The SBOM validator now reads SPDX 3 tool information, SPDX 3 dependency relationships and nested CycloneDX components. Some correct SBOMs got a wrong verdict before. Re-run your documents to see the corrected results.
The same fixes apply to the free SBOM validator and to the SBOM conformance report in your dashboard.
SPDX 3 tool name and version
An SPDX 3 document names the tool that made it through CreationInfo.createdUsing. That field points to Tool elements in the @graph. Before, the validator read only the SPDX 2 creators list, so the tool name of every SPDX 3 document was "absent".
The validator now follows createdUsing to the Tool elements and reads their names. It reads only the CreationInfo of the SBOM itself, on the software_Sbom or SpdxDocument element. A package can carry its own CreationInfo that names a different tool.
An SPDX 3 Tool has no version property. When the tool name has the form "name-version", the validator reads the version from it and reports the field as "partial", not "present".
Emanuele Parrinello (ARIANNA) reported this defect. Thank you for the report.
SPDX 3 dependency coverage
The CISA Coverage check now reads SPDX 3 dependsOn and contains relationships, and the SPDX 2 DEPENDENCY_OF and CONTAINED_BY relationships. Before, every SPDX 3 document got "no dependency relationships".
When a document declares no root, the check now starts from the components that nothing depends on. A file inside a package no longer counts as a transitive dependency.
Nested CycloneDX components
CycloneDX lets a component hold its own list of components. Before, the platform read only the top-level list. Uploaded SBOMs now store the nested components and check them for known vulnerabilities. The validator counts them too, so a dependency on a nested component no longer gives a false "does not meet" in the CRA check.
Where to find it: Settings, then SBOM Registry.
Stricter BSI TR-03183-2 checks
- Hash. The hash check now accepts only SHA-512, as TR-03183-2 requires.
- Creator. A tool alone no longer satisfies the SBOM creator field. The CISA author check already applied this rule.
- SPDX 3 components. The SPDX 3 component row is now "not assessed" and leaves the count. Before, it counted as passed.
What has not changed
The CycloneDX top-level checks and the SPDX 2 checks give the same results as before, except where a fix above applies. The CISA and BSI guidance the validator checks against is not EU law and is not a CRA obligation.