{
 "bomFormat": "CycloneDX",
 "specVersion": "1.6",
 "serialNumber": "urn:uuid:cb2fc988-f664-5a21-b358-74c1842adc27",
 "version": 1,
 "metadata": {
  "timestamp": "2026-09-14T09:27:51Z",
  "tools": {
   "components": [
    {
     "type": "application",
     "name": "corecp-sbom",
     "version": "1",
     "description": "scripts/sbom.py, from supply-chain/inventory.json"
    }
   ]
  },
  "component": {
   "type": "application",
   "bom-ref": "pkg:deb/ubuntu/corecp-php74@7.4.33-5?arch=amd64",
   "name": "corecp-php74",
   "version": "7.4.33-5",
   "purl": "pkg:deb/ubuntu/corecp-php74@7.4.33-5?arch=amd64",
   "description": "corecp-php74 7.4.33-5 for amd64, built by corecp-sbuild",
   "licenses": [
    {
     "license": {
      "name": "the licences of the upstream sources listed as components"
     }
    }
   ],
   "hashes": [
    {
     "alg": "SHA-512",
     "content": "447c47a67ab9cd98346e317b1823f87436a612a8e51017aed3ab245498587b08f295c56ff2f5e8650460532a63b463b1527cb531e35dbd1de7825fad8f1dd5eb"
    },
    {
     "alg": "SHA-256",
     "content": "86d6a353b448d522ebac52ea971448e46f7929c97d4332a49265db8af83f3aa4"
    }
   ],
   "properties": [
    {
     "name": "corecp:artifact:length",
     "value": "19256426"
    },
    {
     "name": "corecp:source:commit",
     "value": "b2dd8b8d780f3b973050222ceb7054ab8b8c68c3"
    },
    {
     "name": "corecp:build:installed-build-depends",
     "value": "329"
    }
   ]
  },
  "properties": [
   {
    "name": "corecp:population",
    "value": "The upstream sources this package was built or repackaged from, each fetched and verified before the build started (infra/build-server/sbuild/recipes/php.sh)."
   }
  ]
 },
 "components": [
  {
   "type": "library",
   "bom-ref": "libxml2@2.9.14",
   "name": "libxml2",
   "version": "2.9.14",
   "purl": "pkg:generic/libxml2@2.9.14?download_url=https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.14.tar.xz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "60d74a257d1ccec0475e749cba2f21559e48139efba6ff28224357c7c798dfee"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.14.tar.xz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "MIT"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/build-deps.sh"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in libxml2-2.9.14/COPYING"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "openssl@1.0.2u",
   "name": "openssl",
   "version": "1.0.2u",
   "purl": "pkg:generic/openssl@1.0.2u?download_url=https://www.openssl.org/source/old/1.0.2/openssl-1.0.2u.tar.gz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "ecd0c6ffb493dd06707d38b14bb4d8c2288bb7033735606569d8f90f89669d16"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://www.openssl.org/source/old/1.0.2/openssl-1.0.2u.tar.gz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "OpenSSL"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/build-deps.sh"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in openssl-1.0.2u/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "openssl@1.1.1w",
   "name": "openssl",
   "version": "1.1.1w",
   "purl": "pkg:generic/openssl@1.1.1w?download_url=https://www.openssl.org/source/old/1.1.1/openssl-1.1.1w.tar.gz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://www.openssl.org/source/old/1.1.1/openssl-1.1.1w.tar.gz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "OpenSSL"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/build-deps.sh"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in openssl-1.1.1w/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-apcu@5.1.24",
   "name": "pecl-apcu",
   "version": "5.1.24",
   "purl": "pkg:generic/pecl-apcu@5.1.24?download_url=https://pecl.php.net/get/apcu-5.1.24.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "5c28a55b27082c69657e25b7ecf553e2cf6b74ec3fa77d6b76f4fb982e001e43"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/apcu-5.1.24.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in apcu-5.1.24/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-igbinary@3.2.16",
   "name": "pecl-igbinary",
   "version": "3.2.16",
