CycloneDX 1.7 JSON Schema — official files vendored for fail-closed CBOM validation.

Primary (GitHub CycloneDX/specification tag 1.7):
  https://raw.githubusercontent.com/CycloneDX/specification/1.7/schema/bom-1.7.schema.json

Published copy (cyclonedx.org):
  https://cyclonedx.org/schema/bom-1.7.schema.json

The published cyclonedx.org copy is a different byte revision of the same $id.
This tree vendors the specification-tag 1.7 files plus the $ref companions
required to resolve cryptography-defs, JSF, and SPDX.

Fetched: 2026-08-12

sha256  bytes  file
df472ef4aaf593904c479293723a1a5c191d6672715c93b3c0b5c318f3914221  315607  bom-1.7.schema.json
8bae002c25e723db7ee1f26afde680ae1a2b1a8f6b4b4b0fd65dc3becb090aae    8058  jsf-0.82.schema.json
54a6288292bc6c90b0d3952f5f939f17436fa76704ffe68a46e5b78539c7cc1b   15883  spdx.schema.json
018ea7f78b5208ec647cfd10f669cc9c26aba6aceb79c4da7f9c0ef4c99b60de   16855  cryptography-defs.schema.json
8a2a72f5a72b55e360f843871a3ddf184af0ad48f05e886c356ad51e52883ef7   96476  cryptography-defs.json

cyclonedx.org published bom-1.7.schema.json (not vendored as primary):
71152f97948eeeca2fd4a1434a9d29aab35d377be11828b504d029dfeeb1925a  229588
