CRA compliance for the SBOM

[Falco20019]

We are currently preparing for the upcoming EU requirements to supply SBOMs as part of the Cyber Resilience Act (CRA). To check what's missing, we are using sbomqs and check against https://github.com/interlynk-io/sbomqs/blob/main/docs/reference/compliance-standards.md

The tool itself still has some issues / wrong mappings which I'm currently trying to report all I can find. Using a simple project I will get the little satisfying scores of Score:5.0 RequiredScore:4.0 AdditionalScore:10.0.

To reproduce:

dotnet new console -o SbomTest
cd SbomTest
dotnet package add Serilog
dotnet CycloneDX -spv 1.6 -egl --set-nuget-purl -F json -o "sboms" SbomTest.csproj
for flag in bsi-v1 bsi-v2 bsi-v21 fsct ntia; do docker run --rm -v $PWD/sboms:/files ghcr.io/interlynk-io/sbomqs compliance --$flag /files/bom.json > sboms/report-$flag.txt; done

This gives the following outputs:

BSI TR-03183-2 v2.1.0 Compliance Report

Compliance score by Interlynk Score:5.0 RequiredScore:4.0 AdditionalScore:10.0 for /files/bom.json
* indicates optional fields
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
|   ELEMENTID    | SECTION |           DATAFIELD            |                 ELEMENT RESULT                  | SCORE |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
| SBOM           |     3.1 | vuln                           | no-vulnerability                                |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                |       4 | specification version          |                                             1.6 |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.1   | creator of SBOM                |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.1   | timestamp                      | 2026-07-14T08:10:34Z                            |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.1   | dependency graph completeness  | dependency graph complete                       |   5.0 |
|                |         |                                | but completeness indication                     |       |
|                |         |                                | missing (BSI v2.1 §5.2.2                        |       |
|                |         |                                | requires explicit indication)                   |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.1   | SBOM-URI                       | urn:uuid:1098fb5f-f097-4ecf-a873-747e7c22f126/1 |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | components                     | present                                         |  10.0 |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
| Serilog-4.4.0  | 5.2.2   | component creator              |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component name                 | Serilog                                         |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component version              | 4.4.0                                           |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | filename                       |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | dependencies                   | no-dependencies (leaf element)                  |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | distribution licence           | not-compliant                                   |   0.0 |
|                |         | (concluded)                    |                                                 |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | hash of deployable component   |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | executable property            |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | archive property               |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | structured property            |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.3   | source code URI                | https://github.com/serilog/serilog              |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.4   | URI of deployable form         |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.5   | other unique identifiers       | purl: pkg:nuget/Serilog@4.4.0                   |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | original licence (declared)    | compliant                                       |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.3*  | effective licence              |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.3*  | hash of source code            |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.3*  | security.txt URL               |                                                 |   0.0 |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
| SbomTest-0.0.0 | 5.2.2   | component creator              |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component name                 | SbomTest                                        |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component version              | 0.0.0                                           |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | filename                       |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | dependencies                   | (all dependencies resolved)                     |  10.0 |
|                |         |                                | Serilog                                         |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | distribution licence           | not-compliant                                   |   0.0 |
|                |         | (concluded)                    |                                                 |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | hash of deployable component   |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | executable property            |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | archive property               |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | structured property            |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.3   | source code URI                |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.4   | URI of deployable form         |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.5   | other unique identifiers       | purl: pkg:nuget/SbomTest@0.0.0                  |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | original licence (declared)    |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.3*  | effective licence              |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.3*  | hash of source code            |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.3*  | security.txt URL               |                                                 |   0.0 |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+

BSI TR-03183-2 v2.0.0 Compliance Report

Compliance score by Interlynk Score:5.3 RequiredScore:4.6 AdditionalScore:10.0 for /files/bom.json
* indicates optional fields
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
|   ELEMENTID    | SECTION |           DATAFIELD            |                 ELEMENT RESULT                  | SCORE |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
| SBOM           |     3.1 | vuln                           | no-vulnerability                                |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                |       4 | specification version          |                                             1.6 |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.1   | creator of SBOM                |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.1   | timestamp                      | 2026-07-14T08:10:34Z                            |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.1   | dependency graph completeness  | dependencies are recursively                    |  10.0 |
|                |         |                                | declared and structurally                       |       |
|                |         |                                | complete                                        |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.1*  | SBOM-URI                       | urn:uuid:1098fb5f-f097-4ecf-a873-747e7c22f126/1 |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | components                     | present                                         |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.4*    | signature                      |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.4*    | BOM links                      |                                                 |   0.0 |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
| Serilog-4.4.0  | 5.2.2   | component creator              |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component name                 | Serilog                                         |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component version              | 4.4.0                                           |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | filename                       |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | dependencies on other          | no-dependencies (leaf element)                  |  10.0 |
|                |         | components                     |                                                 |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | associated license             | compliant                                       |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | hash value of deployable       |                                                 |   0.0 |
|                |         | component                      |                                                 |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | executable property            |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | archive property               |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | structured property            |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | source code URI                | https://github.com/serilog/serilog              |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | URI of deployable form         |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | other unique identifiers       | purl: pkg:nuget/Serilog@4.4.0                   |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | concluded license              |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.4.1*  | declared license               | compliant                                       |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | hash value of source code      |                                                 |   0.0 |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
| SbomTest-0.0.0 | 5.2.2   | component creator              |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component name                 | SbomTest                                        |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component version              | 0.0.0                                           |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | filename                       |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | dependencies on other          | (all dependencies resolved)                     |  10.0 |
|                |         | components                     | Serilog                                         |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | associated license             | not-compliant                                   |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | hash value of deployable       |                                                 |   0.0 |
|                |         | component                      |                                                 |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | executable property            |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | archive property               |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | structured property            |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | source code URI                |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | URI of deployable form         |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | other unique identifiers       | purl: pkg:nuget/SbomTest@0.0.0                  |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | concluded license              |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.4.1*  | declared license               | not-compliant                                   |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | hash value of source code      |                                                 |   0.0 |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+

