":5,"pos":254800}],"flag":"BLOCK","start":40,"end":674,"inode":{"change":5,"pos":254344}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":254389},"to":{"change":5,"start":254389,"end":254800},"introduced_by":5}],"inode":{"change":5,"pos":254344}},"ins_contents":[{"Add":{"text":" Elpe emits exactly one SBOM format: CycloneDX 1.5 JSON. The Grade-1","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:112"}},{"Add":{"text":" \"SBOM from a lock\" lives nowhere here anymore — the lockfile *is* itself","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:191"}},{"Add":{"text":" the canonical CycloneDX document (see [Lock.render]), so re-serialising it","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:270"}},{"Add":{"text":" would be pure duplication. What only a build can produce is captured here:","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:350"}},{"Add":{"text":" [cyclonedx_of_build] describes the *built artifact* and its","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:414"}},{"Add":{"text":" content-addressed closure, every node keyed by its blake3 store hash","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:487"}},{"Add":{"text":" ([pkg:elpe/@] — the verifiable artifact↔SBOM↔provenance link","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:570"}},{"Add":{"text":" the SuperSafe WP funds), with the upstream source PURL (pkg:deb/opam/...)","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:648"}},{"Add":{"text":" forwarded alongside.","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:673"}}],"del_contents":[{"Del":{"text":" An [elpe..lock] is already a bill of materials: one row per","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:254460"}},{"Del":{"text":" resolved package with {name, version, url, hash} and an ecosystem tag","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:254534"}},{"Del":{"text":" ([Lock.source]). This module is a *pure format transform* of that data","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:254610"}},{"Del":{"text":" into the two machine-readable SBOM standards the SuperSafe WP targets:","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:254685"}},{"Del":{"text":" SPDX 2.3 and CycloneDX 1.5, both JSON. No backend, no build — it reads","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:254763"}},{"Del":{"text":" what [elpe lock] already wrote.","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:254799"}}]}},{"Replacement":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":13,"ins":{"up_context":[{"change":5,"pos":254801}],"down_context":[{"change":5,"pos":255449}],"flag":"BLOCK","start":675,"end":1027,"inode":{"change":5,"pos":254344}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":254801},"to":{"change":5,"start":254801,"end":255449},"introduced_by":5}],"inode":{"change":5,"pos":254344}},"ins_contents":[{"Add":{"text":" SPDX is deliberately *not* produced: it is a commodity conversion of","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:747"}},{"Add":{"text":" CycloneDX (cyclonedx-cli / syft), not a package manager's job. The","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:819"}},{"Add":{"text":" consumers downstream (AboutCode — ScanCode for licences, VulnerableCode","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:897"}},{"Add":{"text":" for CVEs) ingest CycloneDX natively. We emit [NOASSERTION] for licences","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:974"}},{"Add":{"text":" and let ScanCode fill them; we do not guess. *)","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1026"}}],"del_contents":[{"Del":{"text":" Division of labour with AboutCode (Coturnix WP, Task 5): Elpe emits the","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:254876"}},{"Del":{"text":" *structural* SBOM (components, PURLs, download URLs, content checksums).","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:254953"}},{"Del":{"text":" Licences are emitted as [NOASSERTION] here and filled downstream by","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255025"}},{"Del":{"text":" ScanCode; CVEs by VulnerableCode. We do not guess licences.","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255090"}},{"Del":{"text":"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255091"}},{"Del":{"text":" This is \"Grade 1\" (flat list, source hashes). \"Grade 2\" — the","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255160"}},{"Del":{"text":" [DEPENDS_ON] dependency graph and the *built-output* content hash — comes","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255240"}},{"Del":{"text":" from walking the derivation DAG at build time (see [project_sbom.md] in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255316"}},{"Del":{"text":" the roadmap repo); the serialisers below are written to be reused","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255386"}},{"Del":{"text":" unchanged once the richer component list is available. *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255448"}}]}},{"Edit":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":21,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":255461},"to":{"change":5,"start":255461,"end":255643},"introduced_by":5}],"inode":{"change":5,"pos":254344}}},"contents":[{"Del":{"text":"(* --- Intermediate, format-neutral representation. Field names are kept","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255534"}},{"Del":{"text":" distinct from [Lock.entry]'s so both records can be in scope without","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255606"}},{"Del":{"text":" ambiguous-label warnings. --- *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255642"}}]}},{"Edit":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":22,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":255644},"to":{"change":5,"start":255644,"end":256004},"introduced_by":5}],"inode":{"change":5,"pos":254344}}},"contents":[{"Del":{"text":"type checksum = { algorithm : string; value : string }","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255698"}},{"Del":{"text":"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255699"}},{"Del":{"text":"type component = {","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255718"}},{"Del":{"text":" purl : string; (** Package-URL identity *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255779"}},{"Del":{"text":" comp_name : string;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255801"}},{"Del":{"text":" comp_version : string;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255826"}},{"Del":{"text":" download_url : string; (** may be \"\" if unknown *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255887"}},{"Del":{"text":" checksums : checksum list;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:255916"}},{"Del":{"text":" license : string option; (** [None] → NOASSERTION (filled by ScanCode) *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:256000"}},{"Del":{"text":"}","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:256002"}},{"Del":{"text":"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:256003"}}]}},{"Edit":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":74,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":258253},"to":{"change":5,"start":258253,"end":258587},"introduced_by":5}],"inode":{"change":5,"pos":254344}}},"contents":[{"Del":{"text":"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258253"}},{"Del":{"text":"let component_of_entry ~target (e : entry) =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258298"}},{"Del":{"text":" {","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258302"}},{"Del":{"text":" purl = purl_of_entry ~target e;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258338"}},{"Del":{"text":" comp_name = e.name;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258362"}},{"Del":{"text":" comp_version = e.version;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258392"}},{"Del":{"text":" download_url = e.url;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258418"}},{"Del":{"text":" checksums = [ { algorithm = e.hash_algorithm; value = e.hash } ];","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258488"}},{"Del":{"text":" license = None;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258508"}},{"Del":{"text":" }","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258512"}},{"Del":{"text":"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258513"}},{"Del":{"text":"(* --- Checksum algorithm names differ between the two standards. --- *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258586"}}]}},{"Edit":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":75,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":258588},"to":{"change":5,"start":258588,"end":258762},"introduced_by":5}],"inode":{"change":5,"pos":254344}}},"contents":[{"Del":{"text":"let spdx_algo = function","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258612"}},{"Del":{"text":" | \"sha256\" -> \"SHA256\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258637"}},{"Del":{"text":" | \"sha512\" -> \"SHA512\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258662"}},{"Del":{"text":" | \"sha1\" -> \"SHA1\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258683"}},{"Del":{"text":" | \"md5\" -> \"MD5\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258702"}},{"Del":{"text":" | \"blake3\" -> \"BLAKE3\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258727"}},{"Del":{"text":" | s -> String.uppercase_ascii s","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258761"}}]}},{"Edit":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":76,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":258763},"to":{"change":5,"start":258763,"end":258940},"introduced_by":5}],"inode":{"change":5,"pos":254344}}},"contents":[{"Del":{"text":"let cdx_algo = function","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258786"}},{"Del":{"text":" | \"sha256\" -> \"SHA-256\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258812"}},{"Del":{"text":" | \"sha512\" -> \"SHA-512\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258838"}},{"Del":{"text":" | \"sha1\" -> \"SHA-1\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258860"}},{"Del":{"text":" | \"md5\" -> \"MD5\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258879"}},{"Del":{"text":" | \"blake3\" -> \"BLAKE3\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258904"}},{"Del":{"text":" | s -> String.uppercase_ascii s","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258938"}},{"Del":{"text":"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:258939"}}]}},{"Edit":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":93,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":259542},"to":{"change":5,"start":259542,"end":259605},"introduced_by":5}],"inode":{"change":5,"pos":254344}}},"contents":[{"Del":{"text":"let opt_license = function Some l -> l | None -> \"NOASSERTION\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259604"}}]}},{"Edit":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":94,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":259606},"to":{"change":5,"start":259606,"end":261215},"introduced_by":5},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":261215},"to":{"change":7,"start":0,"end":18},"introduced_by":7},{"previous":"","flag":"DELETED","from":{"change":7,"pos":18},"to":{"change":5,"start":261237,"end":261489},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":261237},"to":{"change":5,"start":261237,"end":261489},"introduced_by":5},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":261489},"to":{"change":7,"start":19,"end":1078},"introduced_by":7},{"previous":"","flag":"DELETED","from":{"change":7,"pos":1078},"to":{"change":5,"start":261489,"end":261494},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":261489},"to":{"change":5,"start":261489,"end":261494},"introduced_by":5},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":261494},"to":{"change":7,"start":1079,"end":1124},"introduced_by":7},{"previous":"","flag":"DELETED","from":{"change":7,"pos":1124},"to":{"change":5,"start":261494,"end":262179},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":261494},"to":{"change":5,"start":261494,"end":262179},"introduced_by":5}],"inode":{"change":5,"pos":254344}}},"contents":[{"Del":{"text":"(* --- SPDX 2.3 JSON. --- *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259634"}},{"Del":{"text":"let spdx_of_lock (header : header) entries =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259679"}},{"Del":{"text":" let created = now_iso () in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259709"}},{"Del":{"text":" let components =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259728"}},{"Del":{"text":" List.map (component_of_entry ~target:header.target) entries","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259792"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259797"}},{"Del":{"text":" let packages =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259814"}},{"Del":{"text":" List.mapi","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259828"}},{"Del":{"text":" (fun i c ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259846"}},{"Del":{"text":" let id = Printf.sprintf \"SPDXRef-Package-%d\" i in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259904"}},{"Del":{"text":" ( id,","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259918"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259935"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259949"}},{"Del":{"text":" (\"SPDXID\", `String id);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:259987"}},{"Del":{"text":" (\"name\", `String c.comp_name);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260032"}},{"Del":{"text":" (\"versionInfo\", `String c.comp_version);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260087"}},{"Del":{"text":" ( \"downloadLocation\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260123"}},{"Del":{"text":" `String","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260147"}},{"Del":{"text":" (if c.download_url = \"\" then \"NOASSERTION\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260208"}},{"Del":{"text":" else c.download_url) );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260251"}},{"Del":{"text":" (\"filesAnalyzed\", `Bool false);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260297"}},{"Del":{"text":" ( \"checksums\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260326"}},{"Del":{"text":" `List","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260348"}},{"Del":{"text":" (List.map","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260376"}},{"Del":{"text":" (fun ck ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260408"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260438"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260465"}},{"Del":{"text":" (\"algorithm\", `String (spdx_algo ck.algorithm));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260541"}},{"Del":{"text":" (\"checksumValue\", `String ck.value);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260605"}},{"Del":{"text":" ])","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260633"}},{"Del":{"text":" c.checksums) );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260670"}},{"Del":{"text":" (\"licenseConcluded\", `String (opt_license c.license));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260739"}},{"Del":{"text":" (\"licenseDeclared\", `String (opt_license c.license));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260807"}},{"Del":{"text":" ( \"externalRefs\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260839"}},{"Del":{"text":" `List","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260861"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260881"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260908"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:260932"}},{"Del":{"text":" (\"referenceCategory\", `String \"PACKAGE-MANAGER\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261006"}},{"Del":{"text":" (\"referenceType\", `String \"purl\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261065"}},{"Del":{"text":" (\"referenceLocator\", `String c.purl);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261127"}},{"Del":{"text":" ];","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261152"}},{"Del":{"text":" ] );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261175"}},{"Del":{"text":" ] ))","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261192"}},{"Del":{"text":" components","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261209"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261214"}},{"Del":{"text":" let describes =","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:17"}},{"Del":{"text":" List.map","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261249"}},{"Del":{"text":" (fun (id, _) ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261271"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261286"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261298"}},{"Del":{"text":" (\"spdxElementId\", `String \"SPDXRef-DOCUMENT\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261357"}},{"Del":{"text":" (\"relatedSpdxElement\", `String id);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261405"}},{"Del":{"text":" (\"relationshipType\", `String \"DESCRIBES\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261460"}},{"Del":{"text":" ])","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261473"}},{"Del":{"text":" packages","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261488"}},{"Del":{"text":" in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:23"}},{"Del":{"text":" (* Declarative dependency edges (from [entry.deps], populated for deb by