FDA-SUP-001 warning

Every component declares a software level of support

Pack fda-524b 1.0.0

Severity: warning
FDA asks for this explicitly and by name, and no SBOM format has a field for it, so it is absent from essentially every generated file. It is a named item in real deficiency letters. Warning because the guidance says 'should' and permits it to be supplied in an addendum rather than in the SBOM.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*]","spdx":"$.packages[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: State for each component whether it is actively maintained, no longer maintained, or abandoned. FDA gives those three as its own examples. You may supply this in an addendum rather than inside the SBOM.
Source: fda-premarket-2026-02: Section V.A.4(b), first additional element
Note: NO FORMAT HAS A FIELD FOR THIS. Neither CycloneDX nor SPDX. Carry it as a namespaced property and say so in the submission. This gap is one of the reasons packages/eos exists.

Check a file against this

npx stratifypro check sbom.json --pack fda-524b
npx stratifypro explain FDA-SUP-001 --pack fda-524b prints this page.