Do not convert and discard the original. Keep the supplier's native file, parse each format into one internal data model, and run conversion only for export. Conversion between formats can drop or reshape fields, so the original has to stay as the source of truth.
The three approaches
| Approach | How it works | Strength | Weakness |
|---|---|---|---|
| Convert on intake | Turn every file into one format, store only that | One code path | Lossy, original gone |
| Keep native, two code paths | Store and process each format as is | No loss | Double the logic |
| Parse to internal model, keep original | Read both formats into your own schema, store the file too | Single query layer, no loss of evidence | Needs a careful mapping |
The third is where most teams land.
Why formats do not map one to one
The formats model some things differently. SPDX records a document namespace that must be unique per document version, plus external document references with checksums. CycloneDX records a serial number and an integer version that rises on each modification, and it uses reference identifiers that must be unique within a BOM. Fields such as these have no exact twin, so a converter has to choose how to represent them.
What to test in a mapping
- Identity: document identifier and revision survive.
- Component identity: purl or CPE carried across.
- Relationships: dependency edges are preserved, not flattened.
- Licenses: expressions are not rewritten.
- Hashes: all algorithms kept.
- Supplier and author: neither is lost or swapped.
- Unknowns: an explicit statement that something is unknown does not become empty.
Run these on a few real files from different suppliers and compare the before and after. Document each loss you find, so your team knows what the internal model cannot see.
Decide by use case
If your main need is vulnerability matching, an internal model with component identifiers, versions and relationships is enough. If you need to republish or answer a customer who asks for a specific format, you want the original or a vetted export.
Do not promise perfect round trips
When you send a converted file to a customer, say it was converted, and by which tool. Do not present a converted file as the supplier's own.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at the fields shown for each component, and consider which would be lost in a lossy conversion.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning, and you can try a free scan to see the inventory view built from your files.
Quick check
Is it safe to delete the original after conversion?
No. The original is the evidence and may hold fields the converted file lacks.
Do both formats record the document revision?
Yes, but differently: a version integer with a serial number in CycloneDX, a unique namespace per version in SPDX.
Sources
- CycloneDX 1.6 JSON reference: serial number, version, reference uniqueness.
- SPDX 2.3.1, document creation information: namespace, external references.
Last reviewed: 19 October 2026.
