BOM family census
What SBOMFlow's own readers and writers do with each field of a BOM, measured on a pinned synthetic fixture by running the real reader or writer over it. Every number below is a count out of the fields that fixture carries. A row says what happened to that fixture; it is not a statement that a format is supported, complete or interoperable, and a field another document carries may fare differently.
How a field is classified#
The reader or writer runs once over the whole fixture, then once more for each field with that field removed. A field is a key of the document's root object; a root object or array of objects is replaced by its child keys (metadata.supplier, components[].hashes), and the elements of an SPDX 3 @graph are grouped by type (@graph[type=ai_AIPackage].ai_domain).
| Class | Measured as |
|---|---|
preserved | every one of its values appears, as a whole string, in the output |
transformed | removing the field changes the output, but its values are not carried as written (resolved, normalised, reduced to a count, or used to decide something) |
unsupported | not carried, and a warning the reader raised for this document names it (for a writer: it reaches the output only inside an sbomflow: extension property, or the writer's published information-loss table names it) |
lost | not carried, and nothing names it |
A value is searched for only when it is a string of at least 3 characters, and each fixture gives every field a distinct value so one field cannot be credited with another's. The output a reader is judged on is what it hands the engine (components, dependency edges, import-quality counts, declared cryptography, AI entities); a field it carries can still be dropped later, which this census does not follow.
Summary#
| Family | Direction | Format | Engine path | Fixture | Status | Fields | Preserved | Transformed | Unsupported | Lost | Loss report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| sbom | import | CycloneDX 1.x JSON | --import-sbom: CycloneDX 1.x JSON | cyclonedx-1.6-sbom.json | measured | 27 | 6 of 27 | 7 of 27 | 8 of 27 | 6 of 27 | emitted |
| sbom | import | CycloneDX 1.x JSON | --import-sbom: CycloneDX 1.x JSON | cyclonedx-1.7-sbom.json | measured | 20 | 6 of 20 | 7 of 20 | 3 of 20 | 4 of 20 | emitted |
| crypto | import | CycloneDX 1.x JSON | --import-sbom: CycloneDX 1.x JSON | cyclonedx-1.6-cbom.json | measured | 7 | 4 of 7 | 2 of 7 | 0 of 7 | 1 of 7 | emitted |
| ml-bom | import | CycloneDX 1.x JSON | --import-sbom: CycloneDX 1.x JSON | cyclonedx-1.6-mlbom.json | measured | 13 | 6 of 13 | 3 of 13 | 2 of 13 | 2 of 13 | emitted |
| sbom | import | SPDX 2.x JSON | --import-sbom: SPDX 2.x JSON | spdx-2.3-sbom.json | measured | 29 | 1 of 29 | 8 of 29 | 0 of 29 | 20 of 29 | not emitted |
| sbom | import | SPDX 2.2/2.3 tag-value (*.spdx) | --import-sbom: SPDX 2.2/2.3 tag-value (*.spdx) | spdx-2.3-sbom.spdx | measured | 19 | 3 of 19 | 3 of 19 | 0 of 19 | 13 of 19 | not emitted |
| sbom | import | SPDX 3.0.1 JSON-LD | --import-sbom: SPDX 3.0.1 JSON-LD | spdx-3.0.1-software.json | measured | 37 | 4 of 37 | 9 of 37 | 0 of 37 | 24 of 37 | not emitted |
| ai-bom | import | SPDX 3.0.1 JSON-LD | --import-sbom: SPDX 3.0.1 JSON-LD | spdx-3.0.1-ai.json | measured | 26 | 0 of 26 | 1 of 26 | 12 of 26 | 13 of 26 | not emitted |
