Skip to content

Conversation

@tdruez
Copy link
Contributor

@tdruez tdruez commented Sep 2, 2025

Changes

This PR introduces a new benchmark_purls pipeline. See TODO: docref

Documentation: checking an SBOM against a list of expected PURLs:

Create a new project:

  • Provide 2 inputs:
    • SBOM you want to check
    • The list of expected PURLs as a filename-purls.txt file including 1 PURL per line.
      (You may also flag any filename using the "purls" input tag)
  • Select the load_sbom pipeline and run it
  • Run the benchmark_purls pipeline
  • Download the results from the "output" section

About the results:

  • Lines starting with '-' are missing from the project.
  • Lines starting with '+' are unexpected in the project.

Notes:

  • You can provide multiple expected PURLs files.
  • The load_sbom is presented as an example to benchmark external tools using SBOM to load the data.
    You are welcome to run this pipeline directly after any SCIO pipeline to validate the discovered PURLs.

Signed-off-by: tdruez <tdruez@nexb.com>
@pombredanne
Copy link
Member

This works beautifully. I tried using the alpine CDX SBOM from @chinyeungli
scancodeio_alpine_3.22.1_results-2025-09-02-10-15-59.cdx.json

and a modified PURLs as attached
alpine-3.22.1-less-.txt

and I get this correct diff result:
benchmark_purls-2025-09-02-12-48-34.txt

Signed-off-by: tdruez <tdruez@nexb.com>
Signed-off-by: tdruez <tdruez@nexb.com>
@tdruez tdruez merged commit ba53d70 into main Sep 2, 2025
14 of 18 checks passed
@tdruez tdruez deleted the 1804-purl-benchmark branch September 2, 2025 15:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants