{
 "bomFormat": "CycloneDX",
 "specVersion": "1.6",
 "serialNumber": "urn:uuid:1390db0c-80d5-5f20-8231-62dac42f50ad",
 "version": 1,
 "metadata": {
  "timestamp": "2026-09-14T10:29:51Z",
  "tools": {
   "components": [
    {
     "type": "application",
     "name": "corecp-sbom",
     "version": "1",
     "description": "scripts/sbom.py, from supply-chain/inventory.json"
    }
   ]
  },
  "component": {
   "type": "application",
   "bom-ref": "pkg:deb/ubuntu/corecp-lsphp56@5.6.40-5?arch=amd64",
   "name": "corecp-lsphp56",
   "version": "5.6.40-5",
   "purl": "pkg:deb/ubuntu/corecp-lsphp56@5.6.40-5?arch=amd64",
   "description": "corecp-lsphp56 5.6.40-5 for amd64, built by corecp-sbuild",
   "licenses": [
    {
     "license": {
      "name": "the licences of the upstream sources listed as components"
     }
    }
   ],
   "hashes": [
    {
     "alg": "SHA-512",
     "content": "ad3ddce330f6bacca282095b8fb912a9f1057464bd8675e7940403080e83d1f5f495c344b404684cc6bac886c96570fe31e542985aea6525a9674428dd3b2336"
    },
    {
     "alg": "SHA-256",
     "content": "b7649c8fb1df63ddb49dcbd4b927d0e0f0c9e616ef1e870eaa4decd7ae045980"
    }
   ],
   "properties": [
    {
     "name": "corecp:artifact:length",
     "value": "11148222"
    },
    {
     "name": "corecp:source:commit",
     "value": "5f42f3336aecdc732d6d15f393f4a79a47df2cb3"
    },
    {
     "name": "corecp:build:installed-build-depends",
     "value": "329"
    }
   ]
  },
  "properties": [
   {
    "name": "corecp:population",
    "value": "The upstream sources this package was built or repackaged from, each fetched and verified before the build started (infra/build-server/sbuild/recipes/php.sh)."
   }
  ]
 },
 "components": [
  {
   "type": "library",
   "bom-ref": "libxml2@2.9.14",
   "name": "libxml2",
   "version": "2.9.14",
   "purl": "pkg:generic/libxml2@2.9.14?download_url=https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.14.tar.xz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "60d74a257d1ccec0475e749cba2f21559e48139efba6ff28224357c7c798dfee"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.14.tar.xz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "MIT"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/build-deps.sh"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in libxml2-2.9.14/COPYING"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "openssl@1.0.2u",
   "name": "openssl",
   "version": "1.0.2u",
   "purl": "pkg:generic/openssl@1.0.2u?download_url=https://www.openssl.org/source/old/1.0.2/openssl-1.0.2u.tar.gz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "ecd0c6ffb493dd06707d38b14bb4d8c2288bb7033735606569d8f90f89669d16"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://www.openssl.org/source/old/1.0.2/openssl-1.0.2u.tar.gz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "OpenSSL"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/build-deps.sh"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in openssl-1.0.2u/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "openssl@1.1.1w",
   "name": "openssl",
   "version": "1.1.1w",
   "purl": "pkg:generic/openssl@1.1.1w?download_url=https://www.openssl.org/source/old/1.1.1/openssl-1.1.1w.tar.gz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://www.openssl.org/source/old/1.1.1/openssl-1.1.1w.tar.gz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "OpenSSL"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/build-deps.sh"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in openssl-1.1.1w/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-apcu@4.0.11",
   "name": "pecl-apcu",
   "version": "4.0.11",
   "purl": "pkg:generic/pecl-apcu@4.0.11?download_url=https://pecl.php.net/get/apcu-4.0.11.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "454f302ec13a6047ca4c39e081217ce5a61bbea815aec9c1091fb849e70b4d00"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/apcu-4.0.11.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "name": "unidentified — see the licence file in the source"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-igbinary@2.0.8",
   "name": "pecl-igbinary",
   "version": "2.0.8",
   "purl": "pkg:generic/pecl-igbinary@2.0.8?download_url=https://pecl.php.net/get/igbinary-2.0.8.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "bacbab1172e073b1857dc07a486bfdaca6d60fbed678ce0f4b37cd018ef5b680"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/igbinary-2.0.8.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "BSD-3-Clause"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in igbinary-2.0.8/COPYING"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-imagick@3.4.4",
   "name": "pecl-imagick",
   "version": "3.4.4",
   "purl": "pkg:generic/pecl-imagick@3.4.4?download_url=https://pecl.php.net/get/imagick-3.4.4.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "8dd5aa16465c218651fc8993e1faecd982e6a597870fd4b937e9ece02d567077"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/imagick-3.4.4.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in imagick-3.4.4/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-memcached@2.2.0",
   "name": "pecl-memcached",
   "version": "2.2.0",
   "purl": "pkg:generic/pecl-memcached@2.2.0?download_url=https://pecl.php.net/get/memcached-2.2.0.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "17b9600f6d4c807f23a3f5c45fcd8775ca2e61d6eda70370af2bef4c6e159f58"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/memcached-2.2.0.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in memcached-2.2.0/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-msgpack@0.5.7",
   "name": "pecl-msgpack",
   "version": "0.5.7",
   "purl": "pkg:generic/pecl-msgpack@0.5.7?download_url=https://pecl.php.net/get/msgpack-0.5.7.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "b8ee20cd0a79426c1abd55d5bbae85e5dcfbe0238abf9ce300685fbe76d94cdf"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/msgpack-0.5.7.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "BSD-3-Clause"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in msgpack-0.5.7/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-redis@4.3.0",
   "name": "pecl-redis",
   "version": "4.3.0",
   "purl": "pkg:generic/pecl-redis@4.3.0?download_url=https://pecl.php.net/get/redis-4.3.0.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "c0f04cec349960a842b60920fb8a433656e2e494eaed6e663397d67102a51ba2"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/redis-4.3.0.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in redis-4.3.0/COPYING"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-xdebug@2.5.5",
   "name": "pecl-xdebug",
   "version": "2.5.5",
   "purl": "pkg:generic/pecl-xdebug@2.5.5?download_url=https://pecl.php.net/get/xdebug-2.5.5.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "72108bf2bc514ee7198e10466a0fedcac3df9bbc5bd26ce2ec2dafab990bf1a4"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/xdebug-2.5.5.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "BSD-2-Clause"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in xdebug-2.5.5/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-yaml@1.3.2",
   "name": "pecl-yaml",
   "version": "1.3.2",
   "purl": "pkg:generic/pecl-yaml@1.3.2?download_url=https://pecl.php.net/get/yaml-1.3.2.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "5a8ed1b776e099c0dd8615b919ae3d6bc774c4ba04c2609a0f6e3877c72e599a"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/yaml-1.3.2.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "MIT"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in yaml-1.3.2/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "php@5.6.40",
   "name": "php",
   "version": "5.6.40",
   "purl": "pkg:generic/php@5.6.40?download_url=https://www.php.net/distributions/php-5.6.40.tar.xz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://www.php.net/distributions/php-5.6.40.tar.xz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 published by the php.net releases API"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in php-5.6.40/LICENSE"
    }
   ]
  }
 ]
}