| dataset | import | SPDX 3.0.1 JSON-LD | --import-sbom: SPDX 3.0.1 JSON-LD | spdx-3.0.1-dataset.json | measured | 24 | 0 of 24 | 1 of 24 | 10 of 24 | 13 of 24 | not emitted |
| sbom | import | SBOMFlow custom manifest | --import-custom-manifest: SBOMFlow custom manifest | custom-manifest.json | measured | 19 | 8 of 19 | 5 of 19 | 0 of 19 | 6 of 19 | not emitted |
| ml-bom | import | cyclonedx_mlbom | supplier AI-BOM ingest: cyclonedx_mlbom | cyclonedx-1.6-mlbom.json | measured | 13 | 2 of 13 | 4 of 13 | 1 of 13 | 6 of 13 | not emitted |
| ai-bom | import | spdx3_ai_profile | supplier AI-BOM ingest: spdx3_ai_profile | spdx-3.0.1-ai.json | measured | 26 | 1 of 26 | 2 of 26 | 1 of 26 | 22 of 26 | not emitted |
| dataset | import | spdx3_ai_profile | supplier AI-BOM ingest: spdx3_ai_profile | spdx-3.0.1-dataset.json | measured | 24 | 1 of 24 | 2 of 24 | 0 of 24 | 21 of 24 | not emitted |
| firmware | import | yocto *.spdx.index.json | project scan (ingest_create_spdx) | — | unmeasured | — | — | — | — | — | — |
| firmware | import | yocto *.spdx.json | project scan (ingest_create_spdx, ingest_create_spdx3) | — | unmeasured | — | — | — | — | — | — |
| sbom | export | CycloneDX 1.6 (owasp.org/cyclonedx) | cyclonedx-sbom.json | software-export.json | measured | 22 | 9 of 22 | 4 of 22 | 5 of 22 | 4 of 22 | not emitted |
| vulnerability exchange | export | CycloneDX 1.6 VEX (opt-in: --emit-vex) | cyclonedx-vex.json | — | unmeasured | — | — | — | — | — | — |
| vulnerability exchange | export | CycloneDX 1.6 VDR (opt-in: --emit-vdr) | cyclonedx-vdr.json | — | unmeasured | — | — | — | — | — | — |
| sbom | export | SPDX 2.3 (spdx.dev) | spdx-sbom.json | software-export.json | measured | 22 | 8 of 22 | 5 of 22 | 0 of 22 | 9 of 22 | not emitted |
| sbom | export | SPDX 3.0.1 JSON-LD (opt-in: --emit-spdx3) | spdx3-sbom.json | software-export.json | measured | 22 | 8 of 22 | 4 of 22 | 0 of 22 | 10 of 22 | not emitted |
| ml-bom | export | CycloneDX 1.6 ML-BOM (opt-in: --emit-mlbom) | cyclonedx-mlbom.json | ai-export.json | measured | 33 | 28 of 33 | 0 of 33 | 5 of 33 | 0 of 33 | not emitted |
| ai-bom | export | SPDX 3.0.1 AI + Dataset profiles (opt-in: --emit-aibom) | spdx3-aibom.json | ai-export.json | measured | 33 | 22 of 33 | 1 of 33 | 10 of 33 | 0 of 33 | not emitted |
| scanner findings | export | SARIF 2.1.0, OASIS (opt-in: --emit-sarif) | findings.sarif | — | unmeasured | — | — | — | — | — | — |
| vulnerability exchange | export | CSAF 2.0, OASIS (written whenever VEX is emitted and a vulnerability is to be stated; audit always emits VEX) | csaf-vex.json | — | unmeasured | — | — | — | — | — | — |
| vulnerability exchange | export | OpenVEX 0.2.0 (written whenever VEX is emitted and a statement is to be made; audit always emits VEX) | vex.json | — | unmeasured | — | — | — | — | — | — |
| release notes | export | CycloneDX 1.7 release notes (opt-in: compare-releases --release-notes-format cyclonedx|both) | engineering-release-notes.cdx.json | — | unmeasured | — | — | — | — | — | — |
| agent-manifest | — | — | — | — | unmeasured | — | — | — | — | — | — |
18 of 27 rows are measured; the other 9 are unmeasured, which never means preserved.
Field by field#
sbom import: CycloneDX 1.x JSON (cyclonedx-1.6-sbom.json)#
Engine path: --import-sbom: CycloneDX 1.x JSON. Loss report: emitted.
