1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.7"
serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"
version="1"
>
<metadata>
<timestamp>2025-05-01T14:23:00Z</timestamp>
<authors>
<author bom-ref="person-1">
<name>Alice Example</name>
<email>alice@example.com</email>
</author>
</authors>
</metadata>
<components>
<component type="library" bom-ref="component-1">
<name>example-lib</name>
<version>1.2.3</version>
<licenses>
<license>
<id>Apache-2.0</id>
</license>
</licenses>
</component>
</components>
<formulation>
<formula bom-ref="formula-1">
<components>
<component type="application" bom-ref="scan-tool-1">
<name>My Scan Tool</name>
</component>
</components>
<workflows>
<workflow bom-ref="workflow-1">
<uid>259bae74-5ec4-4de8-9386-c91b1f7719b8</uid>
<name>My workflow</name>
<tasks>
<task bom-ref="task-license-scan">
<uid>6d75f8d6-a008-41cf-8b65-c4129fc249f9</uid>
<description>License scan of the source files using OpenSourceScanner v2.1</description>
<taskTypes>
<taskType>scan</taskType>
</taskTypes>
</task>
</tasks>
<taskTypes>
<taskType>scan</taskType>
</taskTypes>
</workflow>
</workflows>
</formula>
</formulation>
<citations>
<citation bom-ref="citation-1">
<pointers>
<pointer>/components/0/name</pointer>
</pointers>
<timestamp>2025-05-01T14:00:00Z</timestamp>
<attributedTo>person-1</attributedTo>
<note>Manually entered by Alice Example - with `attributedTo`</note>
</citation>
<citation bom-ref="citation-2">
<pointers>
<pointer>/components/0/name</pointer>
</pointers>
<timestamp>2025-05-01T14:00:00Z</timestamp>
<attributedTo>person-1</attributedTo>
<note>Semi-manually entered by Alice Example - with `process`</note>
</citation>
<citation bom-ref="citation-3">
<expressions>
<expression>//*[@bom-ref='component-1']/version</expression>
</expressions>
<timestamp>2025-05-01T14:00:00Z</timestamp>
<attributedTo>person-1</attributedTo>
<note>Semi-manually entered by Alice Example - with `process`</note>
</citation>
<citation bom-ref="citation-4">
<expressions>
<expression>/components/component/licenses/license/id</expression>
</expressions>
<timestamp>2025-05-01T14:05:00Z</timestamp>
<attributedTo>scan-tool-1</attributedTo>
<process>task-license-scan</process>
<note>Auto-detected by license scanner tool - with both, 'attributedTo' and 'process'</note>
</citation>
</citations>
</bom>
|