the","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:102"}},{"Del":{"text":" solver in U0/U1). A dep is a package *name*; map it to the SPDXID of the","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:181"}},{"Del":{"text":" package with that name. Same index space as [packages] (both walk","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:253"}},{"Del":{"text":" [entries] in order), so package i is [SPDXRef-Package-i]. *)","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:319"}},{"Del":{"text":" let id_by_name = Hashtbl.create 256 in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:360"}},{"Del":{"text":" List.iteri","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:373"}},{"Del":{"text":" (fun i (e : entry) ->","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:399"}},{"Del":{"text":" Hashtbl.replace id_by_name e.name (Printf.sprintf \"SPDXRef-Package-%d\" i))","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:480"}},{"Del":{"text":" entries;","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:493"}},{"Del":{"text":" let depends =","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:509"}},{"Del":{"text":" List.concat","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:525"}},{"Del":{"text":" (List.mapi","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:542"}},{"Del":{"text":" (fun i (e : entry) ->","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:573"}},{"Del":{"text":" let from = Printf.sprintf \"SPDXRef-Package-%d\" i in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:636"}},{"Del":{"text":" e.deps","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:654"}},{"Del":{"text":" |> List.filter_map (fun d -> Hashtbl.find_opt id_by_name d)","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:725"}},{"Del":{"text":" |> List.sort_uniq String.compare","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:769"}},{"Del":{"text":" |> List.map (fun to_id ->","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:806"}},{"Del":{"text":" `Assoc","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:831"}},{"Del":{"text":" [","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:853"}},{"Del":{"text":" (\"spdxElementId\", `String from);","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:908"}},{"Del":{"text":" (\"relatedSpdxElement\", `String to_id);","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:969"}},{"Del":{"text":" (\"relationshipType\", `String \"DEPENDS_ON\");","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1035"}},{"Del":{"text":" ]))","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1059"}},{"Del":{"text":" entries)","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1077"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261493"}},{"Del":{"text":" let relationships = describes @ depends in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1123"}},{"Del":{"text":" let doc =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261505"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261516"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261524"}},{"Del":{"text":" (\"spdxVersion\", `String \"SPDX-2.3\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261569"}},{"Del":{"text":" (\"dataLicense\", `String \"CC0-1.0\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261613"}},{"Del":{"text":" (\"SPDXID\", `String \"SPDXRef-DOCUMENT\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261661"}},{"Del":{"text":" (\"name\", `String (Printf.sprintf \"elpe-%s\" header.target));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261729"}},{"Del":{"text":" ( \"documentNamespace\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261760"}},{"Del":{"text":" `String (Printf.sprintf \"https://spdx.elpe.dev/%s\" header.target) );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261839"}},{"Del":{"text":" ( \"creationInfo\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261865"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261882"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261896"}},{"Del":{"text":" (\"created\", `String created);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:261940"}},{"Del":{"text":" (\"creators\", `List [ `String \"Tool: elpe-sbom\" ]);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262005"}},{"Del":{"text":" ] );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262022"}},{"Del":{"text":" (\"packages\", `List (List.map snd packages));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262075"}},{"Del":{"text":" (\"relationships\", `List relationships);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262123"}},{"Del":{"text":" ]","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262131"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262136"}},{"Del":{"text":" Yojson.Safe.pretty_to_string doc ^ \"\\n\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262178"}}]}},{"Edit":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":95,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":262180},"to":{"change":5,"start":262180,"end":262497},"introduced_by":5},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":262497},"to":{"change":7,"start":1125,"end":1166},"introduced_by":7},{"previous":"","flag":"DELETED","from":{"change":7,"pos":1166},"to":{"change":5,"start":262497,"end":263442},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":262497},"to":{"change":5,"start":262497,"end":263442},"introduced_by":5},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":263442},"to":{"change":7,"start":1167,"end":2266},"introduced_by":7},{"previous":"","flag":"DELETED","from":{"change":7,"pos":2266},"to":{"change":5,"start":263442,"end":264049},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":263442},"to":{"change":5,"start":263442,"end":264049},"introduced_by":5},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":264049},"to":{"change":7,"start":2267,"end":2313},"introduced_by":7},{"previous":"","flag":"DELETED","from":{"change":7,"pos":2313},"to":{"change":5,"start":264049,"end":264105},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":264049},"to":{"change":5,"start":264049,"end":264105},"introduced_by":5}],"inode":{"change":5,"pos":254344}}},"contents":[{"Del":{"text":"(* --- CycloneDX 1.5 JSON. --- *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262213"}},{"Del":{"text":"let cyclonedx_of_lock (header : header) entries =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262263"}},{"Del":{"text":" let created = now_iso () in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262293"}},{"Del":{"text":" let components =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262312"}},{"Del":{"text":" List.map (component_of_entry ~target:header.target) entries","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262376"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262381"}},{"Del":{"text":" let comps =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262395"}},{"Del":{"text":" List.map","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262408"}},{"Del":{"text":" (fun c ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262424"}},{"Del":{"text":" let base =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262443"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262455"}},{"Del":{"text":" (\"type\", `String \"library\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262496"}},{"Del":{"text":" (\"bom-ref\", `String c.purl);","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1165"}},{"Del":{"text":" (\"name\", `String c.comp_name);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262539"}},{"Del":{"text":" (\"version\", `String c.comp_version);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262588"}},{"Del":{"text":" (\"purl\", `String c.purl);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262626"}},{"Del":{"text":" ( \"hashes\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262650"}},{"Del":{"text":" `List","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262670"}},{"Del":{"text":" (List.map","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262696"}},{"Del":{"text":" (fun ck ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262726"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262754"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262779"}},{"Del":{"text":" (\"alg\", `String (cdx_algo ck.algorithm));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262846"}},{"Del":{"text":" (\"content\", `String ck.value);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262902"}},{"Del":{"text":" ])","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262928"}},{"Del":{"text":" c.checksums) );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262963"}},{"Del":{"text":" ]","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262975"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:262986"}},{"Del":{"text":" let refs =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263005"}},{"Del":{"text":" if