- preserved (6 of 27):
components[].cpe,components[].hashes,components[].licenses,components[].supplier,components[].type,components[].version - transformed (7 of 27):
bomFormat,components[].bom-ref,components[].purl,dependencies[].dependsOn,dependencies[].ref,metadata.component,specVersion - unsupported (8 of 27):
components[].copyright,components[].description,components[].externalReferences,components[].properties,externalReferences[].type,externalReferences[].url,metadata.lifecycles,metadata.supplier - lost (6 of 27):
$schema,components[].name,metadata.timestamp,metadata.tools,serialNumber,version
sbom import: CycloneDX 1.x JSON (cyclonedx-1.7-sbom.json)#
Engine path: --import-sbom: CycloneDX 1.x JSON. Loss report: emitted.
- preserved (6 of 20):
components[].hashes,components[].licenses,components[].name,components[].type,components[].version,metadata.distributionConstraints - transformed (7 of 20):
bomFormat,components[].bom-ref,components[].purl,dependencies[].dependsOn,dependencies[].ref,metadata.component,specVersion - unsupported (3 of 20):
metadata.licenses,metadata.lifecycles,metadata.manufacturer - lost (4 of 20):
$schema,metadata.timestamp,serialNumber,version
crypto import: CycloneDX 1.x JSON (cyclonedx-1.6-cbom.json)#
Engine path: --import-sbom: CycloneDX 1.x JSON. Loss report: emitted.
- preserved (4 of 7):
components[].bom-ref,components[].cryptoProperties,components[].name,components[].type - transformed (2 of 7):
bomFormat,specVersion - unsupported (0 of 7): none
- lost (1 of 7):
version
ml-bom import: CycloneDX 1.x JSON (cyclonedx-1.6-mlbom.json)#
Engine path: --import-sbom: CycloneDX 1.x JSON. Loss report: emitted.
- preserved (6 of 13):
components[].hashes,components[].licenses,components[].name,components[].supplier,components[].type,components[].version - transformed (3 of 13):
bomFormat,components[].purl,specVersion - unsupported (2 of 13):
components[].data,components[].modelCard - lost (2 of 13):
components[].bom-ref,version
sbom import: SPDX 2.x JSON (spdx-2.3-sbom.json)#
Engine path: --import-sbom: SPDX 2.x JSON. Loss report: not emitted.
- preserved (1 of 29):
packages[].supplier - transformed (8 of 29):
packages[].SPDXID,packages[].checksums,packages[].externalRefs,packages[].licenseDeclared,packages[].versionInfo,relationships[].relatedSpdxElement,relationships[].relationshipType,spdxVersion - unsupported (0 of 29): none
- lost (20 of 29):
SPDXID,annotations[].annotationDate,annotations[].annotationType,annotations[].annotator,annotations[].comment,creationInfo.comment,creationInfo.created,creationInfo.creators,dataLicense,documentDescribes,documentNamespace,name,packages[].copyrightText,packages[].description,packages[].downloadLocation,packages[].filesAnalyzed,packages[].licenseConcluded,packages[].name,packages[].primaryPackagePurpose,relationships[].spdxElementId
sbom import: SPDX 2.2/2.3 tag-value (*.spdx) (spdx-2.3-sbom.spdx)#
Engine path: --import-sbom: SPDX 2.2/2.3 tag-value (*.spdx). Loss report: not emitted.
- preserved (3 of 19):
PackageLicenseDeclared,PackageSupplier,PackageVersion - transformed (3 of 19):
ExternalRef,PackageName,SPDXVersion - unsupported (0 of 19): none
- lost (13 of 19):
Created,Creator,DataLicense,DocumentComment,DocumentName,DocumentNamespace,FilesAnalyzed,PackageCopyrightText,PackageDownloadLocation,PackageLicenseConcluded,PackageSummary,Relationship,SPDXID
sbom import: SPDX 3.0.1 JSON-LD (spdx-3.0.1-software.json)#
Engine path: --import-sbom: SPDX 3.0.1 JSON-LD. Loss report: not emitted.
