SBOM data is lacking.

[riteshnoronha]

For CRA compliance & other regulations the sbom provided at sbom is limited. These sboms need to be enriched with better data for compliance and vulnerabilities management needs.

➜  Downloads sbomqs score sbom_cdx.json
SBOM Quality Score: 3.9/10.0     Grade: F       Components: 117          EngineVersion: 1       File: sbom_cdx.json

Profile Summary Scores:
+-----------------------+----------+-------+
|        PROFILE        |  SCORE   | GRADE |
+-----------------------+----------+-------+
| Interlynk Profile     | 4.0/10.0 | F     |
+-----------------------+----------+-------+
| NTIA Minimum Elements | 7.2/10.0 | C     |
+-----------------------+----------+-------+
| BSI TR-03183-2 v1.1   | 5.4/10.0 | D     |
+-----------------------+----------+-------+

Interlynk Detailed Score:
+-------------------+--------------------------------+---------------+-------------------------------------+
|     CATEGORY      |            FEATURE             |     SCORE     |                DESC                 |
+-------------------+--------------------------------+---------------+-------------------------------------+
| Identification    | comp_with_name                 | 10.0/10.0     | 117/117 have names                  |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_with_version              | 10.0/10.0     | 117/117 have versions               |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_with_identifiers          | 10.0/10.0     | 117/117 have unique IDs             |
+-------------------+--------------------------------+---------------+-------------------------------------+
| Provenance        | sbom_creation_timestamp        | 10.0/10.0     | 2025-11-07T14:10:59Z                |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_authors                   | 10.0/10.0     | 1 authors                           |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_tool_version              | 10.0/10.0     | 2 tool                              |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_supplier                  | 0.0/10.0      | missing supplier                    |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_namespace                 | 10.0/10.0     | present namespace                   |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_lifecycle                 | 0.0/10.0      | missing lifecycle                   |
+-------------------+--------------------------------+---------------+-------------------------------------+
| Integrity         | comp_with_checksums            | 0.0/10.0      | 0/117 have SHA-1+                   |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_with_sha256               | 0.0/10.0      | 0/117 have SHA-256+                 |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_signature                 | 0.0/10.0      | missing signature                   |
+-------------------+--------------------------------+---------------+-------------------------------------+
| Completeness      | comp_with_dependencies         | 0.3/10.0      | 4/117 have dependencies             |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_completeness_declared     | 0.0/10.0      | missing completeness                |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_primary_component         | 10.0/10.0     | identified                          |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_with_source_code          | 0.0/10.0      | 0/117 have source URIs              |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_with_supplier             | 0.0/10.0      | 0/117 have suppliers                |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_with_purpose              | 10.0/10.0     | 117/117 have type                   |
+-------------------+--------------------------------+---------------+-------------------------------------+
| Licensing         | comp_with_licenses             | 0.0/10.0      | 0/117 have licenses                 |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_with_valid_licenses       | 0.0/10.0      | 0/117 have valid SPDX licenses      |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_with_declared_licenses    | 0.0/10.0      | 0/117 have declared licenses        |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_data_license              | 0.0/10.0      | missing data license                |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_no_deprecated_licenses    | 0.0/10.0      | N/A                                 |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_no_restrictive_licenses   | 0.0/10.0      | N/A                                 |
+-------------------+--------------------------------+---------------+-------------------------------------+
| Vulnerability     | comp_with_purl                 | 0.3/10.0      | 3/117 have PURLs                    |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_with_cpe                  | 0.4/10.0      | 5/117 have CPEs                     |
+-------------------+--------------------------------+---------------+-------------------------------------+
| Structural        | sbom_spec_declared             | 10.0/10.0     | cyclonedx                           |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_spec_version              | 10.0/10.0     |                                 1.5 |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_file_format               | 10.0/10.0     | json                                |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | sbom_schema_valid              | 10.0/10.0     | schema valid                        |
+-------------------+--------------------------------+---------------+-------------------------------------+
| Component Quality | comp_eol_eos                   | Coming Soon.. | N/A                                 |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_malicious                 | Coming Soon.. | N/A                                 |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_vuln_sev_critical         | Coming Soon.. | N/A                                 |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_kev                       | Coming Soon.. | N/A                                 |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_purl_valid                | Coming Soon.. | N/A                                 |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | comp_cpe_valid                 | Coming Soon.. | N/A                                 |
+                   +--------------------------------+---------------+-------------------------------------+
|                   | NOTE: Register Interest for    |               | https://forms.gle/WVoB3DrX9NKnzfhV8 |
|                   | Component Analysis             |               |                                     |
+-------------------+--------------------------------+---------------+-------------------------------------+

[ALABSTM]

Hi @riteshnoronha,

Thank you for this interesting and structured feedback. I will forward it to our quality assurance team and get back to you once I have their feedback.

