# CDX 1.7 + CBOM Fixtures (SC2/SC5/SC8)
- Golden payloads: `sample-cdx17-cbom.json`, downgraded `sample-cdx16.json`, with `hashes.txt` (BLAKE3, SHA256).
- Must include CVSS v4 + v3.1 ratings, CBOM ingress/egress, evidence properties, SLSA Source Track fields.
- Used by determinism CI to assert stable ordering/hashes.