# curie_map: # bom: "https://w3id.org/bom/" # spdx3-core: "https://spdx.org/rdf/3/terms/Core/" # spdx3-sw: "https://spdx.org/rdf/3/terms/Software/" # spdx3-ai: "https://spdx.org/rdf/3/terms/AI/" # spdx3-ds: "https://spdx.org/rdf/3/terms/Dataset/" # spdx3-sec: "https://spdx.org/rdf/3/terms/Security/" # spdx3-hw: "https://spdx.org/rdf/3/terms/Hardware/" # skos: "http://www.w3.org/2004/02/skos/core#" # semapv: "https://w3id.org/semapv/vocab/" # mapping_set_id: "https://w3id.org/bom/mapping/bom-to-spdx31" # mapping_set_version: "0.1.0" # mapping_set_title: "SBOM Bridge Concepts <-> SPDX 3.1-dev" # mapping_set_description: "Maps each concept in the document bridge ontology (bom.ttl) to the corresponding class or property in the SPDX 3.1-dev specification. This is the pivot file enabling first-pass auto-generation of per-standard SPDX 3 crosswalks: a source-standard concept that carries skos:exactMatch or skos:closeMatch to a bridge concept inherits the SPDX 3.1 mapping via a transitive join with this file. Manual per-standard SSSOM files (ntia-to-spdx31.sssom.tsv, g7ai-to-spdx31.sssom.tsv, etc.) override individual rows for higher precision where needed." # license: "https://creativecommons.org/publicdomain/zero/1.0/" # creator_id: # - "orcid:0000-0002-9698-1899" # mapping_date: "2026-06-17" # subject_source: "https://w3id.org/bom/" # object_source: "https://spdx.github.io/spdx-spec/v3.1-dev/" # see_also: # - "https://spdx.github.io/spdx-spec/v3.1-dev/" # - "https://w3id.org/bom/" subject_id subject_label predicate_id object_id object_label mapping_justification see_also comment object_qualifier bom:MetadataDocument Document Metadata skos:closeMatch spdx3-sw:Sbom Sbom semapv:ManualMappingCuration The BOM document corresponds to the Software.Sbom element (root of the SPDX graph). closeMatch: Sbom is a subclass of Element and carries CreationInfo metadata. spdx3-sw:Sbom bom:MetadataComponent Component Metadata skos:closeMatch spdx3-core:Artifact Artifact semapv:ManualMappingCuration Generic components (packages, files, snippets, AI models, datasets) all subclass Core.Artifact. closeMatch at the abstract level. spdx3-core:Artifact bom:CollectionSoftware Software Profile skos:closeMatch spdx3-sw:SoftwareArtifact SoftwareArtifact semapv:ManualMappingCuration Software-specific components (Package, File, Snippet) subclass Software.SoftwareArtifact. closeMatch. spdx3-sw:SoftwareArtifact bom:CollectionAI AI System and Model Profile skos:closeMatch spdx3-ai:AIPackage AIPackage semapv:ManualMappingCuration AI systems and models are represented as AI.AIPackage elements in the SPDX AI profile. closeMatch. spdx3-ai:AIPackage bom:CollectionDataset Dataset Profile skos:closeMatch spdx3-ds:DatasetPackage DatasetPackage semapv:ManualMappingCuration Datasets are represented as Dataset.DatasetPackage elements in the SPDX Dataset profile. closeMatch. spdx3-ds:DatasetPackage bom:CollectionInfra Infrastructure Profile skos:relatedMatch spdx3-sw:Package Package semapv:ManualMappingCuration Infrastructure components (container images, ML frameworks, hardware) are typically modelled as Package elements linked via RUNTIME_DEPENDENCY_OF / BUILD_DEPENDENCY_OF relationships, plus Hardware.Hardware for specialised accelerators. relatedMatch: no single SPDX class covers the full infra concept. spdx3-sw:Package bom:CollectionSecurity Security Profile skos:relatedMatch spdx3-sec:Vulnerability Vulnerability semapv:ManualMappingCuration Security concepts span multiple SPDX profiles: Security.Vulnerability + VEX Relationships for vulnerability referencing, AIPackage.standardCompliance for compliance, externalRef for policies. relatedMatch: no single SPDX class covers the full security concept. spdx3-sec:Vulnerability bom:doc-author Document author skos:exactMatch spdx3-core:createdBy createdBy semapv:ManualMappingCuration CreationInfo.createdBy references the Agent(s) — Person, Organization, or Tool — that authored the document. Exact semantic match. spdx3-core:CreationInfo bom:doc-timestamp Document timestamp skos:exactMatch spdx3-core:created created semapv:ManualMappingCuration CreationInfo.created is a mandatory xsd:dateTime recording when the document was created. Exact semantic match. spdx3-core:CreationInfo bom:doc-lifecycle-stage SBOM lifecycle stage skos:closeMatch spdx3-sw:sbomType sbomType semapv:ManualMappingCuration Software.Sbom.sbomType (SbomType vocabulary: build, analyzed, deployed, runtime, source, etc.) captures the lifecycle context in which the document was generated. closeMatch. Also called SBOM type (FSCT (3rd Ed.)