c.download_url = \"\" then []","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263046"}},{"Del":{"text":" else","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263061"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263075"}},{"Del":{"text":" ( \"externalReferences\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263113"}},{"Del":{"text":" `List","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263135"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263155"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263182"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263206"}},{"Del":{"text":" (\"type\", `String \"distribution\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263264"}},{"Del":{"text":" (\"url\", `String c.download_url);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263321"}},{"Del":{"text":" ];","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263346"}},{"Del":{"text":" ] );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263369"}},{"Del":{"text":" ]","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263383"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263394"}},{"Del":{"text":" `Assoc (base @ refs))","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263424"}},{"Del":{"text":" components","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263441"}},{"Del":{"text":" in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1171"}},{"Del":{"text":" (* Dependency graph, mirroring [Lock.render]: bom-ref = purl, edges from","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1246"}},{"Del":{"text":" [entry.deps] (dep names resolved to the purl of the package with that","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1321"}},{"Del":{"text":" name). This is the same declarative graph the lock carries natively. *)","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1399"}},{"Del":{"text":" let purl_by_name = Hashtbl.create 256 in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1442"}},{"Del":{"text":" List.iter","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1454"}},{"Del":{"text":" (fun (e : entry) ->","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1478"}},{"Del":{"text":" Hashtbl.replace purl_by_name e.name (purl_of_entry ~target:header.target e))","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1561"}},{"Del":{"text":" entries;","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1574"}},{"Del":{"text":" let dependencies =","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1595"}},{"Del":{"text":" entries","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1607"}},{"Del":{"text":" |> List.filter_map (fun (e : entry) ->","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1650"}},{"Del":{"text":" let ref_purl = purl_of_entry ~target:header.target e in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1717"}},{"Del":{"text":" let deps =","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1739"}},{"Del":{"text":" e.deps","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1759"}},{"Del":{"text":" |> List.filter_map (fun d -> Hashtbl.find_opt purl_by_name d)","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1834"}},{"Del":{"text":" |> List.sort_uniq String.compare","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1880"}},{"Del":{"text":" in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1894"}},{"Del":{"text":" if deps = [] then None","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1928"}},{"Del":{"text":" else","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1944"}},{"Del":{"text":" Some","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1962"}},{"Del":{"text":" ( ref_purl,","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:1989"}},{"Del":{"text":" `Assoc","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2013"}},{"Del":{"text":" [","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2034"}},{"Del":{"text":" (\"ref\", `String ref_purl);","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2082"}},{"Del":{"text":" (\"dependsOn\", `List (List.map (fun p -> `String p) deps));","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2162"}},{"Del":{"text":" ] ))","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2186"}},{"Del":{"text":" |> List.sort (fun (a, _) (b, _) -> String.compare a b)","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2245"}},{"Del":{"text":" |> List.map snd","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2265"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263446"}},{"Del":{"text":" let doc =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263458"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263469"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263477"}},{"Del":{"text":" (\"bomFormat\", `String \"CycloneDX\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263521"}},{"Del":{"text":" (\"specVersion\", `String \"1.5\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263561"}},{"Del":{"text":" (\"version\", `Int 1);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263590"}},{"Del":{"text":" ( \"metadata\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263612"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263629"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263643"}},{"Del":{"text":" (\"timestamp\", `String created);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263689"}},{"Del":{"text":" (\"tools\", `List [ `Assoc [ (\"name\", `String \"elpe-sbom\") ] ]);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263766"}},{"Del":{"text":" ( \"component\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263795"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263818"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263838"}},{"Del":{"text":" (\"type\", `String \"application\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263891"}},{"Del":{"text":" (\"name\", `String (Printf.sprintf \"elpe-%s\" header.target));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263971"}},{"Del":{"text":" ] );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:263994"}},{"Del":{"text":" ] );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:264011"}},{"Del":{"text":" (\"components\", `List comps);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:264048"}},{"Del":{"text":" (\"dependencies\", `List dependencies);","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2312"}},{"Del":{"text":" ]","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:264056"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:264061"}},{"Del":{"text":" Yojson.Safe.pretty_to_string doc ^ \"\\n\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:264103"}},{"Del":{"text":"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:264104"}}]}},{"Edit":{"inode":{"change":5,"pos":254344},"path":"elpe/lib/sbom.ml","line":231,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":270120},"to":{"change":5,"start":270120,"end":273401},"introduced_by":5}],"inode":{"change":5,"pos":254344}}},"contents":[{"Del":{"text":"let spdx_of_build ?(upstream = no_upstream) ~target ~roots ~closure () =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270192"}},{"Del":{"text":" let created = now_iso () in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270222"}},{"Del":{"text":" let nodes = graph_of_build ~roots ~closure in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270270"}},{"Del":{"text":" let ided = List.mapi (fun i g -> (Printf.sprintf \"SPDXRef-Package-%d\" i, g)) nodes in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270358"}},{"Del":{"text":" let purl_ref locator =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270383"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270394"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270402"}},{"Del":{"text":" (\"referenceCategory\", `String \"PACKAGE-MANAGER\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270460"}},{"Del":{"text":" (\"referenceType\", `String \"purl\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270503"}},{"Del":{"text":" (\"referenceLocator\", `String locator);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270550"}},{"Del":{"text":" ]","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270558"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270563"}},{"Del":{"text":" let packages =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270580"}},{"Del":{"text":" List.map","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270593"}},{"Del":{"text":" (fun (id, g) ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270615"}},{"Del":{"text":" (* Primary identity = the built artifact (pkg:elpe@output-hash).","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270688"}},{"Del":{"text":" Secondary = the upstream source coordinates (pkg:deb/opam/...) when","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270767"}},{"Del":{"text":" recoverable — SPDX allows several purl externalRefs, so