score
Evidence
Affected examples
Recommended action
Related IDs
SPDX
Created
By
Browse this SBOM
Only data present in this document is shown.
Graph layout
Risk heatmap
low → high
click to show/hide
Nodes:
Edges:
Scope:
Filter by what's missing:
files
Filter by most-used extension:
Summary
Description
License
Contained in
Built with
Build Configuration
Produced by build
Consumed by builds
Statically linked
Summary
Description
Part number
Category
Manufacturer
Identifiers
Supply Chain
Transport CO₂e
·
Timeline
↓ later
Performed by
Description
No supply-chain elements match these filters
Chain of custody
Who held the product, for how long, and what happened on their watch.
Transfer of
at
·
→
No custody or ownership transfers recorded
State machine
Each StateAction moves the product into a state; transitions are labelled with their
decision process.
state
out-of-spec
positive step
Click a state to jump to its step below.
Trajectory
-
via
No state transitions recorded
Defined processes
The plans that say how each phase should be done. Actions execute them.
Definition only: no matching action observed in this dataset.
No defined processes recorded
Route map
The product's physical journey across locations.
Road
Air
Rail
Sea
Schematic layout: locations could not be geocoded, so order follows the journey.
No locations recorded for this supply chain
·
No requirements match these filters
No requirements match these filters
Summary
Description
Note
Linked evidence
Identifiers
Verification & evaluation
Precondition
Postcondition
Evaluation rationale
No license matches
Narrow to one package and everything it pulls in, which is the unit a compatibility check is really about.
Summary
Description
Declared by
None
Concluded by
None
No licenses found
This is not legal advice.
Compatibility depends on many factors your SBOM may not capture, or may get wrong. Only a lawyer can make that call.
None of the licenses in this document are covered by the OSADL compatibility matrix, so
there is nothing to check them against. The matrix rates 119 widely used licenses; custom
LicenseRef- licenses are never among them.
Every element this scope reaches declares NoAssertion, so there is no license to check. Some SBOMs record licenses on a separate tree of source packages that the build tree does not link to; the licenses are in the document, just not reachable from here.
OSADL rates open source licenses against each other and has no proprietary row, so this
answer is derived: a component clears a closed-source product when every permissive
outbound license in the matrix can absorb it. Weak-copyleft licenses (LGPL, MPL, EPL and
the like) therefore show as conflicts here, though whether they are usable in a closed
product depends on how you link them, which the matrix does not model.
Carried by
Element counts overlap: one package often declares several licenses, so the four figures above do not sum to the number of elements.
Better outbound licenses
These conflict with less of what is in scope. Pick one to re-run the check.
No license in the matrix clears everything in scope. That is the normal answer for a whole OS image, where packages ship alongside each other rather than as one combined work. Narrow the scope to a single package to ask a sharper question.
Coverage
elements declare no license
Nothing can be checked for them, so the verdict above covers only the elements that do carry one. That is a completeness gap in the SBOM rather than a compatibility problem.
None of this document's licenses resolve to a single identifier the matrix rates, so
there is no grid to draw. Compound expressions and custom
LicenseRef- licenses cannot be plotted.
Reading the grid
A row is the license of the combined work, a column the license of a component going into it. The relation runs one way, so the two halves differ.
←
Hover a cell to see what it means.
Compatibility rules from the OSADL Open Source License Checklists, dated , covering 119 licenses. A project by the Open Source Automation Development Lab (OSADL) eG, copyright 2017 to OSADL eG and contributors, licensed CC-BY-4.0. Informational only, not legal advice.
Public vulnerability databases
OSV
NVD
NVD options · bundled index · live lookup
NVD source
Use a pre-indexed local NVD snapshot (fast) or query NVD live (slower).
This product uses data from the
NVD
but is not endorsed or certified by the NVD. CVE is a registered trademark of MITRE. See
the
NVD Terms of Use.
No additional vulnerabilities were found online for this SBOM's components.
Referenced files in this SBOM
Severity
Source
A VEX statement clears for
. Any files listed below are linked for reference only.
Jump to
Summary
Description
Risk assessment
Known exploited
Source: this SBOM's risk assessment
Loading CVE details…
Files referenced by this CVE
- in
Files are matched to this SBOM by path from the CVE record, not declared by the SBOM itself. A file tagged “Not affected” or “Fixed” is cleared by a VEX statement: it's linked here for reference, not as an open issue.
Functions referenced by this CVE
Modules referenced by this CVE
Source: CVE Program · cve.org
VEX assessments
No VEX status recorded for this vulnerability.
No vulnerabilities match your filters
No known vulnerabilities were found in the SBOM or online.
This SBOM carries no vulnerability data.
Use “Check public databases” above to look up known CVEs by PackageURL and CPE.
Configures:
Summary
Description
Compiler Flags
Optimization
Warnings
Features
Machine
Standard
Debug
Preprocessor Defines
Configured Targets
Full Compile Command
No build configurations found
Try a different search or load an SPDX file with build info
Build
Build ID
Created
Build steps
Environment entries
Parameters
Config Sources
Build Parameters
Raw value
Build Steps
/
Outputs:
Inputs:
Params:
Tools:
Summary
Description
None
None
Command
Raw value
Build Tools
Generated Artifacts
People, organizations, and software agents referenced across the document — and everything they created, supplied, originated, or manufactured.
No agents match your filter.
·
· syntax highlighting off for large file
This file is too large to display inline ().
Statistics
Quality, structure, and relationship signals for this SBOM.
/ 100
SBOM Quality Score
A completeness score across this document's packages, weighted over five categories based on the NTIA "minimum elements" baseline. It is not a security or license-compliance measure; see the breakdown below for what to fix first.
Relationship Repartition
Graph-visible relationship edges by type. Switch scope to isolate lifecycle layers.
No graph-visible relationships in this document.
Click a slice to open the graph focused on that relationship type and scope.
NTIA Minimum Elements
Cross-checked with
spdx/ntia-conformance-checker in CI
(document level)
Remediation
CISA 2026 Minimum Elements
Data fields from the 2026 SBOM baseline. Signature is advisory; SBOM Version is N/A for SPDX 3.
Remediation
Category Breakdown
Categories with nothing to measure in this document (e.g. no files) are excluded and the remaining weights are renormalized.
License Family Exposure
Best-effort classification by license id — a heuristic, not legal advice.
Supply-Chain Concentration
Packages the most other packages depend on — the highest-impact links if compromised.
External Reference Resolution
Elements this document references but doesn't define (SPDX ExternalMap imports).
Resolved
Unresolved
Vulnerability Triage
How much of this document's known vulnerabilities have a resolved VEX status.
Resolved
Still open
Unknown
Remediation
Triage concrete SBOM data gaps and open risk findings.
Category
Severity
No remediation findings
The loaded SBOM does not currently produce actionable remediation findings.
No findings match these filters
Impact
Pick one element to trace why it is present and what would be affected by a change.
Find an element
Search packages, files, and other dependency-graph nodes.
elements
edges
roots
Search for a specific element, or open one of the highest-reach elements on the right.
No matching dependency-graph elements.
Highest reach
transitive dependents
No dependency relationships to rank.
Vulnerable × blast radius
CVSS present
Ranked by reach, not severity: a Medium in a
widely-used library can outrank a Critical in a leaf. Severity is the worst of each
package's CVEs.
Reachability
Direct dependents
Total dependents
Why it is here
This is a document root. Nothing else pulls it in.
No dependency or containment path from a document root reaches this element.
optional
What depends on it
Nothing depends on this element in the dependency graph.
Downstream graph
selected + dependents
selected
depends on
it