CISA-MD-005 warning

SBOM Generation Context is declared

Pack cisa-2026-v2.1 1.0.0

Severity: warning
Without it a consumer cannot tell whether a missing component hash means the artifact was unavailable or the data is simply absent. This element is what makes CISA-CD-003's 'unknown' answer legible instead of suspicious.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.metadata","spdx":"$.creationInfo"}
On an empty selector: fire
The selector names a specific object the assertion inspects. When that object is absent the information the rule exists to check was not supplied at all, which is a stronger failure than supplying it badly. Reporting nothing would make a missing section indistinguishable from a satisfied one.
Fix: Record the lifecycle phase the SBOM was generated in. The document accepts general references such as 'before build', 'build' and 'after build', as well as more specific identifiers.
Source: cisa-2026-v2.1: SBOM Metadata, element 5, SBOM Generation Context (New)
Note: Footnote 5 defines build as 'compilation, interpretation, or another process that makes source code executable'. CycloneDX lifecycles is the closest native construct; SPDX has none, so a property or comment is the practical carrier.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-MD-005 --pack cisa-2026-v2.1 prints this page.