{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-09T08:00:00Z",
    "manufacturer": {
      "name": "Example Studio",
      "contact": [
        {
          "email": "security@example.com"
        }
      ]
    },
    "component": {
      "type": "application",
      "bom-ref": "pkg:generic/example-shop@4.2.0",
      "name": "Example Shop",
      "version": "4.2.0",
      "manufacturer": {
        "name": "Example Studio",
        "contact": [
          {
            "email": "security@example.com"
          }
        ]
      },
      "licenses": [
        {
          "license": {
            "name": "Example Studio proprietary licence",
            "acknowledgement": "declared"
          }
        },
        {
          "license": {
            "name": "Example Studio proprietary licence",
            "acknowledgement": "concluded"
          }
        }
      ],
      "purl": "pkg:generic/example-shop@4.2.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://downloads.example.com/example-shop-4.2.0.apk",
          "hashes": [
            {
              "alg": "SHA-512",
              "content": "530d8bce8dfce0db8d14f67d28814857b806d7657f087c955fd8ff5e7364b1be2cdb052824297108ada5cdb6a6f596d347b0bba66ad286eb1ade7d36724d5d3d"
            }
          ]
        },
        {
          "type": "source-distribution",
          "url": "https://git.example.com/example-shop/tree/4.2.0"
        }
      ],
      "properties": [
        {
          "name": "bsi:component:filename",
          "value": "example-shop-4.2.0.apk"
        },
        {
          "name": "bsi:component:executable",
          "value": "executable"
        },
        {
          "name": "bsi:component:archive",
          "value": "archive"
        },
        {
          "name": "bsi:component:structured",
          "value": "structured"
        }
      ]
    },
    "properties": [
      {
        "name": "shipmark:example",
        "value": "Fictional example published by Shipmark (shipmark.eu/tools/sbom-checker/). Names, URLs and hashes are placeholders, not real packages."
      }
    ]
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:generic/example-networking@2.4.1",
      "name": "example-networking",
      "version": "2.4.1",
      "manufacturer": {
        "name": "Example Open Source Project",
        "url": [
          "https://example.org/networking"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause",
            "acknowledgement": "declared"
          }
        },
        {
          "license": {
            "id": "BSD-3-Clause",
            "acknowledgement": "concluded"
          }
        }
      ],
      "purl": "pkg:generic/example-networking@2.4.1",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://downloads.example.org/example-networking-2.4.1.tar.gz",
          "hashes": [
            {
              "alg": "SHA-512",
              "content": "7c1802b350e9608100722b4a6bc77336e3f4503906d20e4d940b8b40a0ff514de2f5b2cf5b583a1ec4b1db513ea9de28a53be3ec971fd3fe7e653ec53c28823b"
            }
          ]
        },
        {
          "type": "source-distribution",
          "url": "https://example.org/networking/source/2.4.1"
        }
      ],
      "properties": [
        {
          "name": "bsi:component:filename",
          "value": "example-networking-2.4.1.tar.gz"
        },
        {
          "name": "bsi:component:executable",
          "value": "non-executable"
        },
        {
          "name": "bsi:component:archive",
          "value": "archive"
        },
        {
          "name": "bsi:component:structured",
          "value": "structured"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:generic/example-json@1.9.0",
      "name": "example-json",
      "version": "1.9.0",
      "manufacturer": {
        "name": "Example Open Source Project",
        "url": [
          "https://example.org/json"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "MIT",
            "acknowledgement": "declared"
          }
        },
        {
          "license": {
            "id": "MIT",
            "acknowledgement": "concluded"
          }
        }
      ],
      "purl": "pkg:generic/example-json@1.9.0",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://downloads.example.org/example-json-1.9.0.tar.gz",
          "hashes": [
            {
              "alg": "SHA-512",
              "content": "3f51bc859baa4cd3a8d04abc92fd200d3d17a481cb7890d4260ed115c04b72b7ca5745bcb65ae9c5cca9e6b302562fdd29436c7f0c6f296ce8e14cae21055874"
            }
          ]
        },
        {
          "type": "source-distribution",
          "url": "https://example.org/json/source/1.9.0"
        }
      ],
      "properties": [
        {
          "name": "bsi:component:filename",
          "value": "example-json-1.9.0.tar.gz"
        },
        {
          "name": "bsi:component:executable",
          "value": "non-executable"
        },
        {
          "name": "bsi:component:archive",
          "value": "archive"
        },
        {
          "name": "bsi:component:structured",
          "value": "structured"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:generic/example-crypto@3.1.2",
      "name": "example-crypto",
      "version": "3.1.2",
      "manufacturer": {
        "name": "Example Open Source Project",
        "url": [
          "https://example.org/crypto"
        ]
      },
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0",
            "acknowledgement": "declared"
          }
        },
        {
          "license": {
            "id": "Apache-2.0",
            "acknowledgement": "concluded"
          }
        }
      ],
      "purl": "pkg:generic/example-crypto@3.1.2",
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://downloads.example.org/example-crypto-3.1.2.tar.gz",
          "hashes": [
            {
              "alg": "SHA-512",
              "content": "3625a03a4b539b26aeb57ef5db27f8c4c0bb3f02166b68c5789d9dddcb0d5d7802ae99f6dc0318615ce9bf4b2b6c27b0f9472c07946c1ae5b638f5f4695bb45a"
            }
          ]
        },
        {
          "type": "source-distribution",
          "url": "https://example.org/crypto/source/3.1.2"
        }
      ],
      "properties": [
        {
          "name": "bsi:component:filename",
          "value": "example-crypto-3.1.2.tar.gz"
        },
        {
          "name": "bsi:component:executable",
          "value": "non-executable"
        },
        {
          "name": "bsi:component:archive",
          "value": "archive"
        },
        {
          "name": "bsi:component:structured",
          "value": "structured"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:generic/example-shop@4.2.0",
      "dependsOn": [
        "pkg:generic/example-networking@2.4.1",
        "pkg:generic/example-crypto@3.1.2"
      ]
    },
    {
      "ref": "pkg:generic/example-networking@2.4.1",
      "dependsOn": [
        "pkg:generic/example-json@1.9.0"
      ]
    },
    {
      "ref": "pkg:generic/example-json@1.9.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:generic/example-crypto@3.1.2",
      "dependsOn": []
    }
  ],
  "compositions": [
    {
      "aggregate": "complete",
      "dependencies": [
        "pkg:generic/example-shop@4.2.0"
      ]
    }
  ]
}