SBOM validation and readiness report
Input: harbor-gateway-hg100-1.4.2.cdx.json · 6,171 bytes · CycloneDX 1.5. Generated at build time with the same code the validator runs in your browser.
Schema
passed
CycloneDX 1.5
Components
15
14 top-level · 1 nested
Query-ready
2/15
13.3% of applicable components
Dependency refs
1
6 relationships declared
The schema passes. The document is structurally valid and still mostly unmatchable. That gap is the reason this tool reports readiness instead of a pass/fail verdict.
Query readiness by reason
| Reason | Components | What it means |
|---|---|---|
missing_package_identity | 2 | No purl and no CPE. Nothing can map this component to an advisory. |
unsupported_ecosystem | 10 | The package type has no advisory-ecosystem mapping here. Most firmware components land in this group, which is why an OSV-only pipeline reports zero findings on them. |
missing_exact_version | 1 | The version is a placeholder, so no version range can be resolved. |
Query readiness is a property of the document. It is not a vulnerability count, and a low percentage does not mean the product is unsafe — it means an advisory-matching pipeline built on these identities would be blind to those components.
First findings as recorded
| Severity | Rule | Component | Path | Message |
|---|---|---|---|---|
| Error | DEPENDENCY_BROKEN_REFERENCE | — | /dependencies/4/dependsOn/0 | dependsOn target "pkg:generic/[email protected]" does not exist. |
| Warning | QUALITY_PLACEHOLDER_VERSION | lwip | /components/8 | Version "unknown" is a placeholder and is not suitable for exact matching. |
| Warning | QUALITY_MISSING_VERSION | vendor-bootloader | /components/12 | Component version is missing. |
| Warning | QUALITY_PLACEHOLDER_VERSION | @harbor/ui-bundle | /components/13 | Version "latest" is a placeholder and is not suitable for exact matching. |
| Info | QUALITY_MISSING_SUPPLIER | openssl-libcrypto | /components/0/components/0 | Supplier information is not provided. |
| Info | QUALITY_MISSING_SUPPLIER | dropbear | /components/4 | Supplier information is not provided. |
| Info | QUALITY_MISSING_SUPPLIER | sqlite | /components/5 | Supplier information is not provided. |
| Info | QUALITY_MISSING_SUPPLIER | zlib | /components/6 | Supplier information is not provided. |
Showing 8 of 25 recorded findings. The full list is in the validator when you run the same file.
Methodology, as published in the report
- readiness: Estimated readiness = Query Ready applicable software packages / Total applicable software packages. Hardware, firmware, files, services and other non-package objects are excluded from the denominator.
- queryReady: A package is Query Ready only when the local rules can determine an OSV ecosystem, a package name and an exact version. CPE presence does not make a package query-ready.
- schema: Validation uses the official JSON Schema for the declared specification version. Passing schema validation does not prove conformance with every normative requirement, CRA compliance or vulnerability status.
- dependency: Reference integrity is checked locally. A document without broken references does not prove that the dependency inventory is complete.
- privacy: The document is analyzed in the browser. No SBOM content is uploaded, logged or sent to any API by this tool.
Tool version 2.0.0 · generated 2026-11-03T00:00:00.000Z