both stay","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270846"}},{"Del":{"text":" first-class and directly consumable. *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270897"}},{"Del":{"text":" let refs =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270916"}},{"Del":{"text":" purl_ref (elpe_purl ~target ~hash:g.g_hash ~name:g.g_name)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270985"}},{"Del":{"text":" ::","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:270998"}},{"Del":{"text":" (match upstream g with Some p -> [ purl_ref p ] | None -> [])","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271070"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271081"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271096"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271108"}},{"Del":{"text":" (\"SPDXID\", `String id);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271144"}},{"Del":{"text":" (\"name\", `String (if g.g_name = \"\" then g.g_hash else g.g_name));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271222"}},{"Del":{"text":" (\"versionInfo\", `String g.g_hash);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271269"}},{"Del":{"text":" (\"downloadLocation\", `String \"NOASSERTION\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271326"}},{"Del":{"text":" (\"filesAnalyzed\", `Bool false);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271370"}},{"Del":{"text":" ( \"checksums\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271397"}},{"Del":{"text":" `List","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271417"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271435"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271460"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271482"}},{"Del":{"text":" (\"algorithm\", `String \"BLAKE3\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271537"}},{"Del":{"text":" (\"checksumValue\", `String g.g_hash);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271596"}},{"Del":{"text":" ];","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271619"}},{"Del":{"text":" ] );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271640"}},{"Del":{"text":" (\"licenseConcluded\", `String \"NOASSERTION\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271697"}},{"Del":{"text":" (\"licenseDeclared\", `String \"NOASSERTION\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271753"}},{"Del":{"text":" (\"externalRefs\", `List refs);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271795"}},{"Del":{"text":" ])","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271808"}},{"Del":{"text":" ided","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271819"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271824"}},{"Del":{"text":" let root_ids = List.filter_map (fun (id, g) -> if g.g_is_root then Some id else None) ided in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271920"}},{"Del":{"text":" let describes =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271938"}},{"Del":{"text":" List.map","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271951"}},{"Del":{"text":" (fun id ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271968"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271983"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:271995"}},{"Del":{"text":" (\"spdxElementId\", `String \"SPDXRef-DOCUMENT\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272054"}},{"Del":{"text":" (\"relatedSpdxElement\", `String id);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272102"}},{"Del":{"text":" (\"relationshipType\", `String \"DESCRIBES\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272157"}},{"Del":{"text":" ])","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272170"}},{"Del":{"text":" root_ids","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272185"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272190"}},{"Del":{"text":" (* root DEPENDS_ON every non-root node (the closure is transitive/flat). *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272268"}},{"Del":{"text":" let depends =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272284"}},{"Del":{"text":" List.concat_map","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272304"}},{"Del":{"text":" (fun rid ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272322"}},{"Del":{"text":" List.filter_map","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272346"}},{"Del":{"text":" (fun (id, g) ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272372"}},{"Del":{"text":" if g.g_is_root then None","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272409"}},{"Del":{"text":" else","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272426"}},{"Del":{"text":" Some","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272445"}},{"Del":{"text":" (`Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272469"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272490"}},{"Del":{"text":" (\"spdxElementId\", `String rid);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272543"}},{"Del":{"text":" (\"relatedSpdxElement\", `String id);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272600"}},{"Del":{"text":" (\"relationshipType\", `String \"DEPENDS_ON\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272665"}},{"Del":{"text":" ]))","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272688"}},{"Del":{"text":" ided)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272704"}},{"Del":{"text":" root_ids","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272719"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272724"}},{"Del":{"text":" let doc =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272736"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272747"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272755"}},{"Del":{"text":" (\"spdxVersion\", `String \"SPDX-2.3\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272800"}},{"Del":{"text":" (\"dataLicense\", `String \"CC0-1.0\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272844"}},{"Del":{"text":" (\"SPDXID\", `String \"SPDXRef-DOCUMENT\");","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272892"}},{"Del":{"text":" (\"name\", `String (Printf.sprintf \"elpe-build-%s\" target));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272959"}},{"Del":{"text":" ( \"documentNamespace\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:272990"}},{"Del":{"text":" `String (Printf.sprintf \"https://spdx.elpe.dev/build/%s\" target) );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273068"}},{"Del":{"text":" ( \"creationInfo\",","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273094"}},{"Del":{"text":" `Assoc","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273111"}},{"Del":{"text":" [","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273125"}},{"Del":{"text":" (\"created\", `String created);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273169"}},{"Del":{"text":" (\"creators\", `List [ `String \"Tool: elpe-sbom\" ]);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273234"}},{"Del":{"text":" ] );","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273251"}},{"Del":{"text":" (\"packages\", `List packages);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273289"}},{"Del":{"text":" (\"relationships\", `List (describes @ depends));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273345"}},{"Del":{"text":" ]","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273353"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273358"}},{"Del":{"text":" Yojson.Safe.pretty_to_string doc ^ \"\\n\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:273400"}}]}},{"Edit":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":49,"atom":{"EdgeMap":{"edges":[{"previous":"","flag":"DELETED","from":{"change":4,"pos":747},"to":{"change":3,"start":74557,"end":74558},"introduced_by":4},{"previous":"","flag":"DELETED","from":{"change":5,"pos":658925},"to":{"change":3,"start":74557,"end":74558},"introduced_by":5},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":74557},"to":{"change":3,"start":74557,"end":74558},"introduced_by":3},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":3,"pos":74558},"to":{"change":5,"start":658926,"end":659462},"introduced_by":5}],"inode":{"change":2,"pos":63278}}},"contents":[{"Del":{"text":"","pos":"ODUDDQRY373JMDR6W2BHUWSKEU6TEICQMNZIAIFKJPNUA5UN3C4QC:74557"}},{"Del":{"text":"(* Read a lock and write its structural (Grade 1) SBOM as","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:658983"}},{"Del":{"text":" .