Practical template
SBOM structural, semantic and coverage review
Use this template with your own product details and evidence. Copy the text into your document to complete the fields and add rows as needed.
- Input/hash: [fill in]
- Generator/version/command: [fill in]
- Product image/hash: [fill in]
- Format/schema URL/hash: [fill in]
- Validator/version/options: [fill in]
- Reviewer/date: [fill in]
- Structural result and raw errors: [fill in]. Format checks enabled/disabled: [fill in].
- Product/component identity and version gaps: [fill in].
- Duplicate or missing references and dependency links: [fill in].
- Comparison against package manifest, static linking, boot/recovery and vendor binaries: [fill in].
- External software scope and disclosure limitations: [fill in].
| Gap | Evidence inspected | Release consequence | Owner/due date | Resolution/approval |
|---|---|---|---|---|
| [fill in] | [fill in] | [fill in] | [fill in] | [fill in] |
Synthetic fixtures accompany the article. A schema pass does not establish product coverage or legal conformity.
Read the accompanying guide
How to Validate an SBOM Beyond Passing the JSON Schema