Validate an SPDX SBOM: spdxVersion (2.x or 3.x), SPDXID document identifier, every package has name+versionInfo+downloadLocation (or purl externalRef), and relationships present. SPDX-format counterpart to ART-135. Feeds the CRA Annex I conformance checker (art-139).
SPDX 2.x / 3.xEU CRA Annex ISBOMFull applicability Dec 2027W3C VC §13.11Zero PIIClient-side only
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Scope
Root stage of the cra-product-conformance chain (art-138→139→140). SPDX-format SBOM validator: checks spdxVersion pattern (SPDX-2.x or SPDX-3.x), document identifier, each package must carry name+versionInfo+downloadLocation or a purl externalRef, and relationships must be present. Use art-135 for CycloneDX format. Both validate the EU CRA Annex I Part II(1) machine-readable SBOM requirement.