Add an annotated SBOM examples page - #129
Merged
Merged
Conversation
Keyword research against DataForSEO turned up a gap worth filling. sbomify.com ranks for 128 keywords, and almost none of them are the category's own terms: "sbom" (4,400/mo, KD 9) does not rank in the top 50 at all, and what does rank is tangential -- GPL licensing, CVSS, in-toto. "sbom examples" and "sbom example" are 210/mo each at KD 1 and 4, with no page on the site targeting either. The SERP is a GitHub repo and three vendor blog posts, none of which show a complete annotated file. This page shows the files instead of describing them. A minimal CycloneDX 1.6 document and its SPDX 2.3 equivalent, field by field and mapped to each other, then a real component entry taken verbatim from an SBOM generated against alpine:3.18 -- purl, SPDX license identifier, hashes and supplier -- and a check of that entry against the seven NTIA minimum elements, which shows that two of the seven live in the header rather than the component list. Sources are the specification maintainers and the agencies, not vendor blogs: NTIA and CISA for the minimum elements, OWASP CycloneDX and the Linux Foundation's SPDX for the formats and their example repositories, OpenSSF and ENISA for background. Every external link was checked to resolve, and the three JSON examples parse. Also links the new page from the formats section of /what-is-sbom/, which is the strongest internally-linked page on the topic. Verified against a production build: the page emits FAQPage schema with five entries, site-wide invalid JSON-LD stays 0, and no other entity count moves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FbqYj6ztzG6yautDpRWDXS
vpetersson
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
/sbom-examples/, an annotated reference page showing what SBOM files actually look like.The page
Most material on this topic describes SBOMs and stops. This page shows the files:
alpine:3.18— purl, SPDX license identifier, hashes, supplierSourced from the specification maintainers and the agencies — NTIA and CISA for the minimum elements (including that CISA's 2025 update is still a comment draft, consistent with
/compliance/ntia-minimum-elements/), OWASP CycloneDX and the Linux Foundation's SPDX for the formats and their own example repositories, OpenSSF and ENISA for background.Also links the page from the formats section of
/what-is-sbom/.Checks
bun run lintpasses