Import software stacks from CycloneDX and SPDX SBOMs #3

Closed

nsaspy wants to merge 1 commit from feat/sbom-stack-import into master

nsaspy commented

2026-09-09 15:55:19 +00:00

Owner

Summary

import CycloneDX 1.x and SPDX 2.x JSON directly into named software stacks
normalize supplier, package, version, PURL, and CPE identifiers
support nested CycloneDX components and SPDX external references
merge inventories by default or replace them authoritatively
add package-name and CPE-product Tek9 indexes with one-time 0.3 upgrade migration
reconcile associated alerts immediately after an SBOM refresh
add CPE-only CVE matching, documentation, and regression tests
bump CVE Hunt to 0.4.0

Validation

local and published Git trees match exactly at 56ef131e...
static Lisp form balance passed across all 22 Lisp files
full SBCL/LMDB, HTTP load, executable smoke, and Nix validation run in PR CI

## Summary - import CycloneDX 1.x and SPDX 2.x JSON directly into named software stacks - normalize supplier, package, version, PURL, and CPE identifiers - support nested CycloneDX components and SPDX external references - merge inventories by default or replace them authoritatively - add package-name and CPE-product Tek9 indexes with one-time 0.3 upgrade migration - reconcile associated alerts immediately after an SBOM refresh - add CPE-only CVE matching, documentation, and regression tests - bump CVE Hunt to 0.4.0 ## Validation - local and published Git trees match exactly at `56ef131e...` - static Lisp form balance passed across all 22 Lisp files - full SBCL/LMDB, HTTP load, executable smoke, and Nix validation run in PR CI

nsaspy added 1 commit

2026-09-09 15:55:19 +00:00