A reusable license library that embeds the full SPDX license list (819 entries) and AboutCode license database (2862 entries). Provides functions to look up licenses by ID, check if a license is restrictive or free-for-use, and parse license expressions. The library is self-contained and can be extracted into any Go project needing license validation or classification.

Defines abstract interfaces (Document, Component, Spec, etc.) for SBOM parsing, with concrete implementations for CycloneDX (JSON), SPDX 2.x (JSON, tag-value), and SPDX 3.0 (JSON-LD). The interfaces decouple SBOM consumers from format specifics, enabling uniform scoring and compliance checking across all formats. Includes counterfeiter-generated fakes for testing. Could be extracted as a standalone SBOM parsing library.

A generic policy evaluation engine that processes YAML-defined rules (required fields, whitelist/blacklist values, patterns) against SBOM documents and components. Supports multiple rule types, actions (fail/warn/pass), and operators. The engine uses extractors to pull field values from SBOMs and evaluates rules independently. This pattern is reusable for any structured data validation beyond SBOMs.

Contains per-feature scoring extractors that evaluate a single SBOM quality dimension (e.g., component version presence, source code URI, checksum strength, license coverage). Each extractor is a pure function with a consistent signature, returning a Score struct with a 0–10 value and a human-readable description. This pattern enables easy addition of new scoring features and profiles without modifying existing logic. The extractors are reused by both the scoring engine and the compliance listing commands.