Declared dependency topology of 78,612 real-world SBOMs: full per-document dataset and analysis output

Per-document measures of the **declared** dependency graph for all 78,612 SBOM files of theWild SBOMs dataset (77,092 parseable), plus the outputs of every analysis reported in theaccompanying paper. The primary corpus is **not redistributed**. We ship the SHA-256 of the archive we scanned(`PROVENANCE-SHA256.md`) together with the derived measures, so that any reader can confirm themeasures were computed over the published corpus without us republishing it. **Contents.** One row per parseable document with 36 measures (order, size, edge count, edgedensity, connected components, orphan counts under **three distinct measurands**, declaredcompleteness, ecosystem mixture, field-coverage indicators, format, generator, status);the full list of 408,087 distinct `(purl, version)` pairs; a catalogue-to-package table withversion ranges; the breakdown of the 1,520 parse failures by source format; the eleven image-scandocuments; and the analysis outputs. **Three items included for reproducibility, not completeness.** (1) `generator_taxonomy.json` —the ordered regular-expression rules that map 321 distinct `creator` strings onto 14 generatorfamilies, with document counts. The η² figures in the paper are computed over families, andfamily is not a field in the data: without these rules those figures cannot be reproduced.(2) `measurands_and_instrument.json` — column-level definitions of **all three** orphan measurands,two of which are computed on different graphs and must not be collapsed, together with their measureddivergence. (3) The same file records instrument versions: scanner commit, `networkx` and Pythonversions, the degeneracy threshold, and the binning convention for `orphan_pct` without which thepublished histogram does not reproduce. **Derivation and licence.** Derived from Wild SBOMs (Soeiro, Robert & Zacchiroli, 2025,DOI 10.5281/zenodo.14250103), licensed CC-BY-4.0. Share-alike does not propagate; this record isreleased under CC-BY-4.0. Per that licence we attribute the source corpus to its authors and stateexplicitly that these records are **derived and modified**: of the primary corpus they contain nodocuments, only measures computed over them. The eleven image-scan documents included in the recordare **our own artifacts**, not part of Wild SBOMs, and are released in full. A `MANIFEST.json` gives SHA-256 for every item.