Validation
SBOM validation and readiness report
A gateway firmware SBOM with vendor blobs and a placeholder version: schema passes, and the report shows exactly which components cannot be matched to advisories and why.
Real output, not a mock-up
Both example reports below are generated by the same engine that powers the free tools, run at build time against the synthetic firmware SBOM shipped with this site. Download the input files and reproduce the result yourself.
Comparison
Firmware release SBOM comparison
The same product at 1.4.2 and 1.4.3: a library update, an agent bump, one added component, and a vendor bootloader that disappeared from the declaration.
Inputs
The sample files
Synthetic data for a fictional product (“Harbor Gateway HG-100”). No customer data, no real firmware, no external downloads required.
- harbor-gateway-hg100-1.4.2.cdx.json — baseline, 13 declared components including one nested, one vendor blob without identity and one placeholder version.
- harbor-gateway-hg100-1.4.3.cdx.json — next release, with an updated library, a new component and a dropped bootloader declaration.
CycloneDX 1.5 JSON. These files are intentionally imperfect: a perfect sample would demonstrate nothing.