Lists the components that were added or removed between two SBOMs, and the components whose version, license or source changed.
Usage
sbom_diff(old, new)
# S3 method for class 'sbom_diff'
print(x, ...)
# S3 method for class 'sbom_diff'
as.data.frame(x, ...)Arguments
- old, new
<sbom>objects, as returned bysbom_package()orsbom_installed().- x
An
<sbom_diff>object.- ...
Ignored.
Value
sbom_diff() returns an <sbom_diff> object: a list whose
changes element is a data frame with one row per change and the columns
name, ecosystem, change ("added", "removed", "version",
"license" or "source"), old and new, sorted by name and change.
as.data.frame() returns that data frame, and print() returns its
argument invisibly.
Details
The two root components are paired with each other. Components of type
"file", embedded components and system components (ecosystems
"system", "deb" and "rpm") are matched by ref, all other
components by name. A "license" change compares the SPDX
expression, then the license as written. A "source" change compares the
package URLs without their versions, or the ecosystems when either
component has no package URL. R itself is compared like any other
component, so a change of R version shows up. Base packages have no
versions and appear only as added or removed.
Only what both SBOMs state is compared. A license that one of them does not
state at all, the license as written when only one states it, and an
ecosystem of "unknown" are not changes. Each format keeps a different
part of what sbom knows (an SPDX document has no field for the license as
written, and no format records sbom's own ecosystems, such as "local"),
so an SBOM compared with itself written in another format and read back
shows none. An SPDX expression on one side and only the license as written
on the other are the same license when license_spdx() translates the
one to the other.
Examples
desc <- system.file("DESCRIPTION", package = "sbom")
old <- sbom_package(desc, system = FALSE)
new <- sbom_package(desc, system = FALSE)
sbom_diff(old, new)
#> No differences.