Back to The Linux Foundation
GSoC 2026

CISA 2025 SBOM Conformance and SPDX 3 Support

The current SPDX conformance tools do not support the upcoming 2025 CISA SBOM minimum elements draft or the newly introduced AI and Dataset profiles in the SPDX v3 specification. This project bridges that compliance gap. The solution involves generating updated Python bindings for the SPDX Python model and implementing a dedicated, decoupled CISA 2025 compliance checker class. The core deliverables include: updated Python bindings supporting new AI profiles, a fully integrated CISA 2025 conformance checker, and a robust Pytest suite using real-world SBOMs for regression testing.

Project details

Contributor

Induwara Gunasena

Mentors

Not available

Technologies

Not listed in the archive