/SPDX) or SBOM generation context (G7/CISA 2025). spdx3-sw:Sbom bom:doc-primary-component SBOM primary component skos:closeMatch spdx3-core:Relationship Relationship semapv:ManualMappingCuration The root component described by the document is linked via a DESCRIBES Relationship from the Sbom element to the primary Package/AIPackage. closeMatch at class level; the relationship type encodes the root-component role. spdx3-core:Element bom:MetadataRelationship SBOM dependency relationship skos:closeMatch spdx3-core:Relationship Relationship semapv:ManualMappingCuration Dependency relationships between components are expressed as first-class Relationship elements (DEPENDS_ON, CONTAINS, DESCRIBED_BY, TRAINED_ON, etc.). closeMatch at class level. bom:doc-version Document version skos:narrowMatch spdx3-core:version version semapv:ManualMappingCuration spdx3-core:version is defined for software package versions, hardware versions, and defined process versions — not for the document document itself. No dedicated SBOM-document-version field exists in SPDX 3.x. narrowMatch: version can be placed on any Element including Sbom, but this is informal reuse, not a specified use. Gap noted. spdx3-sw:Package bom:doc-spec-version SBOM spec version skos:closeMatch spdx3-core:specVersion specVersion semapv:ManualMappingCuration CreationInfo.specVersion records the SPDX specification version string (e.g. "3.1"). Covers the format-version aspect exactly; the format name is implicit in the SPDX serialisation choice. Partial fit for format-name; exact for format-version. spdx3-core:CreationInfo bom:doc-tool-name Document tool name skos:exactMatch spdx3-core:createdUsing createdUsing semapv:ManualMappingCuration CreationInfo.createdUsing references Tool elements; Tool.name carries the tool name. spdx3-core:CreationInfo bom:doc-tool-version Document tool version skos:exactMatch spdx3-core:createdUsing createdUsing semapv:ManualMappingCuration CreationInfo.createdUsing references Tool elements; Tool.version (in SPDX 3.1-dev) carries the tool version. spdx3-core:CreationInfo bom:doc-integrity SBOM integrity skos:narrowMatch spdx3-core:verifiedUsing verifiedUsing semapv:ManualMappingCuration Element.verifiedUsing + Hash covers hash-based integrity of the Sbom element. Native digital signatures (JWS/PGP) are attached externally as detached signatures, not within the SPDX document. Narrow match; signature gap noted. spdx3-core:Element bom:doc-identifier Document identifier skos:closeMatch spdx3-core:spdxId spdxId semapv:ManualMappingCuration The Sbom element's spdxId serves as its unique URI/persistent identifier in the SPDX graph. closeMatch: spdxId is required on all Elements, not specific to Sbom; the BSI-required "BOM-URI" corresponds to this IRI when dereferencing the SPDX document. spdx3-core:Element bom:component-name Component name skos:exactMatch spdx3-core:name name semapv:ManualMappingCuration Element.name carries the human-readable component name on any Element subclass (Package, File, AIPackage, DatasetPackage, etc.). Exact match. spdx3-core:Element bom:component-version Component version skos:exactMatch spdx3-sw:packageVersion packageVersion semapv:ManualMappingCuration Software.Package.packageVersion carries the version string for software packages and AI model packages. Exact match for package-type components. spdx3-sw:Package bom:component-supplier Component supplier skos:closeMatch spdx3-core:suppliedBy suppliedBy semapv:ManualMappingCuration Artifact.suppliedBy references the distributing or supplying Agent. closeMatch: the NTIA/FSCT (3rd Ed.) supplier concept conflates supplying and originating roles; suppliedBy covers the distribution side, originatedBy covers the original author. spdx3-core:Artifact bom:component-identifier Component identifier skos:exactMatch spdx3-sw:packageUrl packageUrl semapv:ManualMappingCuration Software.Package.packageUrl (PURL — Package URL) is the recommended stable external identifier for packages, AI models and datasets. Exact match for the primary external-identifier use case. spdx3-sw:Package bom:component-identifier Component identifier skos:closeMatch spdx3-core:externalIdentifier externalIdentifier semapv:ManualMappingCuration