feat(sbom): read CycloneDX and SPDX bills of materials - #1165

Merged

AlexKantor87 merged 10 commits into

mainfrom

claude/1162-sbom-reader

Sep 11, 2026

Commits on Sep 11, 2026

feat(sbom): read CycloneDX and SPDX bills of materials
AlexKantor87
committed
24deac8
fix(sbom): narrow the panic guard and validate what the server will reject
AlexKantor87
committed
79570ab
fix(sbom): normalise null elements for every SPDX version
AlexKantor87
committed
349e781
fix(sbom): match the server's date-time rule rather than Go's stricter one
AlexKantor87
committed
a77e649
fix(sbom): judge timestamps as the server's validator judges them
AlexKantor87
committed
441ad08
fix(sbom): make the null-relationship test exercise the path it names
AlexKantor87
committed
b457a0e
fix(sbom): check the digest against the rule the server actually enforces
AlexKantor87
committed
87d5ec4
fix(sbom): let both SPDX probes see the same stripped bytes
AlexKantor87
committed
89e8bd6
fix(sbom): cover the tag-value subject path and accept single-quoted YAML
AlexKantor87
committed
fafb6ed
test(sbom): assert extraction through the CycloneDX XML reader
AlexKantor87
committed
9678b66