SBOM消费方验证与变更兼容治理（消费者-版本兼容-策略）最佳实践

实现示例type SbomMeta = { format: 'SPDX' | 'CycloneDX'; version: string; sha256: string } function hex64(h: string): boolean { return /^[A-Fa-f0-9]{64}$/.test(h) } function formatAllowed(f: 'SPDX' | 'CycloneDX', v: string): boolean { return (f === 'SPDX' && v === '2.3') || (f === 'CycloneDX' && v === '1.5') } function evaluate(m: SbomMeta): { ok: boolean; errors: string[] } { const errors: string[] = []; if (!formatAllowed(m.format, m.version)) errors.push('format'); if (!hex64(m.sha256)) errors.push('hash'); return { ok: errors.length === 0, errors } } 审计与运行治理审计消费者侧的兼容策略与验证记录；异常阻断并输出修复建议。版本策略变更需审批与归档。