Package io.quarkus.sbom

Class ComponentDescriptor

java.lang.Object
io.quarkus.sbom.ComponentDescriptor
Direct Known Subclasses:
ComponentDescriptor.Builder
public class ComponentDescriptor extends Object
A generic, ecosystem-agnostic descriptor for software components intended for SBOM contributions.

Component identity is represented by a Purl (Package URL), which encapsulates the ecosystem type, namespace, name, and version. Each component has a bomRef that uniquely identifies it within the SBOM (defaults to the PURL string).

Additional metadata includes:

  • Integrity hash: SRI-format hash from lock files for verification
  • Scope: runtime or development dependency classification
  • Description: human-readable component description
  • Licenses: one or more LicenseInfo entries describing applicable licenses

Dependencies are not stored on the component itself. Use ComponentDependencies to represent the dependency graph separately, referencing components by their bom-ref.

This class follows the builder pattern. Instances are immutable and constructed via the ComponentDescriptor.Builder.

  • Field Details

  • Method Details

    • builder

      public static ComponentDescriptor.Builder builder()
      Creates a new builder for constructing a ComponentDescriptor.
      Returns:
      a new builder instance

    • getPurl

      public Purl getPurl()
      Gets the Package URL identifying this component.
      Returns:
      the Package URL

    • getBomRef

      public String getBomRef()
      Gets the bom-ref that uniquely identifies this component within the SBOM. Defaults to the PURL string.
      Returns:
      the bom-ref

    • getType

      public String getType()
      Gets the package type (PURL type field).

      Examples: "npm", "pypi", "maven", "cargo"

      Returns:
      the package type

    • getNamespace

      public String getNamespace()
      Gets the namespace (PURL namespace field).

      For npm, this is the scope (e.g., "@babel"). For Maven, this is the groupId.

      Returns:
      the package namespace, or null

    • getName

      public String getName()
      Gets the package name.
      Returns:
      the package name

    • getVersion

      public String getVersion()
      Gets the resolved version.
      Returns:
      the package version, or null if not resolved

    • getIntegrity

      public String getIntegrity()
      Gets the integrity hash.

      This is typically an SRI hash from lock files (e.g., "sha512-abc123...").

      Returns:
      the SRI hash, or null

    • getDescription

      public String getDescription()
      Gets the package description.
      Returns:
      a human-readable description, or null

    • getScope

      public String getScope()
      Gets the dependency scope.

      Common values are SCOPE_RUNTIME and SCOPE_DEVELOPMENT.

      Returns:
      the dependency scope, or null

    • getPath

      public Path getPath()
      Gets the file system path to the component artifact.
      Returns:
      the file path, or null

    • getDistributionPath

      public String getDistributionPath()
      Gets the distribution path (relative location within the application distribution).
      Returns:
      the distribution path, or null

    • getPedigree

      public String getPedigree()
      Gets the pedigree notes describing component modifications.
      Returns:
      the pedigree notes, or null

    • isTopLevel

      public boolean isTopLevel()
      Returns whether this component is a top-level (direct) dependency of the main application component.

      Top-level components appear as direct dependency edges from the main application component in the generated SBOM. Components that are transitive dependencies should not be marked as top-level.

      Returns:
      true if this is a top-level dependency

    • getLicenses

      public List<LicenseInfo> getLicenses()
      Gets the licenses associated with this component.
      Returns:
      an unmodifiable list of license information entries, empty if none

    • getComponents

      public List<ComponentDescriptor> getComponents()
      Gets nested (bundled) components contained within this component.

      These represent artifacts that have been shaded or bundled into this component's JAR, detected by the presence of additional META-INF/maven/.../pom.properties entries.

      Returns:
      an unmodifiable list of nested component descriptors, empty if none

    • ensureImmutable

      protected ComponentDescriptor ensureImmutable()