BOM Schemas

10 JSON Schemas for the custom BOM formats. These are machine-readable — CI/CD pipelines validate BOMs against them.

• ADBOM v1.0.0 Schema · standard · raw schema
  ADBOM schema for POC - text data blobs (JSON/YAML/XML) with hash-based verification and cryptographic signing
• Analysis Provenance Evidence v1 Schema · standard · raw schema
  Validates the JSON payloads carried in-band (as application/json attachments) by analysis-provenance attestation evidence. The attestation i…
• Artifact Entry v1 Schema · standard · raw schema
  Validates one L0 artifact entry: a hash-only CycloneDX component (evidence or derived artifact) as enumerated inside a Case Provenance BOM's…
• Case Provenance BOM v1 Schema · standard · raw schema
  Validates one sealed version of an L1 Case Provenance BOM. Shape-only: version monotonicity across seals, corpus completeness, sidecar joins…
• Custody Chain Ledger v1 Schema · standard · raw schema
  Validates the custody-chain ledger: the hash-linked event log that is the authoritative home of custody events. Custody-chain attestations r…
• Finding BOM v1 Schema · standard · raw schema
  Validates one L2 Finding BOM version. Shape-only: provenanceRef resolution, author-identity equality with the provenance attestation, the di…
• CyberBench License v1 Schema · standard · raw schema
  Validates the decoded payload of a .cblicense envelope. Dates are ISO-8601. Capability strings are open by design: a build that does not rec…
• CyberBench License Envelope v1 Schema · standard · raw schema
  Validates a .cblicense file. The signature covers the exact payload bytes carried here — verification never re-serializes the payload, so ca…
• Publication BOM v1 Schema · standard · raw schema
  Validates one L3 Publication BOM version. Shape-only: the finalisation-version check on the catalog pin and the disclosability of composed f…
• Timestamp Sidecar Index v1 Schema · standard · raw schema
  Validates Timestamps/index.json, the sidecar join between sealed documents and the RFC 3161 tokens that cover them. NOT a CycloneDX document…