   "purl": "pkg:generic/pecl-igbinary@3.2.16?download_url=https://pecl.php.net/get/igbinary-3.2.16.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "8bf25d465abc7973d9e2c9a3039a5f8eea635b23bc1477017ff3999ff95836da"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/igbinary-3.2.16.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "BSD-3-Clause"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in igbinary-3.2.16/COPYING"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-imagick@3.7.0",
   "name": "pecl-imagick",
   "version": "3.7.0",
   "purl": "pkg:generic/pecl-imagick@3.7.0?download_url=https://pecl.php.net/get/imagick-3.7.0.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "5a364354109029d224bcbb2e82e15b248be9b641227f45e63425c06531792d3e"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/imagick-3.7.0.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in imagick-3.7.0/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-memcached@3.2.0",
   "name": "pecl-memcached",
   "version": "3.2.0",
   "purl": "pkg:generic/pecl-memcached@3.2.0?download_url=https://pecl.php.net/get/memcached-3.2.0.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "2a41143a7b29f4a962a3805b77aa207a99e4566e2d314ce98a051cd24d6e9636"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/memcached-3.2.0.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in memcached-3.2.0/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-mongodb@1.20.1",
   "name": "pecl-mongodb",
   "version": "1.20.1",
   "purl": "pkg:generic/pecl-mongodb@1.20.1?download_url=https://pecl.php.net/get/mongodb-1.20.1.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "614e57594918feb621f525e6516d59ce09b78f5172355ba8afb6c2207c1ce900"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/mongodb-1.20.1.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "Apache-2.0"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in mongodb-1.20.1/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-msgpack@2.2.0",
   "name": "pecl-msgpack",
   "version": "2.2.0",
   "purl": "pkg:generic/pecl-msgpack@2.2.0?download_url=https://pecl.php.net/get/msgpack-2.2.0.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "82aa1e404c5ff54ec41d2a201305cd6594ed14a7529e9119fa7ca457e4bbd12a"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/msgpack-2.2.0.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "BSD-3-Clause"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in msgpack-2.2.0/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-redis@6.2.0",
   "name": "pecl-redis",
   "version": "6.2.0",
   "purl": "pkg:generic/pecl-redis@6.2.0?download_url=https://pecl.php.net/get/redis-6.2.0.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "5069c13dd22bd9e494bb246891052cb6cc0fc9a1b45c6a572a8be61773101363"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/redis-6.2.0.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in redis-6.2.0/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-xdebug@2.9.8",
   "name": "pecl-xdebug",
   "version": "2.9.8",
   "purl": "pkg:generic/pecl-xdebug@2.9.8?download_url=https://pecl.php.net/get/xdebug-2.9.8.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "f555b6cc58d96c9965af942d22e0f1818b7a477a410c76b1ab0eebe85a762f8a"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/xdebug-2.9.8.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "BSD-2-Clause"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in xdebug-2.9.8/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-yaml@2.2.4",
   "name": "pecl-yaml",
   "version": "2.2.4",
   "purl": "pkg:generic/pecl-yaml@2.2.4?download_url=https://pecl.php.net/get/yaml-2.2.4.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "8eb353baf87f15b1b62ac6eb71c8b589685958a1fe8b0e3d22ac59560d0e8913"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/yaml-2.2.4.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "MIT"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in yaml-2.2.4/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "php@7.4.33",
   "name": "php",
   "version": "7.4.33",
   "purl": "pkg:generic/php@7.4.33?download_url=https://www.php.net/distributions/php-7.4.33.tar.xz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "924846abf93bc613815c55dd3f5809377813ac62a9ec4eb3778675b82a27b927"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://www.php.net/distributions/php-7.4.33.tar.xz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 published by the php.net releases API"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in php-7.4.33/LICENSE"
    }
   ]
  }
 ]
}