- preserved (4 of 37):
@graph[type=Organization].name,@graph[type=software_Package].name,@graph[type=software_Package].software_packageVersion,@graph[type=software_Package].software_primaryPurpose - transformed (9 of 37):
@context,@graph[type=Organization].spdxId,@graph[type=Relationship].from,@graph[type=Relationship].relationshipType,@graph[type=Relationship].to,@graph[type=software_Package].software_packageUrl,@graph[type=software_Package].spdxId,@graph[type=software_Package].suppliedBy,@graph[type=software_Package].verifiedUsing - unsupported (0 of 37): none
- lost (24 of 37):
@graph[type=CreationInfo].@id,@graph[type=CreationInfo].created,@graph[type=CreationInfo].createdBy,@graph[type=CreationInfo].specVersion,@graph[type=Organization].creationInfo,@graph[type=Relationship].creationInfo,@graph[type=Relationship].spdxId,@graph[type=SpdxDocument].creationInfo,@graph[type=SpdxDocument].element,@graph[type=SpdxDocument].name,@graph[type=SpdxDocument].profileConformance,@graph[type=SpdxDocument].rootElement,@graph[type=SpdxDocument].spdxId,@graph[type=Tool].creationInfo,@graph[type=Tool].name,@graph[type=Tool].spdxId,@graph[type=software_Package].creationInfo,@graph[type=software_Package].description,@graph[type=software_Package].software_copyrightText,@graph[type=software_Sbom].creationInfo,@graph[type=software_Sbom].element,@graph[type=software_Sbom].rootElement,@graph[type=software_Sbom].software_sbomType,@graph[type=software_Sbom].spdxId
ai-bom import: SPDX 3.0.1 JSON-LD (spdx-3.0.1-ai.json)#
Engine path: --import-sbom: SPDX 3.0.1 JSON-LD. Loss report: not emitted.
- preserved (0 of 26): none
- transformed (1 of 26):
@context - unsupported (12 of 26):
@graph[type=ai_AIPackage].ai_autonomyType,@graph[type=ai_AIPackage].ai_domain,@graph[type=ai_AIPackage].ai_energyConsumption,@graph[type=ai_AIPackage].ai_informationAboutApplication,@graph[type=ai_AIPackage].ai_limitation,@graph[type=ai_AIPackage].ai_typeOfModel,@graph[type=ai_AIPackage].creationInfo,@graph[type=ai_AIPackage].name,@graph[type=ai_AIPackage].software_packageVersion,@graph[type=ai_AIPackage].software_primaryPurpose,@graph[type=ai_AIPackage].spdxId,@graph[type=ai_AIPackage].verifiedUsing - lost (13 of 26):
@graph[type=CreationInfo].@id,@graph[type=CreationInfo].created,@graph[type=CreationInfo].createdBy,@graph[type=CreationInfo].specVersion,@graph[type=SpdxDocument].creationInfo,@graph[type=SpdxDocument].element,@graph[type=SpdxDocument].name,@graph[type=SpdxDocument].profileConformance,@graph[type=SpdxDocument].rootElement,@graph[type=SpdxDocument].spdxId,@graph[type=Tool].creationInfo,@graph[type=Tool].name,@graph[type=Tool].spdxId
dataset import: SPDX 3.0.1 JSON-LD (spdx-3.0.1-dataset.json)#
Engine path: --import-sbom: SPDX 3.0.1 JSON-LD. Loss report: not emitted.
- preserved (0 of 24): none
- transformed (1 of 24):
@context - unsupported (10 of 24):
@graph[type=dataset_DatasetPackage].creationInfo,@graph[type=dataset_DatasetPackage].dataset_dataPreprocessing,@graph[type=dataset_DatasetPackage].dataset_datasetType,@graph[type=dataset_DatasetPackage].dataset_hasSensitivePersonalInformation,@graph[type=dataset_DatasetPackage].dataset_intendedUse,@graph[type=dataset_DatasetPackage].name,@graph[type=dataset_DatasetPackage].releaseTime,@graph[type=dataset_DatasetPackage].software_packageVersion,@graph[type=dataset_DatasetPackage].software_primaryPurpose,@graph[type=dataset_DatasetPackage].spdxId - lost (13 of 24):
@graph[type=CreationInfo].@id,@graph[type=CreationInfo].created,@graph[type=CreationInfo].createdBy,@graph[type=CreationInfo].specVersion,@graph[type=SpdxDocument].creationInfo,@graph[type=SpdxDocument].element,@graph[type=SpdxDocument].name,@graph[type=SpdxDocument].profileConformance,@graph[type=SpdxDocument].rootElement,@graph[type=SpdxDocument].spdxId,@graph[type=Tool].creationInfo,@graph[type=Tool].name,@graph[type=Tool].spdxId
sbom import: SBOMFlow custom manifest (custom-manifest.json)#
Engine path: --import-custom-manifest: SBOMFlow custom manifest. Loss report: not emitted.