BSI TR-03183-2 v1.1 Compliance Report

Compliance score by Interlynk Score:7.0 RequiredScore:6.2 AdditionalScore:10.0 for /files/bom.json
* indicates optional fields
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
|   ELEMENTID    | SECTION |           DATAFIELD            |                 ELEMENT RESULT                  | SCORE |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
| SBOM           | 5.2.1   | creator of SBOM                |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.1   | timestamp                      | 2026-07-14T08:10:34Z                            |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.1   | dependency graph completeness  | dependencies are recursively                    |  10.0 |
|                |         |                                | declared and structurally                       |       |
|                |         |                                | complete                                        |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.1*  | SBOM-URI                       | urn:uuid:1098fb5f-f097-4ecf-a873-747e7c22f126/1 |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | components                     | present                                         |  10.0 |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
| SbomTest-0.0.0 | 5.2.2   | component creator              |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component name                 | SbomTest                                        |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component version              | 0.0.0                                           |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | dependencies on other          | (all dependencies resolved)                     |  10.0 |
|                |         | components                     | Serilog                                         |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | license                        |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | hash value of executable       |                                                 |   0.0 |
|                |         | component                      |                                                 |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | source code URI                |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | URI of deployable form         |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | hash value of source code      |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | other unique identifiers       | purl: pkg:nuget/SbomTest@0.0.0                  |  10.0 |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+
| Serilog-4.4.0  | 5.2.2   | component creator              |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component name                 | Serilog                                         |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | component version              | 4.4.0                                           |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | dependencies on other          | no-dependencies (leaf element)                  |  10.0 |
|                |         | components                     |                                                 |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | license                        | Apache-2.0 (compliant)                          |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.2.2   | hash value of executable       |                                                 |   0.0 |
|                |         | component                      |                                                 |       |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | source code URI                | https://github.com/serilog/serilog              |  10.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | URI of deployable form         |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | hash value of source code      |                                                 |   0.0 |
+                +---------+--------------------------------+-------------------------------------------------+-------+
|                | 5.3.2*  | other unique identifiers       | purl: pkg:nuget/Serilog@4.4.0                   |  10.0 |
+----------------+---------+--------------------------------+-------------------------------------------------+-------+

Framing Software Component Transparency (v3)

Compliance score by Interlynk Score:6.0 for /files/bom.json
* indicates optional fields
+----------------+----------+---------------------+--------------------------------+-------+----------------------+
|   ELEMENTID    | SECTION  |      DATAFIELD      |         ELEMENT RESULT         | SCORE |       MATURITY       |
+----------------+----------+---------------------+--------------------------------+-------+----------------------+
| SBOM Level     | 2.2.1.1  | SBOM Author         | SBOM author not declared       |   0.0 | Non-Compliant        |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.1.2  | SBOM Timestamp      | 2026-07-14T08:10:34Z           |  10.0 | Minimum Expected     |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.1.3* | SBOM Type           | SBOM type not declared;        |   0.0 | Minimum Expected     |
|                |          |                     | optional per FSCT              |       |                      |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.1.4  | Primary Component   | SbomTest                       |  10.0 | Minimum Expected     |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.6  | SBOM Relationship   | dependency relationship(1),    |   0.0 | None                 |
|                |          |                     | but dependency completeness    |       |                      |
|                |          |                     | missing for primary component  |       |                      |
+----------------+----------+---------------------+--------------------------------+-------+----------------------+
| Serilog-4.4.0  | 2.2.2.1  | Component Name      | Serilog                        |  10.0 | Minimum Expected     |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.2  | Component Version   | 4.4.0                          |  10.0 | Minimum Expected     |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.3  | Component Supplier  | Component supplier not         |   0.0 | Non-Compliant        |
|                |          |                     | declared                       |       |                      |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.4  | Component Unique ID | pkg:nuget/Serilog@4.4.0        |  10.0 | Minimum Expected     |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.5  | Component Checksum  | SHA512                         |  12.0 | Recommended Practice |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.7  | Component License   | Apache-2.0                     |  12.0 | Recommended          |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.8  | Component Copyright | Copyright © Serilog            |  10.0 | Minimum              |
|                |          |                     | Contributors                   |       |                      |
+----------------+----------+---------------------+--------------------------------+-------+----------------------+
| SbomTest-0.0.0 | 2.2.2.1  | Component Name      | SbomTest                       |  10.0 | Minimum Expected     |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.2  | Component Version   | 0.0.0                          |  10.0 | Minimum Expected     |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.3  | Component Supplier  | Component supplier not         |   0.0 | Non-Compliant        |
|                |          |                     | declared                       |       |                      |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.4  | Component Unique ID | pkg:nuget/SbomTest@0.0.0       |  10.0 | Minimum Expected     |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.5  | Component Checksum  | Component checksum not         |   0.0 | Non-Compliant        |
|                |          |                     | declared                       |       |                      |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.7  | Component License   |                                |   0.0 | None                 |
+                +----------+---------------------+--------------------------------+-------+----------------------+
|                | 2.2.2.8  | Component Copyright |                                |   0.0 | None                 |
+----------------+----------+---------------------+--------------------------------+-------+----------------------+

