Format conversion
Workflows processes SBOMs in one canonical internal representation. These nodes are the boundary: readers convert an incoming file into that representation, and writers convert it back out to a standard format.
Because processing happens in the canonical form, a workflow can read CycloneDX and write SPDX — or read both and emit either — without any step in the middle caring which format the data arrived in.
Readers do more than change the container: they also canonicalize license strings into SPDX expressions, turning compound and non-standard names into something later steps can reason about. Component names, versions, and identifiers are left as the supplier wrote them — reconciling those is what Normalize Data is for.
Read CycloneDX
Parses a CycloneDX file and converts it into the canonical SBOM format.
| Category | Data Format |
| Input | file |
| Output | sbom |
| Multiple inputs | Yes |
| Parameter | Type | Default | Description |
|---|---|---|---|
| CycloneDX Version | 1.3, 1.4 | — | Expected CycloneDX version for parsing. |
Place this immediately after whatever brings the file in. Until a file has been
read, it is just an opaque file and no processing node can accept it.
Read SPDX
Parses an SPDX file and converts it into the canonical SBOM format.
| Category | Data Format |
| Input | file |
| Output | sbom |
| Multiple inputs | Yes |
| Parameter | Type | Default | Description |
|---|---|---|---|
| SPDX Version | 2.2, 2.3 | — | Expected SPDX version for parsing. |
Write CycloneDX
Encodes the canonical SBOM as a CycloneDX file.
| Category | Data Format |
| Input | sbom |
| Output | file |
| Multiple inputs | Yes |
| Parameter | Type | Default | Description |
|---|---|---|---|
| CycloneDX Version | 1.2, 1.3, 1.4, 1.5, 1.6 — required | 1.4 | Version to emit. Prefer 1.4 or newer for FossID Workbench. |
Write SPDX
Encodes the canonical SBOM as an SPDX file.
| Category | Data Format |
| Input | sbom |
| Output | file |
| Multiple inputs | Yes |
| Parameter | Type | Default | Description |
|---|---|---|---|
| SPDX Version | 2.2, 2.3 — required | — | Version to encode. |
Notes on conversion
Converting between formats is not always lossless: the two specifications model some things differently, and a field with no equivalent in the target format cannot survive the trip. The SBOM conversion mapping documents how fields correspond.
Related
- SBOM schema — the canonical representation.
- Edges and data flow — why
filehas to be read first.