With regards,

[ALABSTM]

Hi @riteshnoronha,

I had a more thorough look at the SBOM provided in this repository and noticed some discrepancies against what you reported.

Your report claims that 0/117 have declared licenses. However, I found several components, not to say all, with declared "licenses": {, as you can see from the couple of examples below.

Would you mind double checking or clarifying this point, please?

STM32CubeH7/sbom_cdx.json

Lines 95 to 97 in 46631c3

	"license": {
	"id": "MIT"
	}

STM32CubeH7/sbom_cdx.json

Lines 1232 to 1234 in 46631c3

	"license": {
	"id": "BSD-3-Clause"
	}

STM32CubeH7/sbom_cdx.json

Lines 1656 to 1658 in 46631c3

	"license": {
	"name": "LIMITED LICENSE AGREEMENT FOR ST MATERIALS EVALUATION (SLA0078)"
	}

With regards,

[ALABSTM]

ST Internal Reference: 222512

[riteshnoronha]

Thanks for reviewing it below is an updated output. For CRA & Other SBOM regulations

let me highlight a few things

Vulnerability

+------------------------+--------------------------------+---------------+-------------------------------------+
| Vulnerability (12.2%)  | comp_with_purl (12.2% OR)      | 0.3/10.0      | add to 114 components               |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_cpe (12.2% OR)       | 0.4/10.0      | add to 112 components               |
+------------------------+--------------------------------+---------------+-------------------------------------+

To use SBOM to help with Vulnerability tracking of OSS components like Lwip, FreeRTOS, this sbom is not adequate. Either one of these identifiers are required. For NTIA or CRA regulations

Licenses

+------------------------+--------------------------------+---------------+-------------------------------------+
| Licensing (18.3%)      | comp_with_licenses (3.7%)      | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_valid_licenses       | 6.0/10.0      | add to 47 components                |
|                        | (3.7%)                         |               |                                     |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_declared_licenses    | 0.0/10.0      | add to 117 components               |
|                        | (2.7%)                         |               |                                     |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_data_license (1.8%)       | 0.0/10.0      | add data license                    |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_no_deprecated_licenses    | 10.0/10.0     | complete                            |
|                        | (2.7%)                         |               |                                     |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_no_restrictive_licenses   | 9.9/10.0      | review 1 component                  |
|                        | (3.7%)                         |               |                                     |
+------------------------+--------------------------------+---------------+-------------------------------------+

This section shows there are concluded license for all components, but not all are not valid based on missing custom id
licenses. eg "SOFTWARE PACKAGE LICENSE AGREEMENT (SLA0048)" -> the id field should be LicenseRef-... according spdx spec.

Provenance

+------------------------+--------------------------------+---------------+-------------------------------------+
| Provenance (14.6%)     | sbom_creation_timestamp (2.9%) | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_authors (2.9%)            | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_tool_version (2.9%)       | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_supplier (2.2%)           | 0.0/10.0      | add supplier                        |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_namespace (2.2%)          | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_lifecycle (1.5%)          | 0.0/10.0      | add lifecycle                       |
+------------------------+--------------------------------+---------------+-------------------------------------+

We are missing supplier information and lifecycle information, which are required for various regulations.

sbomqs git:(main) ./build/sbomqs score samples/sbom_cdx.json
SBOM Quality Score: 5.1/10.0     Grade: D       Components: 117          EngineVersion: 2       File: samples/sbom_cdx.json

Profile Summary Scores:
+-----------------------+----------+-------+
|        PROFILE        |  SCORE   | GRADE |
+-----------------------+----------+-------+
| Interlynk Profile     | 5.1/10.0 | F     |
+-----------------------+----------+-------+
| NTIA Minimum Elements | 8.6/10.0 | B     |
+-----------------------+----------+-------+
| BSI TR-03183-2 v1.1   | 6.9/10.0 | D     |
+-----------------------+----------+-------+

