Drop the supplier's SPDX SBOM here
SPDX 2.2 / 2.3 JSON (.spdx.json). Everything runs locally in your browser - no data leaves this machine.
Tip: load the SPDX of a previous release to diff license changes between milestones.
License distribution by component count
SBOM quality NTIA minimum elements + audit checks
Dependency graph click a node for details · drag to pan · wheel to zoom
Critical - strong / network copyleft
High - weak / file copyleft
Medium - conditional
Low - permissive
Unknown / custom
Red edge = STATIC_LINK · Blue = DYNAMIC_LINK · Dashed = build/dev
Ring around a node = tainted by transitive copyleft
Findings
| Severity | Rule | Finding | Obligation | Recommended action |
|---|
Component inventory
| Component | Version | Effective license | Risk | Copyleft inherited from |
|---|