Resources

SPDX resources

• SPDX project: https://spdx.dev/
• SPDX 3.0 spec: https://spdx.github.io/spdx-spec/v3.0/
• Model: https://spdx.org/rdf/3.0/spdx-model.ttl
• JSON Schema: https://spdx.org/schema/3.0/spdx-json-schema.json
• JSON-LD context: https://spdx.org/rdf/3.0/spdx-context.jsonld
• JSON-LD serialization annotation: https://spdx.org/rdf/3.0/spdx-json-serialize-annotations.ttl
• SPDX 3.1 spec (under development): https://spdx.github.io/spdx-spec/v3.1-dev/
• Terms: https://spdx.github.io/spdx-spec/v3.1-dev/terms-and-definitions/
• Model: https://spdx.org/rdf/3.1/spdx-model.ttl
• JSON Schema: https://spdx.org/schema/3.1/spdx-json-schema.json
• JSON-LD context: https://spdx.org/rdf/3.1/spdx-context.jsonld
• JSON-LD serialization annotation: https://spdx.org/rdf/3.1/spdx-json-serialize-annotations.ttl
• SPDX 3 JSON validation guide: https://github.com/spdx/spdx-3-model/blob/develop/serialization/jsonld/validation.md
• SPDX 3 model Python binding: https://github.com/spdx/spdx-python-model
• SPDX 3 model format and style guide (useful when reading model source files from spdx-3-model repo): https://github.com/spdx/spdx-3-model/blob/develop/docs/format.md
• SPDX examples: https://github.com/spdx/spdx-examples
• SBOM example using SPDX 3.0 AI and Dataset profiles: https://github.com/bact/sentimentdemo
• NTIA Conformance Checker test corpus: https://github.com/spdx/ntia-conformance-checker/tree/main/tests
• Validator: spdx3-validate on PyPI (https://pypi.org/project/spdx3-validate/); GitHub: https://github.com/JPEWdev/spdx3-validate

SBOM resources

• SBOM-Everywhere: https://sbom-catalog.openssf.org/ Guides and best practices for SBOM in open source projects.
• OpenChain SBOM Document Quality Guide Compliance Management Guide for the Supply Chain version 1.0.0: https://docs.google.com/document/d/1iuXX8j10N70dfce1-CZFWhW6S2jEqc--flcCgXMMdjg/edit?usp=sharing
• 2026 Minimum Elements for a Software Bill of Materials (SBOM): https://www.cisa.gov/resources-tools/resources/2026-minimum-elements-software-bill-materials-sbom https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf
• BSI TR-03183-2: Cyber Resilience Requirements for Manufacturers and Products - Part 2: Software Bill of Materials (SBOM) Version 2.1.0 https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03183/BSI-TR-03183-2_v2_1_0.pdf?__blob=publicationFile&v=5
• OpenChain AI SBOM Compliance Management Guide for the Supply Chain version 1.0: https://github.com/OpenChain-Project/Reference-Material/blob/master/AI-SBOM-Compliance/en/Artificial-Intelligence-System-Bill-of-Materials-Compliance-Management-Guide.md
• The State of Software Bill of Materials (SBOM) and Cybersecurity Readiness: https://www.linuxfoundation.org/research/the-state-of-software-bill-of-materials-sbom-and-cybersecurity-readiness
• SBOMs in the Era of the CRA: Toward a Unified and Actionable Framework: https://openssf.org/blog/2025/10/22/sboms-in-the-era-of-the-cra-toward-a-unified-and-actionable-framework/
• Challenges Facing the Security of the Software Supply Chain: https://linuxfoundation.eu/newsroom/the-state-of-the-secure-software-supply-chain
• Building an Open AIBOM Standard in the Wild: https://arxiv.org/abs/2510.07070 (design notes on SPDX 3.0 AI profile)
• What We Know about AIBOMs: Results from a Multivocal Literature Review on Artificial Intelligence Bill of Materials: https://dl.acm.org/doi/10.1145/3786773
• AIBoMGen: Generating an AI Bill of Materials for Secure, Transparent, and Compliant Model Training https://arxiv.org/abs/2601.05703
• An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead: https://arxiv.org/abs/2301.05362
• A shared G7 vision on software bill of materials for AI: Transparency and Cybersecurity along the AI supply chain: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/KI/SBOM-for-AI_Food-for-thoughts.html
• G7 Software Bill of Materials (SBOM) for Artificial Intelligence - Minimum Elements https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/KI/SBOM-for-AI_minimum-elements.html
• BOMs Away! Inside the Minds of Stakeholders: A Comprehensive Study of Bills of Materials for Software Systems: https://arxiv.org/abs/2309.12206
• A Landscape Study of Open-Source Tools for Software Bill of Materials (SBOM) and Supply Chain Security: https://arxiv.org/abs/2402.11151

AI documentation resources

• AIDOC-AP: An Application Profile for Technical Documentation of AI Systems: https://www.semantic-web-journal.net/system/files/swj4042.pdf https://github.com/CERTAIN-Project/aidoc-ap https://certain-project.github.io/aidoc-ap/
• TechOps: Technical Documentation Templates for the AI Act: https://arxiv.org/abs/2508.08804
• AICat: An AI Cataloguing Approach to Support the EU AI Act: https://arxiv.org/abs/2501.04014

Other resources

• Reproducible Builds -- SOURCE_DATE_EPOCH specification (the timestamp convention Pitloom honours for deterministic SBOM created/builtTime fields and embedded-wheel ZIP entries): https://reproducible-builds.org/specs/source-date-epoch/
• Agent Skills standard https://agentskills.io/
• SARIF (standard format for static analysis)
• https://sarifweb.azurewebsites.net/
• https://docs.oasis-open.org/sarif/sarif/v2.1.0/csprd01/sarif-v2.1.0-csprd01.html
• https://github.com/microsoft/sarif-tutorials/