Element.externalIdentifier covers the full range of external IDs (CPE, PURL, SWID, Gitoid, DOI, etc.) when a structured multi-ID representation is needed. closeMatch for the general unique-identifier concept. spdx3-core:Element bom:component-hash Component hash skos:closeMatch spdx3-core:verifiedUsing verifiedUsing semapv:ManualMappingCuration Artifact.verifiedUsing contains Hash objects (algorithm + hashValue) for integrity verification. verifiedUsing is the entry point for the complete hash structure. closeMatch at property level; algorithm (HashAlgorithm vocabulary) and hashValue are the data fields within the referenced Hash object. spdx3-core:Artifact bom:MetadataRelationship Relationship Metadata skos:closeMatch spdx3-core:Relationship Relationship semapv:ManualMappingCuration Typed relationships between components — DEPENDS_ON, CONTAINS, TRAINED_ON, TESTED_ON, HAS_PREREQUISITE, DESCRIBES, etc. — are expressed as first-class Core.Relationship elements. closeMatch at class level. bom:component-license Component license skos:closeMatch spdx3-core:Relationship Relationship semapv:ManualMappingCuration In SPDX 3.x, licensing is expressed via Relationship elements with hasDeclaredLicense / hasConcludedLicense relationship types linking to AnyLicenseInfo elements. closeMatch: no single property carries the license expression; the Relationship + AnyLicenseInfo pattern encodes it. bom:component-copyright Component copyright skos:closeMatch spdx3-sw:copyrightText copyrightText semapv:ManualMappingCuration Software.SoftwareArtifact.copyrightText carries the copyright notice string for software artifacts (Package, File, Snippet). closeMatch: applies to SoftwareArtifact subclasses; no separate copyright field on non-software elements. spdx3-sw:SoftwareArtifact bom:component-timestamp Component timestamp skos:closeMatch spdx3-core:releaseTime releaseTime semapv:ManualMappingCuration Artifact.releaseTime captures the formal release date of a component. Primary match for released packages. Together with builtTime, covers the full component-timestamp concept. spdx3-core:Artifact bom:component-timestamp Component timestamp skos:closeMatch spdx3-core:builtTime builtTime semapv:ManualMappingCuration Artifact.builtTime captures the build or training date of a component. Primary match for AI model training timestamps and built artifacts. Together with releaseTime, covers the full component-timestamp concept. spdx3-core:Artifact bom:component-description Component description skos:exactMatch spdx3-core:description description semapv:ManualMappingCuration Element.description provides a free-text description applicable to any component type (Package, AIPackage, DatasetPackage, File, etc.). Exact match. spdx3-core:Element bom:component-external-ref Component external reference skos:closeMatch spdx3-core:externalRef externalRef semapv:ManualMappingCuration Element.externalRef (ExternalRef with locator, type, and optional comment) links to supplementary resources: model cards, research papers, source repositories, vulnerability advisories, security policies, etc. closeMatch: covers multiple reference categories via typed sub-fields. spdx3-core:Element bom:component-filename Component filename skos:closeMatch spdx3-sw:File File semapv:ManualMappingCuration The actual filename of a deployed component is the name of a Software.File element linked from the Package via hasDistributionArtifact or CONTAINS Relationship. closeMatch: no single filename property exists directly on Package; requires a File sub-element. The filename is Element.name on the File. spdx3-sw:Package bom:is-executable Is executable skos:closeMatch spdx3-sw:additionalPurpose additionalPurpose semapv:ManualMappingCuration Software.SoftwareArtifact.additionalPurpose (SoftwarePurpose vocabulary: executable, library, application, etc.) approximates the BSI TR-03183-2 executable flag. closeMatch: SoftwarePurpose categories (executable/library/application) partially overlap the BSI binary executable concept. spdx3-sw:SoftwareArtifact bom:is-archive Is archive skos:closeMatch spdx3-sw:additionalPurpose additionalPurpose semapv:ManualMappingCuration Software.SoftwareArtifact.additionalPurpose with purpose archive or container covers the BSI TR-03183-2 archive property. closeMatch: the SoftwarePurpose vocabulary does not distinguish all BSI archive subtypes; BSI CycloneDX extension property taxonomy fills