[suyash-jai]

Summary

Installs cargo-cyclonedx 0.5.9 in the zfs build environment, next to cargo-bundle-licenses. It is a cargo plugin that lists the Rust crates compiled into a program.

delphix/zfs#2439 uses it to add the Rust crates to the zfs package SBOMs: zfsutils-linux goes from 0 to 471 crates, and libzfslinux-dev gets 440. That PR explains why this tool was chosen over two other approaches, and has the testing, the comparison with the CSV and the Mend results.

Merge order

1. This PR first. On its own it only installs the tool and changes nothing else.
2. delphix/zfs#2439 next. Its build runs cargo cyclonedx, so it fails without this PR.
3. The crates show up in the package SBOMs once DLPX-100122 Catalog npm lock files and embedded CycloneDX documents in package SBOMs #422 is also merged, since DLPX-100122 Catalog npm lock files and embedded CycloneDX documents in package SBOMs #422 makes the SBOM scan read the files zfs writes.

Testing

Pre-push #15842 and #15845, with this PR, #422 and delphix/zfs#2439: the zfs build succeeded both times. Installing cargo-cyclonedx adds about 3 minutes to the zfs build.

Related

Jira: DLPX-100304, sub-task of DLPX-100124 (epic CP-13455).

🤖 Generated with Claude Code