What does the sbom validator produce?
Validate supported software bill of materials structure, identities and relationships.
Use the exact local files and task-specific inputs listed below. Preparation and review stay in this browser. Inspect all findings before preparing the finalized pack.
What do you need before you start?
- Define the authorized source population and your review rules.
- Keep the unchanged original files and record the snapshot and exclusions.
- Review missing and invalid inputs before preparing the finalized pack.
What information do you enter?
Select the actual local sources and freeze the task-specific inputs below. Keep source files and complete findings private.
- CycloneDX 1.6 or SPDX 2.3 JSON. Supported sbom source.
- Review reference. Customer-controlled review identifier.
- Responsible reviewer. Owner of the supplied facts and selected method.
- Observation date. Real YYYY-MM-DD date.
- Source and version scope. Name actual population, selected source versions and known omissions.
| Field | What to enter | Fictional example |
|---|---|---|
| Review referenceRequired | Customer-controlled review identifier. | |
| Responsible reviewerRequired | Owner of the supplied facts and selected method. | |
| Observation dateRequired | Real YYYY-MM-DD date. | 2026-10-09 |
| Source and version scopeRequired | Name actual population, selected source versions and known omissions. |
What you can download
Every result must identify its supplied facts, assumptions and unresolved items.
| Free result | Included downloads |
|---|---|
Enter your information, inspect the on-screen result and keep a browser backup. Editing and direct copies of your entered information stay free. |
These supported outputs are free. No checkout is required. |
Fictional review report (PDF). Editable review (DOCX). Complete fictional pack (ZIP). Requires tailoring and responsible review. Samples use the finalized renderer.
How does the sbom validator work?
- 1Select the actual sources
CycloneDX 1.6 or SPDX 2.3 JSON. Supported sbom source.
- 2Freeze the review rules
Validate actual JSON against the frozen official CycloneDX 1.6 or SPDX 2.3 schema. Separately inspect duplicate element references, unresolved dependency or relationship references, package version identity, document metadata and source paths. External document references remain explicit and unverified. Schema validity does not establish inventory completeness or component authenticity.
- 3Inspect complete findings
Review all source-linked results and unresolved items. Free JSON and CSV preserve complete results.
- 4Keep recoverable work
Original files and exact input strings save in this browser. Restore validates identity, schema and actual file hashes before replacing current work. Earlier browser work and historical purchases remain separate.
- 5Prepare the finalized pack
Prepare seven core files and the exact selected attachments, then download them free. Review the fictional sample below.
Method and sources
Apply the steps above to the supported inputs. Use the listed source sections to review the rule basis, assumptions and limits.
- Common Format and MIME Type for CSV FilesSupports CSV interchange only. It specifies no approved domain population, legal criterion or task decision. Sections 2 and 3 describe comma-separated fields, escaping, headers and the text/csv media type.RFC Editor. Reviewed 2026-10-09.
- CycloneDX 1.6 JSON schemaSupports CycloneDX 1.6 structure only. No inventory completeness, authenticity or vulnerability conclusion is inferred. The official CycloneDX 1.6 schema and its local SPDX and signature schema dependencies are frozen with original source URLs and SHA-256 hashes. Required fields, enumerations and nested structures are checked.OWASP CycloneDX. Reviewed 2026-10-09.
- SPDX 2.3 JSON schemaSupports SPDX 2.3 structure only. External document identity, component authenticity and population completeness remain unverified. The official SPDX 2.3 JSON schema is frozen locally with its original source URL and SHA-256. Required document, package, file and relationship fields retain their supported schema constraints.SPDX. Reviewed 2026-10-09.
Common questions
What information does the sbom validator need?
Enter cycloneDX 1.6 or SPDX 2.3 JSON. Supported sbom source; review reference. Customer-controlled review identifier; responsible reviewer. Owner of the supplied facts and selected method; observation date. Real YYYY-MM-DD date; source and version scope. Name actual population, selected source versions and known omissions. Define the authorized source population and your review rules.
What does the sbom validator produce?
Complete source-linked findings, exact parsed source index and named working tables. Seven formal/data core files plus one exact original. PDF, DOCX, Excel, CSV, JSON, file hashes and instructions use the shared formal renderer. Integrity-checked browser backup, exact-byte restore and separately preserved earlier forms, files and historical purchases. Review unresolved findings and limitations before use.
Who makes the final decision?
A responsible person reviews the result. Working results use exact local sources and explicitly selected versions. Originals remain unchanged in this browser. No source authenticity, population completeness, vulnerability exploitability, legal applicability, license conclusion, consent validity, food safety or external submission is established.
Is this tool free?
Yes. The on-screen result and listed downloads are free. No checkout is required. Keep local backups and review the stated method and limits.
Can I use the sbom validator for this task?
Check required fields, identifiers and structural consistency. Working results use exact local sources and explicitly selected versions. Originals remain unchanged in this browser. No source authenticity, population completeness, vulnerability exploitability, legal applicability, license conclusion, consent validity, food safety or external submission is established.
What still needs review?
Working results use exact local sources and explicitly selected versions. Originals remain unchanged in this browser. No source authenticity, population completeness, vulnerability exploitability, legal applicability, license conclusion, consent validity, food safety or external submission is established.
Each source supports at most 10 MB. Table sources support 5000 rows, 50 fields, 100000 cells and 5000000 parsed characters. JSON documents support depth 40 and 100000 nodes.
Working artifacts are produced only when their required named checks pass. Complete findings remain available even when an artifact is withheld.