{spdx,cdx}.json. Shared by [elpe sbom] and [elpe lock -sbom]. *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659061"}},{"Del":{"text":"let emit_lock_sbom ~lockfile ~prefix =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659100"}},{"Del":{"text":" let header, entries = Elpe.Lock.read lockfile in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659151"}},{"Del":{"text":" let spdx = Elpe.Sbom.spdx_of_lock header entries in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659205"}},{"Del":{"text":" let cdx = Elpe.Sbom.cyclonedx_of_lock header entries in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659263"}},{"Del":{"text":" write_file (prefix ^ \".spdx.json\") spdx;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659306"}},{"Del":{"text":" write_file (prefix ^ \".cdx.json\") cdx;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659347"}},{"Del":{"text":" Printf.eprintf \"Wrote %s.spdx.json and %s.cdx.json (%d components)\\n%!\" prefix","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659428"}},{"Del":{"text":" prefix (List.length entries)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659461"}}]}},{"Replacement":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":53,"ins":{"up_context":[{"change":4,"pos":835}],"down_context":[{"change":5,"pos":659734}],"flag":"BLOCK","start":1028,"end":1316,"inode":{"change":2,"pos":63278}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":4,"pos":835},"to":{"change":5,"start":659521,"end":659734},"introduced_by":5}],"inode":{"change":2,"pos":63278}},"ins_contents":[{"Add":{"text":" (* SBOM of the built artifact and its content-addressed closure","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1093"}},{"Add":{"text":" (build_result.destdir = roots, .paths = closure). CycloneDX only — the","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1171"}},{"Add":{"text":" one format Elpe emits; SPDX is a downstream conversion, not our job.","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1245"}},{"Add":{"text":" Written next to the derivation as elpe..build.cdx.json. *)","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1315"}}],"del_contents":[{"Del":{"text":" (* Grade 2 SBOM: describe the built artifact and its content-addressed","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659593"}},{"Del":{"text":" closure (build_result.destdir = roots, .paths = closure). Written next to","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659672"}},{"Del":{"text":" the derivation as elpe..build.{spdx,cdx}.json. *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:659733"}}]}},{"Edit":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":75,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":660697},"to":{"change":5,"start":660697,"end":660787},"introduced_by":5}],"inode":{"change":2,"pos":63278}}},"contents":[{"Del":{"text":" let spdx = Elpe.Sbom.spdx_of_build ~upstream ~target ~roots:b.destdir ~closure () in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:660786"}}]}},{"Edit":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":76,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":660881},"to":{"change":5,"start":660881,"end":660927},"introduced_by":5}],"inode":{"change":2,"pos":63278}}},"contents":[{"Del":{"text":" write_file (prefix ^ \".spdx.json\") spdx;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:660926"}}]}},{"Replacement":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":77,"ins":{"up_context":[{"change":5,"pos":660971}],"down_context":[{"change":4,"pos":835}],"flag":"BLOCK","start":1317,"end":1370,"inode":{"change":2,"pos":63278}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":660971},"to":{"change":5,"start":660971,"end":661048},"introduced_by":5}],"inode":{"change":2,"pos":63278}},"ins_contents":[{"Add":{"text":" Printf.eprintf \"Wrote %s.cdx.json\\n%!\" prefix);","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1369"}}],"del_contents":[{"Del":{"text":" Printf.eprintf \"Wrote %s.spdx.json and %s.cdx.json\\n%!\" prefix prefix);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:661047"}}]}},{"Replacement":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":158,"ins":{"up_context":[{"change":5,"pos":661465}],"down_context":[{"change":5,"pos":661542}],"flag":"BLOCK","start":1371,"end":1453,"inode":{"change":2,"pos":63278}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":661465},"to":{"change":5,"start":661465,"end":661542},"introduced_by":5}],"inode":{"change":2,"pos":63278}},"ins_contents":[{"Add":{"text":" ~doc:\"emit elpe..build.cdx.json (CycloneDX) for the built closure\"","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1452"}}],"del_contents":[{"Del":{"text":" ~doc:\"emit elpe..build.{spdx,cdx}.json for the built closure\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:661541"}}]}},{"Replacement":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":179,"ins":{"up_context":[{"change":5,"pos":661642}],"down_context":[{"change":5,"pos":661968}],"flag":"BLOCK","start":1454,"end":1662,"inode":{"change":2,"pos":63278}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":661642},"to":{"change":5,"start":661642,"end":661968},"introduced_by":5}],"inode":{"change":2,"pos":63278}},"ins_contents":[{"Add":{"text":" ~summary:","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1467"}},{"Add":{"text":" \"Resolve project dependencies and write elpe..lock (which is \\","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1544"}},{"Add":{"text":" itself the canonical CycloneDX SBOM)\"","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1589"}},{"Add":{"text":" (let%map_open.Command files = anon (sequence (\"file\" %: string)) in","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1661"}}],"del_contents":[{"Del":{"text":" ~summary:\"Resolve project dependencies and write elpe..lock\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:661714"}},{"Del":{"text":" (let%map_open.Command files = anon (sequence (\"file\" %: string))","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:661783"}},{"Del":{"text":" and sbom =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:661799"}},{"Del":{"text":" flag \"-sbom\" no_arg","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:661826"}},{"Del":{"text":" ~doc:","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:661841"}},{"Del":{"text":" \"also write elpe..{spdx,cdx}.json next to the lock (commit \\","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:661921"}},{"Del":{"text":" them alongside the lock)\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:661959"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:661967"}}]}},{"Replacement":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":193,"ins":{"up_context":[{"change":5,"pos":662351}],"down_context":[{"change":2,"pos":64512}],"flag":"BLOCK","start":1663,"end":1875,"inode":{"change":2,"pos":63278}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":662351},"to":{"change":5,"start":662351,"end":662879},"introduced_by":5}],"inode":{"change":2,"pos":63278}},"ins_contents":[{"Add":{"text":" (* The lock action writes elpe..lock, which is itself the","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1742"}},{"Add":{"text":" canonical CycloneDX SBOM (graph included) — no separate SBOM to","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1825"}},{"Add":{"text":" emit. *)","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1851"}},{"Add":{"text":" action))","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1874"}}],"del_contents":[{"Del":{"text":" let* () = action in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662384"}},{"Del":{"text":" (* The lock action wrote elpe..lock; emit the SBOM next to","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662465"}},{"Del":{"text":" it so a single [elpe lock -sbom] produces committable BOMs. *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662545"}},{"Del":{"text":" (if sbom then","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662573"}},{"Del":{"text":" let lockfile =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662605"}},{"Del":{"text":" Printf.sprintf \"elpe.%s.lock\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662654"}},{"Del":{"text":" (Elpe.Platform.triple !Elpe.Platform.target)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662720"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662740"}},{"Del":{"text":" emit_lock_sbom ~lockfile","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662782"}},{"Del":{"text":" ~prefix:(Filename.remove_extension lockfile));","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662848"}},{"Del":{"text":" Lwt.return ()))","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662878"}}]}},{"Edit":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":250,"atom":{"EdgeMap":{"edges":[{"previous":"","flag":"DELETED","from":{"change":6,"pos":9033},"to":{"change":5,"start":662880,"end":663756},"introduced_by":6},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":2,"pos":64513},"to":{"change":5,"start":662880,"end":663756},"introduced_by":5}],"inode":{"change":2,"pos":63278}}},"contents":[{"Del":{"text":"let sbom =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662890"}},{"Del":{"text":" Core.Command.basic","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662911"}},{"Del":{"text":" ~summary:","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:662925"}},{"Del":{"text":" \"Generate SPDX + CycloneDX SBOM from an elpe..lock (no build)\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663002"}},{"Del":{"text":" (let%map_open.Command lockfile = anon (maybe (\"lockfile\" %: string))","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663075"}},{"Del":{"text":" and out_prefix =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663097"}},{"Del":{"text":" flag \"-o\" (optional string)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663132"}},{"Del":{"text":" ~doc:\"PREFIX output path prefix (default: elpe.)