The site tells a reader which SBOM format a regulation demands and never tells them which formats sbomify handles. /compliance/bsi-tr-03183/ states that BSI TR-03183-2 requires "CycloneDX v1.6 or later, OR SPDX v3.0.1 or later", and /compliance/schema-crosswalk/ maps fields across CycloneDX 1.7, SPDX 2.3 and SPDX 3.0. Neither answers the next question a reader has, which is whether sbomify can take their document.
There is no supported-formats page anywhere in content/.
This matters most for SPDX 3, where the honest answer has three parts that differ from each other: which versions sbomify ingests, which it scores correctly, and which the CI/CD action can write. The action's README has the same problem and is being corrected in sbomify/sbomify-action#333.
Gated on capability. Do not write this until epic sbomify/sbomify#1324 clears Phase 0. Today a spec-conformant SPDX 3.0.1 document scores worse on NTIA and BSI than a malformed one, so any support claim would be wrong in the direction that matters.
Work
A supported-formats page under content/ stating, per format and version, what sbomify does. Read, score and write are different columns and should look different.
Facts the page has to get right, all verified during the epic research:
- SPDX 2.2, 2.2.1 and 2.3, and CycloneDX 1.4 through 1.7, are the everyday path.
- SPDX 3.0 and 3.0.1 are JSON-LD only. SPDX dropped tag-value, YAML and RDF/XML in 3.0 and 3.1-RC1 adds none back.
- SPDX 3.1 is a release candidate. sbomify rejects it deliberately.
- ISO/IEC 5962:2021 encodes SPDX 2.2.1, not 3.x, and sits at stage 90.92. SPDX 3.0 is an OMG formal specification, formal/24-11-01. A reader who needs to cite a standard needs that distinction, and marketing must not call SPDX 3 an ISO standard.
Acceptance
The site tells a reader which SBOM format a regulation demands and never tells them which formats sbomify handles.
/compliance/bsi-tr-03183/states that BSI TR-03183-2 requires "CycloneDX v1.6 or later, OR SPDX v3.0.1 or later", and/compliance/schema-crosswalk/maps fields across CycloneDX 1.7, SPDX 2.3 and SPDX 3.0. Neither answers the next question a reader has, which is whether sbomify can take their document.There is no supported-formats page anywhere in
content/.This matters most for SPDX 3, where the honest answer has three parts that differ from each other: which versions sbomify ingests, which it scores correctly, and which the CI/CD action can write. The action's README has the same problem and is being corrected in sbomify/sbomify-action#333.
Gated on capability. Do not write this until epic sbomify/sbomify#1324 clears Phase 0. Today a spec-conformant SPDX 3.0.1 document scores worse on NTIA and BSI than a malformed one, so any support claim would be wrong in the direction that matters.
Work
A supported-formats page under
content/stating, per format and version, what sbomify does. Read, score and write are different columns and should look different.Facts the page has to get right, all verified during the epic research:
Acceptance
/compliance/bsi-tr-03183/and/compliance/schema-crosswalk/