NTIA Report

Compliance score by Interlynk Score:9.1 RequiredScore:8.2 OptionalScore:10.0 for /files/bom.json
* indicates optional fields
+-------------------------+------------+-------------------------------+--------------------------------+-------+
|       ELEMENT ID        | SECTION ID |     NTIA MINIMUM ELEMENTS     |             RESULT             | SCORE |
+-------------------------+------------+-------------------------------+--------------------------------+-------+
| Automation Support      |        1.1 | Machine-Readable Formats      | cyclonedx, json                |  10.0 |
+                         +------------+-------------------------------+--------------------------------+-------+
|                         |        1.2 | SBOM generation tool declared | CycloneDX module for           |  10.0 |
|                         |            |                               | .NET-5.5.0.0                   |       |
+-------------------------+------------+-------------------------------+--------------------------------+-------+
| Required Document-level |        2.1 | Author                        | SBOM author inferred from SBOM |  10.0 |
|                         |            |                               | tool: CycloneDX module for     |       |
|                         |            |                               | .NET-5.5.0.0                   |       |
+                         +------------+-------------------------------+--------------------------------+-------+
|                         |        2.2 | Timestamp                     | 2026-07-14T08:10:34Z           |  10.0 |
+                         +------------+-------------------------------+--------------------------------+-------+
|                         |        2.3 | Dependencies                  | primary component declares 1   |  10.0 |
|                         |            |                               | top-level dependencies         |       |
+-------------------------+------------+-------------------------------+--------------------------------+-------+
| SbomTest-0.0.0          |        2.4 | Package Name                  | SbomTest                       |  10.0 |
+                         +------------+-------------------------------+--------------------------------+-------+
|                         |        2.6 | Package Supplier              | supplier not declared          |   0.0 |
+                         +------------+-------------------------------+--------------------------------+-------+
|                         |        2.7 | Package Version               | 0.0.0                          |  10.0 |
+                         +------------+-------------------------------+--------------------------------+-------+
|                         |        2.8 | Other Uniq IDs                | pkg:nuget/SbomTest@0.0.0       |  10.0 |
+-------------------------+------------+-------------------------------+--------------------------------+-------+
| Serilog-4.4.0           |        2.4 | Package Name                  | Serilog                        |  10.0 |
+                         +------------+-------------------------------+--------------------------------+-------+
|                         |        2.6 | Package Supplier              | supplier not declared          |   0.0 |
+                         +------------+-------------------------------+--------------------------------+-------+
|                         |        2.7 | Package Version               | 4.4.0                          |  10.0 |
+                         +------------+-------------------------------+--------------------------------+-------+
|                         |        2.8 | Other Uniq IDs                | pkg:nuget/Serilog@4.4.0        |  10.0 |
+-------------------------+------------+-------------------------------+--------------------------------+-------+

https://github.com/interlynk-io/sbomqs/blob/main/docs/reference/bsi-v21-compliance.md (and neighboring files) give hints on how the fields are mapped to the CycloneDX file.

Two things I already created tickets for:

• CycloneDX 1.6 metadata.manufacturer not working interlynk-io/sbomqs#701
• BSI 2.1.0 ignores author(s) as component creator interlynk-io/sbomqs#708

It would be great if we could have a joint effort to bring the tool chain to a good CRA compliant state. I am also going to create PRs for it.

[Falco20019]

The parts that I especially would expect to be set and see as missing:

• Distribution license (probably same as original license but missing "acknowledgement": "concluded")
• Hash of deployable component (SHA-512 hash already given as component.hashes, will try to get this changed in sbomqs)
• Executable property (bsi:component:executable probably always executable for share libraries)
• Archive property (bsi:component:archive probably always no archive for DLLs)
• Structured property (bsi:component:structured probably always structured for DLLs)
• URI of deployable form (externalReferences item with `"type": "distribution", url: "https://www.nuget.org/api/v2/package/<package_name>/<package_version>")
• Dependency graph completeness (compositions with "aggregate": "complete", "dependencies": ["<primary_component>"])
• SBOM type (metadata.lifecycles item with "phase": "build")

Optionally I could see:

• Effective license (probably same as original license)