\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663199"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663207"}},{"Del":{"text":" fun () ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663222"}},{"Del":{"text":" let lockfile =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663244"}},{"Del":{"text":" match lockfile with","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663273"}},{"Del":{"text":" | Some f -> f","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663296"}},{"Del":{"text":" | None ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663315"}},{"Del":{"text":" Printf.sprintf \"elpe.%s.lock\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663358"}},{"Del":{"text":" (Elpe.Platform.triple !Elpe.Platform.target)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663418"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663428"}},{"Del":{"text":" (* Default prefix drops the \".lock\" suffix so the SBOM sits next to the","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663507"}},{"Del":{"text":" lock (elpe..lock → elpe..spdx.json). *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663575"}},{"Del":{"text":" let prefix =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663595"}},{"Del":{"text":" match out_prefix with","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663626"}},{"Del":{"text":" | Some p -> p","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663649"}},{"Del":{"text":" | None -> Filename.remove_extension lockfile","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663703"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663713"}},{"Del":{"text":" emit_lock_sbom ~lockfile ~prefix)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663754"}},{"Del":{"text":"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:663755"}}]}},{"Edit":{"inode":{"change":2,"pos":63278},"path":"elpe/bin/elpe_bin.ml","line":257,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":6,"pos":9136},"to":{"change":6,"start":9136,"end":9158},"introduced_by":6}],"inode":{"change":2,"pos":63278}}},"contents":[{"Del":{"text":" (\"sbom\", sbom);","pos":"RQCTKMTOLLSGTRF2LTCUG4S5N22MAPDPIBFSH3CM5WWJ2MQYUB6QC:9157"}}]}},{"Replacement":{"inode":{"change":5,"pos":19},"path":"elpe/test/test_elpe.ml","line":54,"ins":{"up_context":[{"change":5,"pos":2499}],"down_context":[{"change":5,"pos":2699}],"flag":"BLOCK","start":1876,"end":2125,"inode":{"change":5,"pos":19}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":2499},"to":{"change":5,"start":2499,"end":2699},"introduced_by":5}],"inode":{"change":5,"pos":19}},"ins_contents":[{"Add":{"text":"(* --- PURL mapping: the one per-ecosystem bit of the SBOM path. Checks the","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:1951"}},{"Add":{"text":" Package-URL produced for each [Lock.source]. (The lock itself is the","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2023"}},{"Add":{"text":" canonical CycloneDX SBOM — see the lock roundtrip test; Elpe emits no other","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2104"}},{"Add":{"text":" SBOM format.) *)","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2124"}}],"del_contents":[{"Del":{"text":"(* --- SBOM (Grade 1): pure lock→SPDX/CycloneDX transform, no backend. Checks","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:2578"}},{"Del":{"text":" the PURL mapping per ecosystem and that both documents are well-formed JSON","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:2657"}},{"Del":{"text":" with the expected top-level shape. *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:2698"}}]}},{"Edit":{"inode":{"change":5,"pos":19},"path":"elpe/test/test_elpe.ml","line":85,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":3787},"to":{"change":5,"start":3787,"end":5030},"introduced_by":5}],"inode":{"change":5,"pos":19}}},"contents":[{"Del":{"text":"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:3787"}},{"Del":{"text":" (* --- Both documents parse as JSON and carry the right markers. --- *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:3861"}},{"Del":{"text":" let header =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:3876"}},{"Del":{"text":" { L.target; ubuntu_release = Some \"plucky\"; ocaml_version = None;","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:3946"}},{"Del":{"text":" python_version = None }","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:3976"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:3981"}},{"Del":{"text":" let entries =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:3997"}},{"Del":{"text":" [ entry (L.Ubuntu { release = \"plucky\"; repository = \"main\" }) \"gcc\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4070"}},{"Del":{"text":" \"14.2.0\" \"http://x/gcc.deb\" \"sha256\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4115"}},{"Del":{"text":" \"1111111111111111111111111111111111111111111111111111111111111111\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4190"}},{"Del":{"text":" ; entry L.Cargo \"serde\" \"1.0.210\" \"http://x/serde.crate\" \"sha256\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4260"}},{"Del":{"text":" \"2222222222222222222222222222222222222222222222222222222222222222\" ]","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4337"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4342"}},{"Del":{"text":" let spdx = S.spdx_of_lock header entries in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4388"}},{"Del":{"text":" let cdx = S.cyclonedx_of_lock header entries in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4438"}},{"Del":{"text":" let jspdx = Yojson.Safe.from_string spdx in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4484"}},{"Del":{"text":" let jcdx = Yojson.Safe.from_string cdx in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4528"}},{"Del":{"text":" let member k j = Yojson.Safe.Util.member k j in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4578"}},{"Del":{"text":" let to_s j = Yojson.Safe.Util.to_string j in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4625"}},{"Del":{"text":" eq \"spdx version\" (to_s (member \"spdxVersion\" jspdx)) \"SPDX-2.3\";","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4693"}},{"Del":{"text":" check \"spdx has 2 packages\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4723"}},{"Del":{"text":" (List.length (Yojson.Safe.Util.to_list (member \"packages\" jspdx)) = 2);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4799"}},{"Del":{"text":" eq \"cdx format\" (to_s (member \"bomFormat\" jcdx)) \"CycloneDX\";","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4863"}},{"Del":{"text":" eq \"cdx spec\" (to_s (member \"specVersion\" jcdx)) \"1.5\";","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4921"}},{"Del":{"text":" check \"cdx has 2 components\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:4952"}},{"Del":{"text":" (List.length (Yojson.Safe.Util.to_list (member \"components\" jcdx)) = 2);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:5029"}}]}},{"Edit":{"inode":{"change":5,"pos":19},"path":"elpe/test/test_elpe.ml","line":86,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":7,"pos":2315},"to":{"change":7,"start":2315,"end":3306},"introduced_by":7},{"previous":"","flag":"DELETED","from":{"change":7,"pos":3306},"to":{"change":5,"start":5030,"end":5031},"introduced_by":7},{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":5030},"to":{"change":5,"start":5030,"end":5031},"introduced_by":5}],"inode":{"change":5,"pos":19}}},"contents":[{"Del":{"text":" (* --- Declarative graph (U2): [entry.deps] must surface as SPDX DEPENDS_ON","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2392"}},{"Del":{"text":" and CycloneDX [dependencies]. gcc depends on serde by name. --- *)","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2464"}},{"Del":{"text":" let g_entries =","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2482"}},{"Del":{"text":" [ { (List.hd entries) with L.deps = [ \"serde\" ] }; List.nth entries 1 ]","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2558"}},{"Del":{"text":" in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2563"}},{"Del":{"text":" let jspdx_g = Yojson.Safe.from_string (S.spdx_of_lock