- preserved (8 of 19):
components[].component_type,components[].dependencies,components[].ecosystem,components[].hashes,components[].licenses,components[].name,components[].source_files,components[].version - transformed (5 of 19):
components[].direct,components[].purl,components[].supplier,schema,schema_version - unsupported (0 of 19): none
- lost (6 of 19):
components[].metadata,generated_at,generator,metadata.cmmeta.key,product_id,release_id
ml-bom import: cyclonedx_mlbom (cyclonedx-1.6-mlbom.json)#
Engine path: supplier AI-BOM ingest: cyclonedx_mlbom. Loss report: not emitted.
- preserved (2 of 13):
components[].supplier,components[].version - transformed (4 of 13):
bomFormat,components[].hashes,components[].name,components[].type - unsupported (1 of 13):
components[].modelCard - lost (6 of 13):
components[].bom-ref,components[].data,components[].licenses,components[].purl,specVersion,version
ai-bom import: spdx3_ai_profile (spdx-3.0.1-ai.json)#
Engine path: supplier AI-BOM ingest: spdx3_ai_profile. Loss report: not emitted.
- preserved (1 of 26):
@graph[type=ai_AIPackage].software_primaryPurpose - transformed (2 of 26):
@context,@graph[type=ai_AIPackage].verifiedUsing - unsupported (1 of 26):
@graph[type=ai_AIPackage].ai_energyConsumption - lost (22 of 26):
@graph[type=CreationInfo].@id,@graph[type=CreationInfo].created,@graph[type=CreationInfo].createdBy,@graph[type=CreationInfo].specVersion,@graph[type=SpdxDocument].creationInfo,@graph[type=SpdxDocument].element,@graph[type=SpdxDocument].name,@graph[type=SpdxDocument].profileConformance,@graph[type=SpdxDocument].rootElement,@graph[type=SpdxDocument].spdxId,@graph[type=Tool].creationInfo,@graph[type=Tool].name,@graph[type=Tool].spdxId,@graph[type=ai_AIPackage].ai_autonomyType,@graph[type=ai_AIPackage].ai_domain,@graph[type=ai_AIPackage].ai_informationAboutApplication,@graph[type=ai_AIPackage].ai_limitation,@graph[type=ai_AIPackage].ai_typeOfModel,@graph[type=ai_AIPackage].creationInfo,@graph[type=ai_AIPackage].name,@graph[type=ai_AIPackage].software_packageVersion,@graph[type=ai_AIPackage].spdxId
dataset import: spdx3_ai_profile (spdx-3.0.1-dataset.json)#
Engine path: supplier AI-BOM ingest: spdx3_ai_profile. Loss report: not emitted.
- preserved (1 of 24):
@graph[type=dataset_DatasetPackage].name - transformed (2 of 24):
@context,@graph[type=dataset_DatasetPackage].software_primaryPurpose - unsupported (0 of 24): none
- lost (21 of 24):
@graph[type=CreationInfo].@id,@graph[type=CreationInfo].created,@graph[type=CreationInfo].createdBy,@graph[type=CreationInfo].specVersion,@graph[type=SpdxDocument].creationInfo,@graph[type=SpdxDocument].element,@graph[type=SpdxDocument].name,@graph[type=SpdxDocument].profileConformance,@graph[type=SpdxDocument].rootElement,@graph[type=SpdxDocument].spdxId,@graph[type=Tool].creationInfo,@graph[type=Tool].name,@graph[type=Tool].spdxId,@graph[type=dataset_DatasetPackage].creationInfo,@graph[type=dataset_DatasetPackage].dataset_dataPreprocessing,@graph[type=dataset_DatasetPackage].dataset_datasetType,@graph[type=dataset_DatasetPackage].dataset_hasSensitivePersonalInformation,@graph[type=dataset_DatasetPackage].dataset_intendedUse,@graph[type=dataset_DatasetPackage].releaseTime,@graph[type=dataset_DatasetPackage].software_packageVersion,@graph[type=dataset_DatasetPackage].spdxId
sbom export: CycloneDX 1.6 (owasp.org/cyclonedx) (software-export.json)#
Engine path: cyclonedx-sbom.json. Loss report: not emitted.
