{
 "bomFormat": "CycloneDX",
 "specVersion": "1.6",
 "serialNumber": "urn:uuid:d8165e46-3162-5915-ac07-401cdcae41fe",
 "version": 1,
 "metadata": {
  "timestamp": "2026-09-18T12:42:57Z",
  "tools": {
   "components": [
    {
     "type": "application",
     "name": "corecp-sbom",
     "version": "1",
     "description": "scripts/sbom.py, from supply-chain/inventory.json"
    }
   ]
  },
  "component": {
   "type": "application",
   "bom-ref": "pkg:deb/ubuntu/corecp-php84@8.4.26-5?arch=amd64",
   "name": "corecp-php84",
   "version": "8.4.26-5",
   "purl": "pkg:deb/ubuntu/corecp-php84@8.4.26-5?arch=amd64",
   "description": "corecp-php84 8.4.26-5 for amd64, built by corecp-sbuild",
   "licenses": [
    {
     "license": {
      "name": "the licences of the upstream sources listed as components"
     }
    }
   ],
   "hashes": [
    {
     "alg": "SHA-512",
     "content": "4e714d2223c08ec12418a7e06336be6314b70f0895ec92b4d64b466467452a8a6bfbee90b61dc238beee50b7cc0451392de1cb8de91cea37d4c9e7e4b37fcace"
    },
    {
     "alg": "SHA-256",
     "content": "0b990f2a1619ea9993a7fd47c3a8311e2f4ac501ccfde80ab430e0b8410c6d58"
    }
   ],
   "properties": [
    {
     "name": "corecp:artifact:length",
     "value": "16753950"
    },
    {
     "name": "corecp:source:commit",
     "value": "unknown: this build ran from a source tree with no git history (the build server holds an rsync copy), and no caller passed CORECP_SOURCE_COMMIT"
    },
    {
     "name": "corecp:build:installed-build-depends",
     "value": "329"
    }
   ]
  },
  "properties": [
   {
    "name": "corecp:population",
    "value": "The upstream sources this package was built or repackaged from, each fetched and verified before the build started (infra/build-server/sbuild/recipes/php.sh)."
   }
  ]
 },
 "components": [
  {
   "type": "library",
   "bom-ref": "pecl-apcu@5.1.24",
   "name": "pecl-apcu",
   "version": "5.1.24",
   "purl": "pkg:generic/pecl-apcu@5.1.24?download_url=https://pecl.php.net/get/apcu-5.1.24.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "5c28a55b27082c69657e25b7ecf553e2cf6b74ec3fa77d6b76f4fb982e001e43"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/apcu-5.1.24.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in apcu-5.1.24/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-igbinary@3.2.16",
   "name": "pecl-igbinary",
   "version": "3.2.16",
   "purl": "pkg:generic/pecl-igbinary@3.2.16?download_url=https://pecl.php.net/get/igbinary-3.2.16.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "8bf25d465abc7973d9e2c9a3039a5f8eea635b23bc1477017ff3999ff95836da"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/igbinary-3.2.16.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "BSD-3-Clause"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in igbinary-3.2.16/COPYING"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-imagick@3.8.1",
   "name": "pecl-imagick",
   "version": "3.8.1",
   "purl": "pkg:generic/pecl-imagick@3.8.1?download_url=https://pecl.php.net/get/imagick-3.8.1.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "3a3587c0a524c17d0dad9673a160b90cd776e836838474e173b549ed864352ee"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/imagick-3.8.1.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in imagick-3.8.1/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-imap@1.0.3",
   "name": "pecl-imap",
   "version": "1.0.3",
   "purl": "pkg:generic/pecl-imap@1.0.3?download_url=https://pecl.php.net/get/imap-1.0.3.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "0c2c0b1f94f299004be996b85a424e3d11ff65ac0a3c980db3213289a4a3faaf"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/imap-1.0.3.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in imap-1.0.3/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-memcached@3.4.0",
   "name": "pecl-memcached",
   "version": "3.4.0",
   "purl": "pkg:generic/pecl-memcached@3.4.0?download_url=https://pecl.php.net/get/memcached-3.4.0.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "c163434eb0da97c8f45c7ad41d979d381f8b81c49402b1b90b063987fb37972e"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/memcached-3.4.0.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in memcached-3.4.0/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-mongodb@2.4.1",
   "name": "pecl-mongodb",
   "version": "2.4.1",
   "purl": "pkg:generic/pecl-mongodb@2.4.1?download_url=https://pecl.php.net/get/mongodb-2.4.1.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "a57dc6bd18938ac2396086d9eec44bc82e7d17c399844923b04fe4cdff895ac0"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/mongodb-2.4.1.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "Apache-2.0"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in mongodb-2.4.1/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-msgpack@3.0.1",
   "name": "pecl-msgpack",
   "version": "3.0.1",
   "purl": "pkg:generic/pecl-msgpack@3.0.1?download_url=https://pecl.php.net/get/msgpack-3.0.1.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "e30be355ab79aaea4568692fbd6073fd7c7f50ea8d3cf12edce40fc0c921d868"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/msgpack-3.0.1.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "BSD-3-Clause"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in msgpack-3.0.1/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-redis@6.2.0",
   "name": "pecl-redis",
   "version": "6.2.0",
   "purl": "pkg:generic/pecl-redis@6.2.0?download_url=https://pecl.php.net/get/redis-6.2.0.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "5069c13dd22bd9e494bb246891052cb6cc0fc9a1b45c6a572a8be61773101363"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/redis-6.2.0.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in redis-6.2.0/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-xdebug@3.5.3",
   "name": "pecl-xdebug",
   "version": "3.5.3",
   "purl": "pkg:generic/pecl-xdebug@3.5.3?download_url=https://pecl.php.net/get/xdebug-3.5.3.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "f073de91bea046106abf4d6071c963ea71e58571df6ce58948ceca89d121cb2d"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/xdebug-3.5.3.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "Xdebug-1.03"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in xdebug-3.5.3/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "pecl-yaml@2.3.0",
   "name": "pecl-yaml",
   "version": "2.3.0",
   "purl": "pkg:generic/pecl-yaml@2.3.0?download_url=https://pecl.php.net/get/yaml-2.3.0.tgz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "bc8404807a3a4dc896b310af21a7f8063aa238424ff77f27eb6ffa88b5874b8a"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "https://pecl.php.net/get/yaml-2.3.0.tgz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "MIT"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 pinned in packages/php/php-recipe.sh (trust on first use; PECL publishes no digest)"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in yaml-2.3.0/LICENSE"
    }
   ]
  },
  {
   "type": "library",
   "bom-ref": "php@8.4.26",
   "name": "php",
   "version": "8.4.26",
   "purl": "pkg:generic/php@8.4.26?download_url=http://127.0.0.1:23768/distributions/php-8.4.26.tar.xz",
   "hashes": [
    {
     "alg": "SHA-256",
     "content": "4eddae31d11e97bf7371000b2abab8f0468c0de009ade6a877bbfdc0162b27d5"
    }
   ],
   "externalReferences": [
    {
     "type": "distribution",
     "url": "http://127.0.0.1:23768/distributions/php-8.4.26.tar.xz"
    }
   ],
   "licenses": [
    {
     "license": {
      "id": "PHP-3.01"
     }
    }
   ],
   "properties": [
    {
     "name": "corecp:source:verified",
     "value": "sha256 published by the php.net releases API"
    },
    {
     "name": "corecp:licence:source",
     "value": "detected in php-8.4.26/LICENSE"
    }
   ]
  }
 ]
}