SBOM conformance check — RaspberryPiOsLite

Project: RaspberryPiOsLite · Generated: 2026-10-26 17:08 UTC · Format: CycloneDX · Profile: default

Regulatory crosswalk

Framework	Present	Gap	Failed	Review	Total
BSI TR-03183-2 — SBOM data fields (EU CRA) Regulation (EU) 2024/2847 Annex I Part II(1); BSI TR-03183-2 v2.1.0 (2025-08-20)	7	5	1	1	14
US SBOM minimum elements "2026 Minimum Elements for a Software Bill of Materials (SBOM)" v2.1 (2026-07-29), authored by CISA, NSA and FBI with fifteen international partners including Germany's BSI, Japan's METI and Korea's KISA	12	7	0	4	23

BomLens does not certify or determine compliance with the EU AI Act, the Korean AI Framework Act, the EU Cyber Resilience Act, or any other regulation. This crosswalk covers only the documentation elements an SBOM can carry; obligations that an SBOM cannot express — bias and fairness assessment, risk management, human oversight — are out of its scope and must be met through separate documents. It makes documentation gaps visible so a person can prepare; interpreting it against a specific product's legal obligations is a person's job.

SBOM format requirements

What the SBOM itself has to carry. The same bar applies however the SBOM was produced, and a single mandatory failure makes the overall result a failure.

