Hypermedia Security: ADBOM Specification

v1.0.0Hypermedia Au

Arbitrary Risk Bill of Materials

Published 2025-11-09. By Hypermedia Au Security Team. Serial urn:uuid:8a9c2f1e-4b3d-4e8a-9c7f-2d1e3c4b5a6f

Arbitrary Risk Bill of Materials - Cryptographic attestation for arbitrary data blobs

Download raw JSON

About this standard

schema-url: https://sec.hypermedia.au/schemas/adbom/v1.0.0.schema.json
spec-version: 1.0.0-poc
scope: text-data-blobs

Sources

github.com: documentation
sec.hypermedia.au: website

ADBOM-001 Hash-Based Verification MUST

checked: cryptographic-hash

ADBOM documents MUST contain cryptographic hashes of the data blob using SHA-256 and optionally SHA-512, SHA3-256, SHA3-512, or BLAKE3. Hash calculation MUST occur before signature generation.

Hash-based verification ensures data integrity without storing the actual data blob. Only hash values are included in the ADBOM, creating a privacy-preserving attestation model.

required-algorithms: SHA-256
optional-algorithms: SHA-512SHA3-256SHA3-512BLAKE3

ADBOM-002 Cryptographic Signature MUST

checked: cryptographic-signature

ADBOM documents MUST be cryptographically signed using ES256, ES384, or ES512 algorithms. Keyless signing via Sigstore Fulcio is supported for ephemeral key scenarios.

Cryptographic signatures provide authenticity and non-repudiation. The signature covers the entire ADBOM document including hashes, metadata, and component information.

signature-algorithms: ES256ES384ES512
keyless-support: true
fulcio-integration: supported

ADBOM-003 CycloneDX 1.6/1.7 Compliance MUST

checked: field-presence

ADBOM documents MUST conform to CycloneDX 1.6 or 1.7 specification with component type='data'. The document MUST include required fields: bomFormat, specVersion, serialNumber, version, metadata, components, and signature.

CycloneDX compliance ensures interoperability with existing BOM tooling and repositories. The 'data' component type is specifically designed for non-software artifacts.

required-fields: bomFormatspecVersionserialNumberversionmetadatacomponentssignature
spec-versions: 1.61.7
component-type: data

ADBOM-004 Metadata Requirements MUST

checked: field-presence

ADBOM metadata MUST include timestamp, tools array (generation tool), and MAY include authors and custom properties. Properties SHOULD use 'adbom:' namespace prefix.

Metadata provides context about ADBOM generation including when, by whom, and using what tools. Custom properties enable extensibility for domain-specific metadata.

namespace-prefix: adbom:
required-fields: metadata.timestampmetadata.tools