- preserved (9 of 22):
components[].component_type,components[].content_sha256,components[].licenses,components[].name,components[].version,dependency_edges[].from_purl,dependency_edges[].to_purl,product_name,product_version - transformed (4 of 22):
components[].dependency_kind,components[].ecosystem,components[].identity_basis,components[].purl_namespace - unsupported (5 of 22):
components[].license_provenance,components[].origin,components[].source_file,components[].source_files,dependency_edges[].source_file - lost (4 of 22):
components[].dependency_scope,components[].observed_by,components[].raw_version,dependency_edges[].relationship
sbom export: SPDX 2.3 (spdx.dev) (software-export.json)#
Engine path: spdx-sbom.json. Loss report: not emitted.
- preserved (8 of 22):
components[].content_sha256,components[].licenses,components[].name,components[].version,dependency_edges[].from_purl,dependency_edges[].to_purl,product_name,product_version - transformed (5 of 22):
components[].component_type,components[].ecosystem,components[].identity_basis,components[].license_provenance,components[].purl_namespace - unsupported (0 of 22): none
- lost (9 of 22):
components[].dependency_kind,components[].dependency_scope,components[].observed_by,components[].origin,components[].raw_version,components[].source_file,components[].source_files,dependency_edges[].relationship,dependency_edges[].source_file
sbom export: SPDX 3.0.1 JSON-LD (opt-in: --emit-spdx3) (software-export.json)#
Engine path: spdx3-sbom.json. Loss report: not emitted.
- preserved (8 of 22):
components[].component_type,components[].content_sha256,components[].name,components[].version,dependency_edges[].from_purl,dependency_edges[].to_purl,product_name,product_version - transformed (4 of 22):
components[].ecosystem,components[].identity_basis,components[].purl_namespace,components[].source_file - unsupported (0 of 22): none
- lost (10 of 22):
components[].dependency_kind,components[].dependency_scope,components[].license_provenance,components[].licenses,components[].observed_by,components[].origin,components[].raw_version,components[].source_files,dependency_edges[].relationship,dependency_edges[].source_file
ml-bom export: CycloneDX 1.6 ML-BOM (opt-in: --emit-mlbom) (ai-export.json)#
Engine path: cyclonedx-mlbom.json. Loss report: not emitted.
- preserved (28 of 33):
entities[kind=adapter].licence,entities[kind=adapter].name,entities[kind=adapter].supplier,entities[kind=adapter].version,entities[kind=agent].name,entities[kind=agent].supplier,entities[kind=agent].version,entities[kind=dataset].licence,entities[kind=dataset].name,entities[kind=dataset].purpose,entities[kind=dataset].sensitivity,entities[kind=dataset].supplier,entities[kind=dataset].version,entities[kind=evaluation].name,entities[kind=evaluation].purpose,entities[kind=evaluation].version,entities[kind=model].intendedUse,entities[kind=model].licence,entities[kind=model].limitations,entities[kind=model].name,entities[kind=model].supplier,entities[kind=model].version,entities[kind=prompt].name,entities[kind=prompt].purpose,entities[kind=prompt].version,entities[kind=service].name,entities[kind=service].provider,entities[kind=service].version - transformed (0 of 33): none
- unsupported (5 of 33):
entities[kind=adapter].base_model,entities[kind=dataset].containsPersonalData,entities[kind=dataset].provenance,entities[kind=dataset].transformations,entities[kind=model].baseModel - lost (0 of 33): none
ai-bom export: SPDX 3.0.1 AI + Dataset profiles (opt-in: --emit-aibom) (ai-export.json)#
Engine path: spdx3-aibom.json. Loss report: not emitted.