the gap. spdx3-sw:SoftwareArtifact bom:is-structured Is structured skos:closeMatch spdx3-sw:additionalPurpose additionalPurpose semapv:ManualMappingCuration Software.SoftwareArtifact.additionalPurpose (e.g. container = structured, firmware = unstructured) partially covers the BSI TR-03183-2 structured property. closeMatch: the SPDX SoftwarePurpose vocabulary has no native structured/unstructured distinction; CycloneDX BSI property taxonomy provides finer granularity. spdx3-sw:SoftwareArtifact bom:ai-application-domain AI application domain skos:exactMatch spdx3-ai:domain domain semapv:ManualMappingCuration AI.AIPackage.domain (list of strings) enumerates the application domains (healthcare, finance, autonomous driving, etc.) for which the AI system is intended. Exact semantic match. spdx3-ai:AIPackage bom:ai-data-flow AI data flow skos:narrowMatch spdx3-ai:informationAboutApplication informationAboutApplication semapv:ManualMappingCuration No structured data-flow graph field exists in SPDX 3.1-dev. AI.AIPackage.informationAboutApplication (free text) is the closest container for a narrative data-flow description. Narrow match; gap noted for future AI profile extension. spdx3-ai:AIPackage bom:ai-data-usage AI data usage skos:closeMatch spdx3-ai:useSensitivePersonalInformation useSensitivePersonalInformation semapv:ManualMappingCuration AI.AIPackage.useSensitivePersonalInformation (PresenceType: yes/no/unknown) covers the sensitive-data usage aspect. informationAboutApplication covers broader data-usage narrative. Together a close match for data-usage documentation. spdx3-ai:AIPackage bom:ai-io-prop AI input/output property skos:narrowMatch spdx3-ai:informationAboutApplication informationAboutApplication semapv:ManualMappingCuration No structured I/O schema field exists in SPDX 3.1-dev. AI.AIPackage.informationAboutApplication and typeOfModel (modality) partially cover I/O interface documentation. Narrow match; gap noted for future structured I/O schema extension. spdx3-ai:AIPackage bom:ai-model-prop AI model property skos:broadMatch spdx3-ai:AIPackage AIPackage semapv:ManualMappingCuration Model property is a basket concept distributed across multiple AIPackage fields: typeOfModel, modelExplainability, autonomyType, energyConsumption, safetyRiskAssessment, limitation, metric, metricDecisionThreshold. Broad match at class level; no single property covers the full concept. spdx3-ai:AIPackage bom:ai-training-prop AI training property skos:closeMatch spdx3-ai:informationAboutTraining informationAboutTraining semapv:ManualMappingCuration AI.AIPackage.informationAboutTraining (free text), hyperparameter (key/value dict), modelDataPreprocessing and finetuningEnergyConsumption together cover training properties well. informationAboutTraining is the primary text-level match. spdx3-ai:AIPackage bom:dataset-type Dataset type skos:closeMatch spdx3-ds:datasetType datasetType semapv:ManualMappingCuration Dataset.DatasetPackage.datasetType (DatasetType vocabulary: image, text, audio, structured, sensor, syntactic, etc.) covers content modality. datasetSize and sensor properties add further content characterisation. closeMatch. spdx3-ds:DatasetPackage bom:dataset-provenance Dataset provenance skos:closeMatch spdx3-ds:dataCollectionProcess dataCollectionProcess semapv:ManualMappingCuration Dataset.DatasetPackage.dataCollectionProcess (how/where data was gathered), datasetUpdateMechanism (cadence), suppliedBy/originatedBy (who) together form the provenance cluster. dataCollectionProcess is the primary match for collection methodology. spdx3-ds:DatasetPackage bom:dataset-statistical-prop Dataset statistical property skos:closeMatch spdx3-ds:datasetSize datasetSize semapv:ManualMappingCuration Statistical properties span a basket: Dataset.DatasetPackage.datasetSize (count), datasetNoise (quality), knownBias (bias description), dataPreprocessing (preparation steps). datasetSize is the most concrete scalar field; no single property covers all statistical characteristics. closeMatch. spdx3-ds:DatasetPackage bom:dataset-sensitivity Dataset sensitivity skos:closeMatch spdx3-ds:hasSensitivePersonalInformation hasSensitivePersonalInformation semapv:ManualMappingCuration Dataset.DatasetPackage.hasSensitivePersonalInformation (PresenceType: yes/no/unknown), confidentialityLevel and anonymizationMethodUsed together form a strong sensitivity