#	Status	Requirement	Required	Detail	Evidence / how
1	PASS	Spec version (CycloneDX 1.3/1.4/1.5/1.6/1.7) BSI TR-03183-2 Section 4	yes	CycloneDX 1.6
2	PASS	Timestamp (metadata.timestamp) BSI TR-03183-2 Section 5.2.1	yes	2026-10-26T16:57:12Z
3	PASS	Tool info (metadata.tools) BSI TR-03183-2 Section 5.2.1	yes	4 tool(s)
4	PASS	Top-level component name+version BSI TR-03183-2 Section 5.1	yes	2026-06-18-raspios-trixie-arm64-lite.img.xz@2026-06-18
5	FAIL	Component name+version coverage (100%) BSI TR-03183-2 Section 5.2.2	yes	1065/2860
6	PASS	PURL coverage (>= 90%) BSI TR-03183-2 Section 5.2.4	yes	99% (2835/2860); 8 identified by CPE instead
7	PASS	File component identifier coverage (hash, >= 80%, recommended)	no	100% (57262/57262)
8	WARN	Traceable PURL (no pkg:generic, advisory)	no	1904 untraceable
9	PASS	PURL syntax (pkg:type/[namespace/]name)	yes	0 malformed
10	PASS	PURL namespace where the type requires it (pkg:maven/<groupId>/name)	yes	0 without namespace
11	WARN	PURL namespace for golang/huggingface (advisory)	no	2 without namespace
12	PASS	PURL type defined by purl-spec (advisory)	no	0 undefined type(s)
13	PASS	Transitive dependencies (graph edges) BSI TR-03183-2 Section 5.1; 5.2.2	yes	2062 edge(s), graph completeness unknown (no positive evidence found, not a defect)
14	WARN	License coverage (>= 80%, recommended) BSI TR-03183-2 Section 5.2.2	no	4% (2772/60123)
15	PASS	Hash coverage (>= 50%, recommended) BSI TR-03183-2 Section 5.2.2	no	95% (57270/60123)
16	WARN	SHA-512 checksum coverage (>= 80%, recommended) BSI TR-03183-2 Section 5.2.2	no	0% (0/60123)
17	WARN	Component creator coverage (>= 80%, recommended) BSI TR-03183-2 Section 5.2.2	no	24% (700/2860)
18	WARN	Component filename coverage (>= 80%, recommended) BSI TR-03183-2 Section 5.2.2	no	0% (9/2860)
19	WARN	Source or distribution URI coverage (>= 80%, recommended) BSI TR-03183-2 Section 5.2.4	no	0% (0/2860)
20	REVIEW	Delivered-file properties (executable/archive/structured) BSI TR-03183-2 Section 5.2.2	no	requires inspecting the delivered files (no automated source in this scan)
21	WARN	SBOM author CISA 2026 SBOM Author	no	not present in the SBOM	How to fill this `"metadata": { "authors": [ { "name": "Example Manufacturing Co., Ltd." } ] }` Reference: cyclonedx.org
22	WARN	SBOM author signature CISA 2026 SBOM Author Signature	no	not present in the SBOM	What to establish A signature carried inside the document, or a detached one sitting next to the SBOM as <sbom-filename>.sig (cosign's own convention, e.g. from --sign), is detected automatically and this row will say so. A detached signature under a different name or location is not visible here, because this report only looks for that one convention. Verify it against the sender's key before treating the contents as theirs, and record that you did. Reference: www.cisa.gov
23	PASS	SBOM data format name CISA 2026 SBOM Data Format Name	no	present
24	PASS	SBOM data format version CISA 2026 SBOM Data Format Version	no	present
25	PASS	SBOM generation context CISA 2026 SBOM Generation Context	no	present
26	PASS	SBOM timestamp CISA 2026 SBOM Timestamp	no	present
27	PASS	SBOM tool name CISA 2026 SBOM Tool Name	no	present
28	PASS	SBOM tool version CISA 2026 SBOM Tool Version	no	present
29	PASS	SBOM version CISA 2026 SBOM Version	no	present
30	PASS	Component name CISA 2026 Component Name	no	60124/60124 component(s)
31	WARN	Component version CISA 2026 Component Version	no	2862/60124 component(s)
32	WARN	Component producer CISA 2026 Component Producer	no	700/60124 component(s)	How to fill this `"components": [ { "name": "libexample", "version": "1.2.3", "publisher": "The Example Project" } ]` Reference: cyclonedx.org
33	WARN	Component identifiers CISA 2026 Component Identifiers	no	60106/60124 component(s)	cpe:2.3:a:cli-32:cli-32::::::::, cpe:2.3:a:cli-64:cli-64::::::::, cpe:2.3:a:cli-arm64:cli-arm64::::::::, cpe:2.3:a:cli:cli::::::::, cpe:2.3:a:gui-32:gui-32::::::::, cpe:2.3:a:gui-64:gui-64::::::::, cpe:2.3:a:gui-arm64:gui-arm64::::::::, cpe:2.3:a:gui:gui::::::::, pkg:deb/debian/7zip@25.01%2Bdfsg-1~deb13u2?arch=arm64&distro=debian-13.5, pkg:deb/debian/adduser@3.152?arch=all&distro=debian-13.5, pkg:deb/debian/alsa-topology-conf@1.2.5.1-3?arch=all&distro=debian-13.5, pkg:deb/debian/alsa-ucm-conf@1.2.14-1?arch=all&distro=debian-13.5, pkg:deb/debian/alsa-utils@1.2.14-1%2Brpt1?arch=arm64&distro=debian-13.5, pkg:deb/debian/apparmor@4.1.0-1?arch=arm64&distro=debian-13.5, pkg:deb/debian/apt-listchanges@4.8?arch=all&distro=debian-13.5, pkg:deb/debian/apt-utils@3.0.3?arch=arm64&distro=debian-13.5, pkg:deb/debian/apt@3.0.3?arch=arm64&distro=debian-13.5, pkg:deb/debian/avahi-daemon@0.8-16?arch=arm64&distro=debian-13.5, pkg:deb/debian/base-files@13.8%2Bdeb13u5?arch=arm64&distro=debian-13.5, pkg:deb/debian/base-passwd@3.6.7?arch=arm64&distro=debian-13.5, pkg:deb/debian/bash-completion@2.16.0-7?arch=all&distro=debian-13.5&epoch=1, pkg:deb/debian/bash@5.2.37-2%2Bb9?arch=arm64&distro=debian-13.5, pkg:deb/debian/binutils-aarch64-linux-gnu@2.44-3?arch=arm64&distro=debian-13.5, pkg:deb/debian/binutils-common@2.44-3?arch=arm64&distro=debian-13.5, pkg:deb/debian/binutils@2.44-3?arch=arm64&distro=debian-13.5, pkg:deb/debian/bluez-firmware@1.2-13%2Brpt2?arch=all&distro=debian-13.5, pkg:deb/debian/bluez@5.82-1.1%2Brpt1?arch=arm64&distro=debian-13.5, pkg:deb/debian/bsdextrautils@2.41-5?arch=arm64&distro=debian-13.5, pkg:deb/debian/bsdutils@2.41-5?arch=arm64&distro=debian-13.5&epoch=1, pkg:deb/debian/build-essential@12.12?arch=arm64&distro=debian-13.5, pkg:deb/debian/busybox@1.37.0-6%2Bb8?arch=arm64&distro=debian-13.5&epoch=1, pkg:deb/debian/bzip2@1.0.8-6?arch=arm64&distro=debian-13.5, pkg:deb/debian/ca-certificates@20250419?arch=all&distro=debian-13.5, pkg:deb/debian/cifs-utils@7.4-1?arch=arm64&distro=debian-13.5&epoch=2, pkg:deb/debian/cloud-guest-utils@0.33-1?arch=all&distro=debian-13.5, pkg:deb/debian/cloud-init@25.2-1~bpo13%2B1%2Brpt20?arch=all&distro=debian-13.5, pkg:deb/debian/console-setup-linux@1.242~deb13u1?arch=all&distro=debian-13.5, pkg:deb/debian/console-setup@1.242~deb13u1?arch=all&distro=debian-13.5, pkg:deb/debian/coreutils@9.7-3?arch=arm64&distro=debian-13.5, pkg:deb/debian/cpio@2.15%2Bdfsg-2?arch=arm64&distro=debian-13.5, pkg:deb/debian/cpp-14-aarch64-linux-gnu@14.2.0-19?arch=arm64&distro=debian-13.5, pkg:deb/debian/cpp-14-for-host@14.2.0-19?arch=arm64&distro=debian-13.5, pkg:deb/debian/cpp-14@14.2.0-19?arch=arm64&distro=debian-13.5, pkg:deb/debian/cpp-aarch64-linux-gnu@14.2.0-1?arch=arm64&distro=debian-13.5&epoch=4, pkg:deb/debian/cpp@14.2.0-1?arch=arm64&distro=debian-13.5&epoch=4, pkg:deb/debian/cron-daemon-common@3.0pl1-197?arch=all&distro=debian-13.5, pkg:deb/debian/cron@3.0pl1-197?arch=arm64&distro=debian-13.5, pkg:deb/debian/curl@8.14.1-2%2Bdeb13u3?arch=arm64&distro=debian-13.5, pkg:deb/debian/dash@0.5.12-12?arch=arm64&distro=debian-13.5, pkg:deb/debian/dbus-bin@1.16.2-2?arch=arm64&distro=debian-13.5
34	WARN	Component license CISA 2026 Component License	no	2772/60124 component(s)
35	WARN	Component hash value CISA 2026 Component Hash Value	no	57271/60124 component(s)	How to fill this `"components": [ { "name": "libexample", "hashes": [ { "alg": "SHA-256", "content": "3b7c…" } ] } ]` Reference: cyclonedx.org
36	PASS	Component hash algorithm CISA 2026 Component Hash Algorithm	no	60124/60124 component(s)
37	PASS	Component dependency relationship CISA 2026 Component Dependency Relationship	no	present
38	PASS	Machine-processable data CISA 2026 Machine-Processable Data	no	present
39	REVIEW	Coverage CISA 2026 Coverage	no	requires human review (no automated source)	What to establish Establish that the SBOM lists every component making up the software, transitive dependencies included. No tool can confirm this from the document alone — the document cannot show what was left out of it. Compare it against the build's own dependency resolution, or against the manifests the software is built from. Reference: www.cisa.gov
40	REVIEW	Accommodation of updates to SBOM data CISA 2026 Accommodation of Updates to SBOM Data	no	requires human review (no automated source)	What to establish Establish that there is a way to correct SBOM data after it has been published, and that corrections go out promptly. This is a practice of the organisation issuing the SBOM, not a field in it. Reference: www.cisa.gov
41	REVIEW	Distribution and delivery CISA 2026 Distribution and Delivery	no	requires human review (no automated source)	What to establish Establish that whoever needs the SBOM can get it promptly, and that any access control keeps unauthorized parties out without blocking authorized ones or preventing the data from being loaded into their security tools. Reference: www.cisa.gov
42	PASS	Explicitly identifying unknown information CISA 2026 Explicitly Identifying Unknown Information	no	present
43	REVIEW	Frequency CISA 2026 Frequency	no	requires human review (no automated source)	What to establish Establish that each software version or update has an SBOM of its own, and that a revised SBOM is issued when the component data changes or an error in it is found. Reference: www.cisa.gov
44	N/A	PURL resolves in its repository (advisory)	no	repository lookup not run

Conformance check report

Regulatory crosswalk

SBOM format requirements

Missing / non-conformant items

Component name+version coverage (100%)

Traceable PURL (no pkg:generic, advisory)

PURL namespace for golang/huggingface (advisory)

Component version

Component producer

Component identifiers

Component license

Component hash value