SBOM examples

Real software bills of materials produced by Provenant, one directory per target. Each target directory contains an SPDX tag-value document (sbom.spdx) and a CycloneDX JSON document (sbom.cdx.json), plus a short provenance README.

These examples are generated by Provenant 1.0.5 (the current build) scanning each project at a pinned commit with license, package, and copyright detection enabled. Every SBOM is a complete, closed inventory: each resolved dependency is promoted to a component with a package URL, and every dependency relationship resolves within the document.

Targets

Target	Ecosystem	Release	Pinned commit
ripgrep	Rust / Cargo	15.2.0	e89fff89ac9af12e8d4ce9d5fd07beb408ca730f
express	JavaScript / npm	v5.2.1	dbac741a49a5a64336b70c06e85c2e2706e36336
flask	Python / PyPI	3.1.3	22d924701a6ae2e4cd01e9a15bbaf3946094af65
tokio	Rust / Cargo workspace	tokio-1.53.1	75fef53d0a8590c2d1dbb63672aa7b7d1ef51155

Verification

Every target was compared against ScanCode with the compare-outputs xtask before being included here. None carry a medium-or-major regression (a real missing license or copyright, garbled detections, scan errors, or materially wrong package inventory); the remaining differences are benign (ScanCode noise, unknown-license-reference placeholders, or Provenant's cleaner source-faithful rendering).

Regeneration

These are illustrative artifacts, not golden fixtures, so they are refreshed on demand rather than drift-checked on every change. Regenerate all of them — pinned checkout, scan, and documents — with a single command:

cargo run --manifest-path xtask/Cargo.toml --bin generate-sbom-examples

Refresh them when cutting a release, when a detection or output change is worth showcasing, or when adding a target (edit the TARGETS list in xtask/src/bin/generate_sbom_examples.rs).