Reference

The canonical SBOM representation, how it maps to SPDX and CycloneDX, what the regulations require, and what each execution status means.

📄️Canonical SBOM format

The internal representation every SBOM is converted to inside FossID Workflows.

How SPDX and CycloneDX fields map to the canonical format, and what changes on the way through.

What the EU CRA, NTIA 2021, and CISA 2025 require from an SBOM, and what the compliance node checks.

Quick lookup for every workflow, execution, and node status.