Validate a supplier CycloneDX SBOM

Created by

Cedric Günther

Actor

SBOM Policy Checker

Evaluate a supplier CycloneDX SBOM for required provenance, relationship integrity, and denied licenses.

Try for free

SBOM Policy Checkerceddl/sbom-policy-evidence-gate

Record type

Sbom id

Format

Spec version

+15 fields

Input

Inline SBOMs(required)

SBOM ID(required):synthetic-supplier-pass

Inline SBOM JSON object(required)

Versioned technical policy(required)

Policy name(required):synthetic-supplier-intake

Policy version(required):1.0.0

Require document provenance(required):true

Required component fields(required):name+1

Denied licenses(required):GPL-3.0-only

Allowed licenses(required)

Unknown license behavior(required):DENY

Denied package URLs(required)

Require relationship integrity(required):true

Output fields

Record type

Sbom id

Format

Spec version

Status

Component count

Relationship count

Finding count

Finding code

Severity

Component id

Path

Message

Fingerprint

Error code

Policy name

Policy version

Policy hash

Input hash

How it works

Sign up on Apify or log in

The SBOM Policy Checker Actor is ready to run with the inputs already set for "Validate a supplier CycloneDX SBOM". Sign up or log in and you'll land in Apify Console with a copy of this exact task.

Start the "Validate a supplier CycloneDX SBOM" task

The SBOM Policy Checker Actor will start running based on the input automatically. You can also change all the input fields, like inline sboms and versioned technical policy, to match your specific use case.

Receive the "Validate a supplier CycloneDX SBOM" output

Monitor the progress in real time. You will be notified as soon as your dataset is complete and ready for review. Each result includes data such as record type, sbom id, format, and more.

Integrate into your workflow

The final output is delivered in JSON, CSV, or Excel format, ready to be plugged into your workflow. You can also run the "Validate a supplier CycloneDX SBOM" task via API.