Graphs.jl Integration

[nsajko]

Each SPDX relationship seems to have a natural interpretation as the edge of a digraph (directed graph). Providing integration with the Graphs.jl package would be nice as it could make applying graph-theoretic tools to the SBOM very convenient.

Generating a representation for the SBOM in one of the usual graph formats like GML or GraphViz Dot would be nice. The representation could then be fed to an external program to visualize the SBOM as a digraph in 2D (using GraphViz) and 3D (using Graphia). Not completely sure, but I think you get GML and Dot export for free after integration with Graphs.jl.

[SamuraiAku]

@nsajko could you move this idea to SPDX.jl? That package implements the SPDX specification and is a better place for this concept. This package is focused on plumbing through Pkg and the registry to obtain the information to create the SBOM.

[nsajko]

Fine by me, but I think you're the only one who can move the issue.

[SamuraiAku]

Done

[SamuraiAku]

Some notes for anyone who wants to try this and I hope I’m getting the terminology right…

• The entire graph would describe an SpdxDocumentV2 object
• The nodes of the graph are objects of types
  • SpdxPackageV2
  • SpdxFileV2
  • SpdxSnippetV2
  • an SpdxDocumentV2 contains vectors of these objects in the properties Packages, Files, and Snippets
• the roots of the graph are documented in the property Relationships of the SpdxDocumentV2 object.
  • any relationship that in string form reads
  • SPDXRef-DOCUMENT DESCRIBES “objects SPDXID”
• the connections between nodes (edges?) are also described in the Relationships property
  • most typical is a relationship of the form
  • SPDXID_A DEPENDENCY_OF SPDXID_B
  • The SPDX spec has a rather large set of relationships including identical ones but with the direction reversed (A DEPENDENCY_OF B, B DEPENDS_ON A), but just focusing on just this one relationship to start takes care of a lot of the real world usage.

[SamuraiAku]

And when the SBOM is created in PkgToSoftwareBOM.jl any artifacts have the relationship: A RUNTIME_DEPENDENCY_OF B