Skip to content

Add SPDX 3 SBOM naming #145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bact wants to merge 3 commits into
base: main
Choose a base branch
from
+17 −11
Open

Add SPDX 3 SBOM naming #145

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5a23077
Add SPDX 3 JSON SBOM naming
bact Aug 7, 2026
b287b8f
Add SPDX 3 RDF XML format to naming conventions
bact Aug 7, 2026
4825d78
Fix SPDX RDF XML file extension
bact Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 17 additions & 11 deletions SBOM-wiki/sbom-naming.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,17 +22,23 @@ For SBOMs which are distributed with source tarballs or pre-built binaries as a

Following [guidance](https://slsa.dev/spec/v1.0/distributing-provenance#relationship-between-artifacts-and-attestations) from SLSA provenance attestations of appending a corresponding extension to the filename of the artifact that is being described. For the [CycloneDX](https://cyclonedx.org/specification/overview/) and [SPDX](https://spdx.github.io/spdx-spec/v2.3/conformance/#44-standard-data-format-requirements) SBOM standards and their file extension formats the guidance is as follows:

| Standard + Format | Artifact Filename | SBOM Filename |
|-------------------|-------------------|---------------|
| CycloneDX JSON | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.cdx.json|
| CycloneDX XML | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.cdx.xml |
| SPDX TAG:VALUE | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx |
| SPDX JSON | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx.json |
| SPDX XML | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx.xml |
| SPDX YAML | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx.yml (or .yaml) |
| SPDX RDF XML | artifact-1.0.0.tar.gz | Artifact-1.0.0.tar.gz.spdx.rdf (or .rdf.xml)

The .spdx.* and .cdx.* extensions are sourced from the [CycloneDX](https://cyclonedx.org/guides/sbom/extensibility/) and [SPDX](https://spdx.github.io/spdx-ntia-sbom-howto/) guidance on filename extensions for SBOM documents of the corresponding standard and format.
| Standard + Format | Artifact Filename | SBOM Filename |
|-------------------|-----------------------|---------------|
| CycloneDX JSON | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.cdx.json |
| CycloneDX XML | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.cdx.xml |
| SPDX TAG:VALUE | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx |
| SPDX JSON | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx.json |
| SPDX XML | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx.xml |
| SPDX YAML | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx.yml (or .yaml) |
| SPDX RDF XML | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx.rdf |
| SPDX 3 JSON | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx3.json |
| SPDX 3 RDF XML | artifact-1.0.0.tar.gz | artifact-1.0.0.tar.gz.spdx3.rdf |

The .cdx.\*, .spdx.\*, and .spdx3.\* extensions are sourced from
the [CycloneDX](https://cyclonedx.org/guides/sbom/extensibility/),
the [SPDX 2](https://spdx.github.io/spdx-spec/v2.3/conformance/#44-standard-data-format-requirements), and
the [SPDX 3](https://spdx.github.io/spdx-spec/v3.1/serializations/#file-naming)
guidance on filename extensions for SBOM documents of the corresponding standard and format.

The JSON format files should be considered a mandatory requirement and are always available. The tool support for JSON documents is considered to be better than the other file format options. If other formats are desired, the JSON SBOM should also be available.

Expand Down