header g_entries) in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2640"}},{"Del":{"text":" let jcdx_g = Yojson.Safe.from_string (S.cyclonedx_of_lock header g_entries) in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2721"}},{"Del":{"text":" let rtype r = to_s (member \"relationshipType\" r) in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2775"}},{"Del":{"text":" let rels = Yojson.Safe.Util.to_list (member \"relationships\" jspdx_g) in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2849"}},{"Del":{"text":" check \"spdx has 1 DEPENDS_ON\"","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2881"}},{"Del":{"text":" (List.length (List.filter (fun r -> rtype r = \"DEPENDS_ON\") rels) = 1);","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:2957"}},{"Del":{"text":" let cdx_deps = Yojson.Safe.Util.to_list (member \"dependencies\" jcdx_g) in","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:3033"}},{"Del":{"text":" check \"cdx has 1 dependency edge\" (List.length cdx_deps = 1);","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:3097"}},{"Del":{"text":" check \"cdx edge dependsOn serde purl\"","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:3137"}},{"Del":{"text":" (List.exists","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:3154"}},{"Del":{"text":" (fun d ->","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:3171"}},{"Del":{"text":" List.mem (`String \"pkg:cargo/serde@1.0.210\")","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:3225"}},{"Del":{"text":" (Yojson.Safe.Util.to_list (member \"dependsOn\" d)))","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:3287"}},{"Del":{"text":" cdx_deps);","pos":"JZCYTJ4CZ3QFLX5BVKXCUN63EHTGNUEX4FDFA4LLGSSRRVZ3GRLQC:3305"}},{"Del":{"text":"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:5030"}}]}},{"Replacement":{"inode":{"change":5,"pos":19},"path":"elpe/test/test_elpe.ml","line":124,"ins":{"up_context":[{"change":5,"pos":6639}],"down_context":[{"change":5,"pos":6827}],"flag":"BLOCK","start":2126,"end":2228,"inode":{"change":5,"pos":19}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":6639},"to":{"change":5,"start":6639,"end":6827},"introduced_by":5}],"inode":{"change":5,"pos":19}},"ins_contents":[{"Add":{"text":" (* --- CycloneDX build doc parses; root dependsOn its 2 non-root nodes; purls","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2205"}},{"Add":{"text":" are pkg:elpe. *)","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2227"}}],"del_contents":[{"Del":{"text":" (* --- documents parse; DEPENDS_ON edges = root→2 non-root nodes; purls are pkg:elpe. *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:6731"}},{"Del":{"text":" let spdx = S.spdx_of_build ~target:\"x86_64-unknown-linux-gnu\" ~roots:[ root ] ~closure () in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:6826"}}]}},{"Replacement":{"inode":{"change":5,"pos":19},"path":"elpe/test/test_elpe.ml","line":127,"ins":{"up_context":[{"change":5,"pos":6926}],"down_context":[{"change":5,"pos":7011}],"flag":"BLOCK","start":2229,"end":2273,"inode":{"change":5,"pos":19}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":6926},"to":{"change":5,"start":6926,"end":7011},"introduced_by":5}],"inode":{"change":5,"pos":19}},"ins_contents":[{"Add":{"text":" let jcdx = Yojson.Safe.from_string cdx in","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2272"}}],"del_contents":[{"Del":{"text":" let jspdx = Yojson.Safe.from_string spdx and jcdx = Yojson.Safe.from_string cdx in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:7010"}}]}},{"Edit":{"inode":{"change":5,"pos":19},"path":"elpe/test/test_elpe.ml","line":129,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":7061},"to":{"change":5,"start":7061,"end":7451},"introduced_by":5}],"inode":{"change":5,"pos":19}}},"contents":[{"Del":{"text":" let rels = Yojson.Safe.Util.to_list (member \"relationships\" jspdx) in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:7132"}},{"Del":{"text":" let rtype r = Yojson.Safe.Util.to_string (member \"relationshipType\" r) in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:7208"}},{"Del":{"text":" let depends = List.filter (fun r -> rtype r = \"DEPENDS_ON\") rels in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:7278"}},{"Del":{"text":" let describes = List.filter (fun r -> rtype r = \"DESCRIBES\") rels in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:7349"}},{"Del":{"text":" check \"1 DESCRIBES\" (List.length describes = 1);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:7400"}},{"Del":{"text":" check \"2 DEPENDS_ON\" (List.length depends = 2);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:7450"}}]}},{"Replacement":{"inode":{"change":5,"pos":19},"path":"elpe/test/test_elpe.ml","line":184,"ins":{"up_context":[{"change":5,"pos":9984}],"down_context":[{"change":5,"pos":10101}],"flag":"BLOCK","start":2274,"end":2436,"inode":{"change":5,"pos":19}},"del":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":9984},"to":{"change":5,"start":9984,"end":10101},"introduced_by":5}],"inode":{"change":5,"pos":19}},"ins_contents":[{"Add":{"text":" (* end to end: a build over one deb node keeps its pkg:elpe identity as the","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2351"}},{"Add":{"text":" component purl and forwards the deb source PURL as an elpe:source property. *)","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2435"}}],"del_contents":[{"Del":{"text":" (* end to end: a build over one deb node forwards BOTH purls in SPDX and the","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10062"}},{"Del":{"text":" source property in CycloneDX. *)","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10100"}}]}},{"Edit":{"inode":{"change":5,"pos":19},"path":"elpe/test/test_elpe.ml","line":189,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":10230},"to":{"change":5,"start":10230,"end":10365},"introduced_by":5}],"inode":{"change":5,"pos":19}}},"contents":[{"Del":{"text":" let spdx = S.spdx_of_build ~upstream:resolve ~target ~roots:[ root ] ~closure:[] () in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10318"}},{"Del":{"text":" let jspdx = Yojson.Safe.from_string spdx in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10364"}}]}},{"Edit":{"inode":{"change":5,"pos":19},"path":"elpe/test/test_elpe.ml","line":190,"atom":{"EdgeMap":{"edges":[{"previous":"BLOCK","flag":"BLOCK | DELETED","from":{"change":5,"pos":10415},"to":{"change":5,"start":10415,"end":11019},"introduced_by":5}],"inode":{"change":5,"pos":19}}},"contents":[{"Del":{"text":" let pkg0 =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10427"}},{"Del":{"text":" List.hd (Yojson.Safe.Util.to_list (member \"packages\" jspdx))","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10492"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10497"}},{"Del":{"text":" let refs = Yojson.Safe.Util.to_list (member \"externalRefs\" pkg0) in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10567"}},{"Del":{"text":" let locators =","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10584"}},{"Del":{"text":" List.map (fun r -> Yojson.Safe.Util.to_string (member \"referenceLocator\" r)) refs","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10670"}},{"Del":{"text":" in","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10675"}},{"Del":{"text":" check \"spdx node has 2 purls (elpe + deb)\" (List.length locators = 2);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10748"}},{"Del":{"text":" check \"spdx forwards deb purl\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10781"}},{"Del":{"text":" (List.exists (fun l -> l = \"pkg:deb/ubuntu/zlib1g@1.3.1?arch=amd64&distro=ubuntu-plucky\") locators);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10886"}},{"Del":{"text":" check \"spdx keeps elpe purl\"","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10917"}},{"Del":{"text":" (List.exists (fun l ->","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:10944"}},{"Del":{"text":" String.length l >= 9 && String.sub l 0 9 = \"pkg:elpe/\") locators);","pos":"WLGN2XYIIDGFB2RUD7WX6J5RFK2DS37HLV2WIGS64P5G4L6BNIQQC:11018"}}]}},{"Edit":{"inode":{"change":5,"pos":19},"path":"elpe/test/test_elpe.ml","line":193,"atom":{"NewVertex":{"up_context":[{"change":5,"pos":11235}],"down_context":[{"change":5,"pos":11235}],"flag":"BLOCK","start":2437,"end":2605,"inode":{"change":5,"pos":19}}},"contents":[{"Add":{"text":" check \"cdx component purl is pkg:elpe\"","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2477"}},{"Add":{"text":" (let p = Yojson.Safe.Util.to_string (member \"purl\" comp0) in","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2542"}},{"Add":{"text":" String.length p >= 9 && String.sub p 0 9 = \"pkg:elpe/\");","pos":"JBUPSWE3FK4J6KOFZVURAIHX4BHLFR5C5UX36QXLBW4CUPLUB2MAC:2604"}}]}}],"owner":"pmeunier","repo":"elpe","token":"9uh8jidP3UOIvgtT7wUhKCs1ytXwWuALBkS6aHItUpc=","login":null}

…

Dependencies

Change contents

Review