Lesson 11 · supply

An SBOM is an evidence map

Validate both structure and relationships.

An SBOM records components, versions, identifiers and relationships in a particular artifact. Manifest dependency ranges and resolved lockfile entries are different evidence. Neither necessarily establishes every third-party license.

CycloneDX 1.5 JSON uses bom-ref identifiers and dependency references. SPDX 3.0.1 uses a graph serialization in JSON-LD, with creation information and typed relationships. A document labeled SPDX 3.0 that contains a 2.x package shape is not a valid 3.0.1 document.

Schema validation detects many structural errors. Semantic checks also matter: an identifier may be unique in shape yet point to nothing, or a valid document may omit a required shipped component.

The gym validates against pinned official schemas offline, then checks graph references and the supplied project inventory. A valid SBOM records evidence; it is not itself a legal clearance certificate.

Read the primary terms and guidance ↗

Try it: An SBOM with a ghost dependency

Repair bom.json so it describes the supplied project and has complete, unique references. The SBOM generator is available, but validate the result.

Before inspecting the result

What does this supplied release need before its modeled requirements are met?

Already meets the requirementsA concrete repairAdditional evidence or a license choice

Project boundary

2 components

Dependency relationships
From → to	Connection	Semantics
app → library	bundle	intimate

Supplied facts

Distribution: binary
Network interaction: No
Intended use: internal
Evaluation date: 2026-10-24
Policy: learning

These facts define the simulation. Evidence declarations stand in for actual corresponding source, relinkable objects and release materials.

Components

Inspect component

Declared license: LicenseRef-Proprietary
Modified files: None
Artifact: code

Third-party grants remain fixed unless this scenario supplies authority to change them.

Project artifacts

Format library 1.0.0

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
associated documentation files (the "Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial
portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.

Evidence artifact format

Source offers contain “component: id” and “source: https://…” on separate lines. Covered-file offers also list the covered paths. Relinking declarations contain “replace-compatible-library” for dynamic linking or “relink-object-files” for static linking, and “reverse-engineering-permitted”. These declarations model supplied release artifacts.

License reference

permissions: commercial-use, modifications, distribution, private-use
conditions: include-copyright, include-license
limitations: liability, warranty

Read authoritative terms ↗

Expression builder

SPDX expression

Each row is one selectable alternative. AND retains every term in a row.
Alternative	Required licenses
1	MIT AND LGPL-3.0-only
2	Apache-2.0 AND LGPL-3.0-only

Results appear after submission.