{
  "tool_id": "art-138-spdx-sbom-validator",
  "kernel_id": "art-138-spdx-sbom-validator",
  "display_name": "SPDX SBOM Validator (EU CRA Annex I)",
  "tool_version": "1.0.0",
  "mandate_type": "compliance_mandate",
  "purpose": "Validates an SPDX SBOM against the EU CRA Annex I machine-readable SBOM requirement: spdxVersion matches SPDX-2.x or SPDX-3.x, SPDXID present, all packages carry name+versionInfo+downloadLocation (or purl externalRef), relationships array non-empty. Emits sbom_valid verdict and per-package gap list. Root stage of cra-product-conformance chain.",
  "control_description": "Validates an SPDX SBOM against the EU CRA Annex I machine-readable SBOM requirement: spdxVersion matches SPDX-2.x or SPDX-3.x, SPDXID present, all packages carry name+versionInfo+downloadLocation (or purl externalRef), relationships array non-empty. Emits sbom_valid verdict and per-package gap list. Root stage of cra-product-conformance chain.",
  "declared_inputs": [],
  "declared_outputs": [
    "art-139-cra-annex1-completeness-checker"
  ],
  "kernel_digest": "sha256:18c614b3a041c909a5b08d50674dbc1b0969d0fa0a9e3fa43bdea58ac7e1bf92",
  "trust_label": "deferred -- deterministic source published, zkVM proof not yet generated",
  "data_vintage": "2026-07-10",
  "last_validated": "2026-07-10",
  "conformance_fixtures_vendored": true,
  "compute_proof_ready": "ready",
  "wave": 25,
  "source_url": "https://ainumbers.co/chaingraph/art-138-spdx-sbom-validator.html",
  "generated_at": "2026-07-25T20:02:55.601Z"
}