Ada ALIRE SBOM Support

[squinky86]

Description

I’ve implemented native ALIRE dependency inventory and CycloneDX/SPDX SBOM support for filesystem and repository scans, with tests and documentation. Vulnerability matching is outside this contribution’s scope. The implementation is available in squinky86/trivalire Would you welcome a PR? I’d particularly appreciate feedback on package identity and incomplete-inventory handling.

Of additional information, this is what I was working on when I emailed @knqyf263 and opened the security triage discussions.

Target

Filesystem

Scanner

License