- preserved (22 of 33):
entities[kind=adapter].name,entities[kind=adapter].supplier,entities[kind=adapter].version,entities[kind=agent].name,entities[kind=agent].supplier,entities[kind=agent].version,entities[kind=dataset].name,entities[kind=dataset].purpose,entities[kind=dataset].supplier,entities[kind=dataset].transformations,entities[kind=dataset].version,entities[kind=evaluation].name,entities[kind=evaluation].version,entities[kind=model].intendedUse,entities[kind=model].limitations,entities[kind=model].name,entities[kind=model].supplier,entities[kind=model].version,entities[kind=prompt].name,entities[kind=prompt].version,entities[kind=service].name,entities[kind=service].version - transformed (1 of 33):
entities[kind=dataset].containsPersonalData - unsupported (10 of 33):
entities[kind=adapter].base_model,entities[kind=adapter].licence,entities[kind=dataset].licence,entities[kind=dataset].provenance,entities[kind=dataset].sensitivity,entities[kind=evaluation].purpose,entities[kind=model].baseModel,entities[kind=model].licence,entities[kind=prompt].purpose,entities[kind=service].provider - lost (0 of 33): none
Unmeasured rows#
| Family | Direction | Format | Engine path | Why |
|---|---|---|---|---|
| firmware | import | yocto *.spdx.index.json | project scan (ingest_create_spdx) | read from a build tree by the project scan; no fixture in this census yet |
| firmware | import | yocto *.spdx.json | project scan (ingest_create_spdx, ingest_create_spdx3) | read from a build tree by the project scan; no fixture in this census yet |
| vulnerability exchange | export | CycloneDX 1.6 VEX (opt-in: --emit-vex) | cyclonedx-vex.json | no fixture in this census yet |
| vulnerability exchange | export | CycloneDX 1.6 VDR (opt-in: --emit-vdr) | cyclonedx-vdr.json | no fixture in this census yet |
| scanner findings | export | SARIF 2.1.0, OASIS (opt-in: --emit-sarif) | findings.sarif | no fixture in this census yet |
| vulnerability exchange | export | CSAF 2.0, OASIS (written whenever VEX is emitted and a vulnerability is to be stated; audit always emits VEX) | csaf-vex.json | no fixture in this census yet |
| vulnerability exchange | export | OpenVEX 0.2.0 (written whenever VEX is emitted and a statement is to be made; audit always emits VEX) | vex.json | no fixture in this census yet |
| release notes | export | CycloneDX 1.7 release notes (opt-in: compare-releases --release-notes-format cyclonedx|both) | engineering-release-notes.cdx.json | no fixture in this census yet |
| agent-manifest | — | — | — | no import flag, scanner BOM reader, AI-BOM ingest format or registered external format names a standard for this family |
The loss-report contract#
Every importer and exporter owes its reader one section stating, for the document it processed, which of the four classes each field fell into. The section is additive and carries its own version:
| Key | Holds |
|---|---|
schema_version | sbomflow-bom-loss-report-v1 |
direction | import or export |
format | the format and version the processor read or wrote |
granularity | the field rule above: root keys; a root object or array of objects is replaced by its child keys; JSON-LD @graph elements are grouped by type |
fields_present | how many fields the document carried; the four counts sum to it |
counts | one count per class |
classes | per class, one {field, note} entry per field, the note saying what happened |
class_meanings | the four definitions, so a section read alone can be interpreted |
boundary_note | what the section does not claim |
The CycloneDX reader is the first processor to emit it: each imported CycloneDX document's row in evidence-pack.json imported_sbom_quality carries it as loss_report, and its unsupported class is exactly the set of keys the cyclonedx_fields_not_interpreted warning names. A reader that does not emit it writes no key, so its rows are unchanged.
This census holds the section to what it measures. For every fixture a processor that has adopted the contract reads, the report must exist, must have the shape above, and must give every field the class the census measured; any difference stops the census from being generated.
Processors that have adopted it: import-sbom:cyclonedx.
Processors measured here that do not emit it yet: ai-bom-ingest, export:cyclonedx-mlbom.json, export:cyclonedx-sbom.json, export:spdx-sbom.json, export:spdx3-aibom.json, export:spdx3-sbom.json, import-custom-manifest, import-sbom:spdx2-json, import-sbom:spdx2-tag-value, import-sbom:spdx3.