{
 "bomFormat": "CycloneDX",
 "specVersion": "1.6",
 "serialNumber": "urn:uuid:adba1ecd-81d7-5490-97d8-16b17b7d2f0b",
 "version": 1,
 "metadata": {
  "timestamp": "2026-09-17T06:37:59Z",
  "tools": {
   "components": [
    {
     "type": "application",
     "name": "corecp-sbom",
     "version": "1",
     "description": "scripts/sbom.py, from supply-chain/inventory.json"
    }
   ]
  },
  "component": {
   "type": "application",
   "bom-ref": "pkg:deb/ubuntu/corecp-modsecurity2@2.9.14+corecp1?arch=amd64",
   "name": "corecp-modsecurity2",
   "version": "2.9.14+corecp1",
   "purl": "pkg:deb/ubuntu/corecp-modsecurity2@2.9.14+corecp1?arch=amd64",
   "description": "corecp-modsecurity2 2.9.14+corecp1 for amd64, built by corecp-sbuild",
   "licenses": [
    {
     "license": {
      "name": "the licences of the upstream sources listed as components"
     }
    }
   ],
   "hashes": [
    {
     "alg": "SHA-512",
     "content": "653e9debf36271fde3795fe8d20425548f1ece8c8da3fbd5a16e7a18f4863673731185af7f1b79a05088616614651948d354cb88aab5b11ad7571e20937706b0"
    },
    {
     "alg": "SHA-256",
     "content": "815b2837335b635894fb5a6575bcf89efbba09f8d5238601c7284de56e9dbec3"
    }
   ],
   "properties": [
    {
     "name": "corecp:artifact:length",
     "value": "242334"
    },
    {
     "name": "corecp:source:commit",
     "value": "aa1adb4229eec26fcb0a188af985bf99c6e0b735"
    },
    {
     "name": "corecp:build:installed-build-depends",
     "value": "191"
    }
   ]
  },
  "properties": [
   {
    "name": "corecp:population",
    "value": "The upstream sources this package was built or repackaged from, each fetched and verified before the build started (infra/build-server/sbuild/recipes/modsecurity.sh)."
   }
  ]
 },
 "components": [
  {
   "type": "library",
   "bom-ref": "modsecurity@2.9.14",
   "name": "modsecurity",
   "version": "2.9.14",
   "purl": "pkg:generic/modsecurity@2.9.14?download_url=https://github.com/owasp-modsecurity/ModSecurity/releases/download/v2.9.14/modsecurity-v2.9.14.tar.gz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "746217af916a0c6db9eb6e2610e64090833e1b2f1aa7ae7babda9cf2476f4d8c"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://github.com/owasp-modsecurity/ModSecurity/releases/download/v2.9.14/modsecurity-v2.9.14.tar.gz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "Apache-2.0"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in infra/build-server/sbuild/recipes/modsecurity.sh after verifying upstream's OpenPGP signature (key 0B2BA1924065B44691202A2AD286E022149F0F6E)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in modsecurity-v2.9.14/LICENSE"
    }
   ]
  }
 ]
}