Answers questions, not just files
Six views over one workspace: the same search and facets everywhere.
Each document also gets a quality report: author, timestamp, namespace
and relationship checks, plus per-package coverage of versions, suppliers, IDs,
checksums and licenses: factual numbers, no invented score, and every report names and
links the requirement source it checks against. The default preset is the NTIA minimum
elements (2021); its successor, the CISA 2026 minimum elements (CISA,
NSA, FBI and 16 international partners including the BSI), is a selectable builtin,
honest about the fields the engine cannot read. Profiles evaluate on SPDX and CycloneDX
alike, and a builtin
BSI TR-03183-2 preset approximates what the German technical guideline
expects, starting with the format itself: the TR accepts only SPDX 3.0.1+ or CycloneDX
1.6+, so an SPDX 2.x or CycloneDX 1.5 document fails that baseline in the report
instead of rendering all-green. A growing preset catalog covers sector duties, FDA 524B
cybersecurity, OpenChain Automotive and the G7 SBOM for AI minimum elements, and reads
CBOMs too: crypto inventories checked against BSI TR-02102-1
parameters, the EU PQC roadmap, DORA and PCI DSS, counting what the BOM states, never
issuing a security verdict. For standards scores in CI, pair it with a norm scorer like sbomqs; profiles are the
custom, cascade-aware complement: your own minimum elements as a small JSON file.
Drop an OpenVEX or CSAF 2.0 advisory (the BSI exchange
format) next to your SBOMs and the Inventory grows a VEX column: each
package carries what the supplier communicates about known vulnerabilities: status,
justification, impact and action. Both formats share one overlay and the same time rule,
statements match by package URL and by CPE, the identifier BSI-CERT advisories actually
use, and the findings export with the table. It is a
communication channel, not a scanner: no CVE database, no version ranges: what the
supplier said, mapped onto what you shipped. Every CSAF advisory also shows the clauses
of BSI TR-03191 a file can show, as facts with clause numbers, and a folder of
advisories opens even before any SBOM.
Check delivery turns the SBOM into an acceptance test: point SBOM Lens
at the files you were actually delivered and it hashes them in the worker, comparing each
to the SBOM's file checksums: match, mismatch, missing, unverifiable, or an extra the
SBOM never listed. The delivered bytes never reach the UI thread. It is the SPDX-side
counterpart to OCM Lens's blob-digest check.
Beyond “can I read this?”, every document is checked against the
specification it claims to follow: 28 rules across SPDX 2.x, SPDX 3.0.x
and CycloneDX 1.x catch what a consumer downstream would trip over, a relationship type
outside the vocabulary, a digest whose length cannot match its algorithm, an identifier
off its grammar, a duplicate bom-ref. These spec findings stay warnings
and sit apart from parser notes, so you always know which you are looking at. License
expressions are checked for grammar, never against the license list: rating licenses
stays a non-goal, and for authoritative conformance verification the docs point at
spdx/tools-java.