Category Summary:
+----------------+--------+-----------+-------+
|    CATEGORY    | WEIGHT |   SCORE   | GRADE |
+----------------+--------+-----------+-------+
| Identification | 12.2%  | 10.0/10.0 | A     |
+----------------+--------+-----------+-------+
| Provenance     | 14.6%  | 7.5/10.0  | C     |
+----------------+--------+-----------+-------+
| Integrity      | 18.3%  | 0.0/10.0  | F     |
+----------------+--------+-----------+-------+
| Completeness   | 14.6%  | 3.7/10.0  | F     |
+----------------+--------+-----------+-------+
| Licensing      | 18.3%  | 6.7/10.0  | D     |
+----------------+--------+-----------+-------+
| Vulnerability  | 12.2%  | 0.3/10.0  | F     |
+----------------+--------+-----------+-------+
| Structural     | 9.8%   | 10.0/10.0 | A     |
+----------------+--------+-----------+-------+

Interlynk Detailed Score:
+------------------------+--------------------------------+---------------+-------------------------------------+
|        CATEGORY        |            FEATURE             |     SCORE     |                DESC                 |
+------------------------+--------------------------------+---------------+-------------------------------------+
| Identification (12.2%) | comp_with_name (4.9%)          | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_version (4.3%)       | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_identifiers (3.0%)   | 10.0/10.0     | complete                            |
+------------------------+--------------------------------+---------------+-------------------------------------+
| Provenance (14.6%)     | sbom_creation_timestamp (2.9%) | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_authors (2.9%)            | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_tool_version (2.9%)       | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_supplier (2.2%)           | 0.0/10.0      | add supplier                        |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_namespace (2.2%)          | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_lifecycle (1.5%)          | 0.0/10.0      | add lifecycle                       |
+------------------------+--------------------------------+---------------+-------------------------------------+
| Integrity (18.3%)      | comp_with_strong_checksums     | 0.0/10.0      | add to 117 components               |
|                        | (9.1%)                         |               |                                     |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_weak_checksums       | 0.0/10.0      | no checksums found                  |
|                        | (7.3%)                         |               |                                     |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_signature (1.8%)          | 0.0/10.0      | add signature                       |
+------------------------+--------------------------------+---------------+-------------------------------------+
| Completeness (14.6%)   | comp_with_dependencies (3.7%)  | 0.3/10.0      | add to 113 components               |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_completeness_declared     | 0.0/10.0      | add completeness                    |
|                        | (2.2%)                         |               |                                     |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_primary_component (2.9%)  | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_source_code (2.2%)   | 0.0/10.0      | add to 117 components               |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_supplier (2.2%)      | 0.3/10.0      | add to 113 components               |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_purpose (1.5%)       | 10.0/10.0     | complete                            |
+------------------------+--------------------------------+---------------+-------------------------------------+
| Licensing (18.3%)      | comp_with_licenses (3.7%)      | 10.0/10.0     | complete                            |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_valid_licenses       | 6.0/10.0      | add to 47 components                |
|                        | (3.7%)                         |               |                                     |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_declared_licenses    | 0.0/10.0      | add to 117 components               |
|                        | (2.7%)                         |               |                                     |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_data_license (1.8%)       | 0.0/10.0      | add data license                    |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_no_deprecated_licenses    | 10.0/10.0     | complete                            |
|                        | (2.7%)                         |               |                                     |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_no_restrictive_licenses   | 9.9/10.0      | review 1 component                  |
|                        | (3.7%)                         |               |                                     |
+------------------------+--------------------------------+---------------+-------------------------------------+
| Vulnerability (12.2%)  | comp_with_purl (12.2% OR)      | 0.3/10.0      | add to 114 components               |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_with_cpe (12.2% OR)       | 0.4/10.0      | add to 112 components               |
+------------------------+--------------------------------+---------------+-------------------------------------+
| Structural (9.8%)      | sbom_spec_declared (2.9%)      | 10.0/10.0     | cyclonedx                           |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_spec_version (2.9%)       | 10.0/10.0     | v1.5                                |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_file_format (2.0%)        | 10.0/10.0     | json                                |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | sbom_schema_valid (2.0%)       | 10.0/10.0     | complete                            |
+------------------------+--------------------------------+---------------+-------------------------------------+
| Component Quality      | comp_eol_eos                   | Coming Soon.. | N/A                                 |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_malicious                 | Coming Soon.. | N/A                                 |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_vuln_sev_critical         | Coming Soon.. | N/A                                 |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_kev                       | Coming Soon.. | N/A                                 |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_purl_valid                | Coming Soon.. | N/A                                 |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | comp_cpe_valid                 | Coming Soon.. | N/A                                 |
+                        +--------------------------------+---------------+-------------------------------------+
|                        | NOTE: Register Interest for    |               | https://forms.gle/WVoB3DrX9NKnzfhV8 |
|                        | Component Analysis             |               |                                     |
+------------------------+--------------------------------+---------------+-------------------------------------+