Fix SBOM SPDX references

[MikeMcQuaid]

Fixes #22467

• Ensure SBOM relationships point at SPDX IDs emitted in the document
• Preserve API patch metadata so patch relationships survive API loads
• Cover patch packages and API-loaded patch regression cases

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR.

OpenAI Codex 5.5 xhigh with local review and testing.

---

[Copilot]

Pull request overview

This PR fixes Homebrew’s SPDX SBOM output to ensure all relationship references point to SPDX IDs that actually exist in the document, and restores patch metadata when formulae are loaded from the API so patch-related SBOM entries aren’t lost.

Changes:

• Fix SBOM relationship targets to reference emitted SPDX package/file IDs (e.g., source archive vs. bottle, archive vs. non-existent package-src IDs).
• Emit external patches as SPDX packages (with download location and checksum) and add a source-archive file entry when a checksum is available.
• Preserve and reload stable patch metadata through the API formula struct path, with regression tests for API-loaded patches.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Library/Homebrew/sbom.rb	Align relationship IDs with emitted packages/files; add patch packages and optional source file entry; centralize “described” package ID logic.
Library/Homebrew/formulary.rb	Rehydrate stable patches when instantiating formulae from API structs.
Library/Homebrew/api/formula/formula_struct_generator.rb	Preserve stable patch metadata (stable_patches) when generating the formula struct hash.
Library/Homebrew/api/formula_struct.rb	Add stable_patches field to the API formula struct.
Library/Homebrew/test/sbom_spec.rb	Add tests ensuring relationships reference defined SPDX IDs and that external patches are emitted as packages.
Library/Homebrew/test/formulary_spec.rb	Add regression test asserting patches load from API JSON.
Library/Homebrew/test/api/formula/formula_struct_generator_spec.rb	Add test ensuring stable patches are preserved in generated struct hashes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-code-quality]

Code Coverage Overview

Languages: Ruby

Ruby / code-coverage/simplecov

The overall coverage in the fix-sbom-spdx-refs branch remains at 78%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main 23e5f86	fix-sbom-spdx-refs 28c37d3	+/-
formulary.rb	93%	92%	-1%
download_queue.rb	74%	73%	-1%
dependency.rb	91%	90%	-1%
sbom.rb	93%	93%	0%
api/formula/for...ct_generator.rb	93%	93%	0%
api/formula_struct.rb	99%	99%	0%
downloadable.rb	94%	95%	+1%

---

_{Updated May 30, 2026 14:14 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}