DataOps-platform/docs/security/cyclonedx-1.5-schema

CycloneDX 1.5 JSON Schema

These fixed validation inputs were retrieved from the official CycloneDX schema host on 2026-07-23:

• https://cyclonedx.org/schema/bom-1.5.schema.json (sha256:a00fcba23a44b72179ac1f288be4c3529b59f6e1b3719709a40685f177516b46)
• https://cyclonedx.org/schema/spdx.schema.json (sha256:c87aa7bb5eb503d40b52ec6bf00de8045df15da7a13cea48d290cf6d36a8d2ea)
• https://cyclonedx.org/schema/jsf-0.82.schema.json (sha256:2faf5eb3651f2ae5f46091a131770d8d847bbd121139d19c85fc7051bfa58c46)

The primary schema states that the CycloneDX JSON schema is published under the Apache License 2.0. The files are vendored so SBOM validation is deterministic and does not require network access.