cluster. hasSensitivePersonalInformation is the primary match. spdx3-ds:DatasetPackage bom:infra-software Infrastructure software skos:closeMatch spdx3-sw:Package Package semapv:ManualMappingCuration Container images, ML frameworks (PyTorch, TensorFlow, CUDA), OS layers and runtime libraries are modelled as Software.Package elements linked to the root AIPackage via RUNTIME_DEPENDENCY_OF / BUILD_DEPENDENCY_OF Relationship elements. closeMatch at class level. spdx3-sw:Package bom:infra-hardware Infrastructure hardware skos:exactMatch spdx3-hw:Hardware Hardware semapv:ManualMappingCuration SPDX 3.1-dev introduces a Hardware profile (new in 3.1-dev vs 3.0.1). The Hardware.Hardware class covers specialised AI accelerators (GPUs, TPUs, NPUs) and other hardware components required to operate the AI system. Exact match. spdx3-hw:Hardware bom:security-controls Security controls skos:narrowMatch spdx3-core:externalRef externalRef semapv:ManualMappingCuration No first-class security-controls field in SPDX 3.1-dev. Element.externalRef with type securityPolicy or other links to external control-framework documents (NIST SP 800-53, ISO 27001, etc.). Narrow match; gap noted. spdx3-core:Element bom:security-compliance Security compliance skos:exactMatch spdx3-ai:standardCompliance standardCompliance semapv:ManualMappingCuration AI.AIPackage.standardCompliance (list of strings) records conformance to standards and regulations (EU AI Act, ISO/IEC 42001, NIST AI RMF, CRA, etc.). Exact semantic match for AI/ML system context. spdx3-ai:AIPackage bom:security-policy Security policy skos:narrowMatch spdx3-core:externalRef externalRef semapv:ManualMappingCuration No first-class security-policy property in SPDX 3.1-dev. Element.externalRef with type securityPolicy links to a vulnerability-disclosure policy (VDP) or security.txt file. Narrow match; gap noted. spdx3-core:Element bom:security-vuln-ref Vulnerability reference skos:exactMatch spdx3-sec:Vulnerability Vulnerability semapv:ManualMappingCuration SPDX 3.1-dev Security profile: Security.Vulnerability element combined with VEX assessment Relationship types (VexAffectedVulnAssessmentRelationship, VexFixedVulnAssessmentRelationship, VexNotAffectedVulnAssessmentRelationship, etc.) provides native CVE referencing and VEX status. Exact match. spdx3-sec:Vulnerability bom:security-metric Security metric skos:closeMatch spdx3-ai:metric metric semapv:ManualMappingCuration AI.AIPackage.metric (key/value dictionary) and metricDecisionThreshold carry security metrics (e.g. adversarial robustness). closeMatch because security metrics are distributed across properties. spdx3-ai:AIPackage bom:ai-perf-metric Operational perf metric skos:closeMatch spdx3-ai:metric metric semapv:ManualMappingCuration AI.AIPackage.metric (key/value dictionary) and metricDecisionThreshold carry operational metrics (accuracy, F1, latency). energyConsumption covers energy metrics. closeMatch because operational KPIs span two profile properties. spdx3-ai:AIPackage bom:component-source-code Component source code skos:closeMatch spdx3-sw:SoftwareArtifact SoftwareArtifact semapv:ManualMappingCuration Code components are represented as Software.SoftwareArtifact elements (often Package or File). closeMatch. spdx3-sw:SoftwareArtifact bom:component-documentation Component documentation skos:closeMatch spdx3-core:externalIdentifier externalIdentifier semapv:ManualMappingCuration Documentation distributed separately can be referenced via Element.externalIdentifier (e.g., using a url or doi). If included in the package, it would be a SoftwareArtifact. closeMatch. spdx3-core:Element bom:ai-model-card AI model card skos:closeMatch spdx3-core:externalIdentifier externalIdentifier semapv:ManualMappingCuration Model cards distributed separately can be referenced via Element.externalIdentifier. If bundled, they may be a File or externalRef. closeMatch. spdx3-core:Element bom:ai-model-parameters AI model parameters skos:closeMatch spdx3-core:Artifact Artifact semapv:ManualMappingCuration Model parameters (weights, checkpoints) are typically Artifacts (Files or Packages) linked to the AIPackage. closeMatch. spdx3-core:Artifact bom:dataset-data-card Dataset data card skos:closeMatch spdx3-core:externalIdentifier externalIdentifier semapv:ManualMappingCuration Data cards distributed separately can be referenced via Element.externalIdentifier. closeMatch. spdx3-core:Element