You can validate an SBOM from the command line with the Safeguard CLI validate command. It checks CycloneDX, SPDX and VEX documents against their specifications, accepts several files at once, and has strict and fail fast modes. Validate before you send an SBOM to a customer or load it anywhere.
Why bother validating
An SBOM that does not parse is worse than none, because the receiver finds out at the worst time. Common causes are a generator bug, a hand edit, a truncated upload, or the wrong format tag. A validation step in your release job catches these cheaply.
Validation checks structure, not truth. A perfectly valid file can still list the wrong components. Treat it as the first gate, with accuracy checks after it.
The basic command
safeguard validate sbom.json
The help text lists the supported inputs: CycloneDX in JSON or XML, SPDX in JSON, YAML, tag value or RDF, and VEX in CSAF or OpenVEX form.
Name the format when auto detection is not enough:
safeguard validate sbom.xml --format cyclonedx-xml
Strict mode, recursion and reports
The usage docs list these options:
safeguard validate ./sboms --recursive --strict --fail-fast -o report.json
- Recursive walks a folder.
- Strict turns warnings into errors.
- Fail fast stops at the first problem.
- The output option writes a report file you can attach to a build.
Start without strict, read the warnings once, then decide whether to enforce them. Turning on strict in a release job on day one tends to block shipping for cosmetic reasons.
Where it fits in a pipeline
A sensible order:
- Generate the SBOM.
- Validate it. Fail the job on errors.
- Scan it for vulnerabilities.
- Publish or attach it to the release.
The scan command can also take an existing SBOM as its target, so the same file can flow through steps two and three. Remember the scan takes one target per run.
What the validator will not tell you
- Whether every dependency is present. Compare against your lock file.
- Whether versions are correct. A generator can read a manifest range instead of the resolved version.
- Whether the minimum fields your customers expect are filled. Check those separately against the checklist your buyer or regulator uses.
Pick one format and be consistent
CycloneDX and SPDX both work for most needs. Choose based on what your customers and tools consume, and keep that choice stable. If you must supply both, generate both from the same source rather than converting one to the other, since conversion can drop fields.
Quick check
Does a valid SBOM mean an accurate SBOM?
No. Validation checks the document against the specification. It does not check whether the component list matches what you actually ship.
Which formats can the CLI validate?
CycloneDX in JSON or XML, SPDX in several encodings, and VEX in CSAF or OpenVEX form, according to the command help.
For a quick view of the components in a project, try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
