{
  "tool_id": "art-135-cyclonedx-sbom-validator",
  "kernel_id": "art-135-cyclonedx-sbom-validator",
  "display_name": "CycloneDX SBOM Validator (EU CRA Annex I)",
  "tool_version": "1.0.0",
  "mandate_type": "compliance_mandate",
  "purpose": "Validates a CycloneDX SBOM against the EU CRA Annex I machine-readable SBOM requirement: bomFormat=CycloneDX, specVersion in [1.4,1.5,1.6], all components carry purl+name+version, top-level dependencies array present. Emits sbom_valid verdict and per-component gap list. Root stage of sbom-provenance-attestation chain.",
  "control_description": "Validates a CycloneDX SBOM against the EU CRA Annex I machine-readable SBOM requirement: bomFormat=CycloneDX, specVersion in [1.4,1.5,1.6], all components carry purl+name+version, top-level dependencies array present. Emits sbom_valid verdict and per-component gap list. Root stage of sbom-provenance-attestation chain.",
  "declared_inputs": [],
  "declared_outputs": [
    "art-136-slsa-provenance-verifier"
  ],
  "kernel_digest": "sha256:b678ddca7acdb020ecfe9ad3404580ffbc8bfc498caceee2042ab3574c957caf",
  "trust_label": "deferred -- deterministic source published, zkVM proof not yet generated",
  "data_vintage": "2026-07-10",
  "last_validated": "2026-07-10",
  "conformance_fixtures_vendored": true,
  "compute_proof_ready": "ready",
  "wave": 25,
  "source_url": "https://ainumbers.co/chaingraph/art-135-cyclonedx-sbom-validator.html",
  "generated_at": "2026-07-25T20:02:55.601Z"
}