{
  "chain": "sbom-provenance-attestation",
  "question": "We attach a CycloneDX SBOM to the release for the CRA file. Does the attached SBOM meet the machine readable bar?",
  "look_at": "art-135-cyclonedx-sbom-validator.sbom_valid",
  "try_changing": {
    "step": "art-135-cyclonedx-sbom-validator",
    "field": "sbom",
    "value_note": "the express component carries no purl"
  }
}