{
 "bomFormat": "CycloneDX",
 "specVersion": "1.6",
 "serialNumber": "urn:uuid:c6f2190d-c7fb-5541-ab7c-6e5c7cab8f9d",
 "version": 1,
 "metadata": {
  "timestamp": "2026-09-14T08:24:19Z",
  "tools": {
   "components": [
    {
     "type": "application",
     "name": "corecp-sbom",
     "version": "1",
     "description": "scripts/sbom.py, from supply-chain/inventory.json"
    }
   ]
  },
  "component": {
   "type": "application",
   "bom-ref": "pkg:deb/ubuntu/corecp-crs@4.25.1-corecp2?arch=all",
   "name": "corecp-crs",
   "version": "4.25.1-corecp2",
   "purl": "pkg:deb/ubuntu/corecp-crs@4.25.1-corecp2?arch=all",
   "description": "corecp-crs 4.25.1-corecp2 for all, built by corecp-sbuild",
   "licenses": [
    {
     "license": {
      "name": "the licences of the upstream sources listed as components"
     }
    }
   ],
   "hashes": [
    {
     "alg": "SHA-512",
     "content": "23c1afc9555394bf4b4b3e8346a7c615c7532aacc8453d9da4fa739a15efc4e8e20d17ce61a2aa65d0e65846cd34a1f1c87fd70ba8b30312e475771c5b49b341"
    },
    {
     "alg": "SHA-256",
     "content": "b7164e305e807fb38934c0464cdb6e4bb879e754dfde683bda55e119975e3009"
    }
   ],
   "properties": [
    {
     "name": "corecp:artifact:length",
     "value": "158972"
    },
    {
     "name": "corecp:source:commit",
     "value": "b2dd8b8d780f3b973050222ceb7054ab8b8c68c3"
    },
    {
     "name": "corecp:build:installed-build-depends",
     "value": "115"
    }
   ]
  },
  "properties": [
   {
    "name": "corecp:population",
    "value": "The upstream sources this package was built or repackaged from, each fetched and verified before the build started (infra/build-server/sbuild/recipes/crs.sh)."
   }
  ]
 },
 "components": [
  {
   "type": "library",
   "bom-ref": "coreruleset@4.25.1",
   "name": "coreruleset",
   "version": "4.25.1",
   "purl": "pkg:generic/coreruleset@4.25.1?download_url=https://github.com/coreruleset/coreruleset/releases/download/v4.25.1/coreruleset-4.25.1-minimal.tar.gz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "e314bc5b64a268ae4264822bc93db24eb93c5eb648ff80aed96b23f3fce2c701"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://github.com/coreruleset/coreruleset/releases/download/v4.25.1/coreruleset-4.25.1-minimal.tar.gz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "Apache-2.0"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in infra/build-server/sbuild/recipes/crs.sh after verifying upstream's OpenPGP signature"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in coreruleset-4.25.1/LICENSE"
    }
   ]
  }
 ]
}