github.com/CycloneDX/sbom-utility@v0.16.0/examples/cyclonedx/usecases/cdx-use-case-composition-and-completeness.json (about)

     1  {
     2        "bomFormat":"CycloneDX",
     3        "specVersion":"1.4",
     4        "serialNumber":"urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
     5        "version":1,
     6        "metadata":{
     7            "component":{
     8                "bom-ref":"acme-application-1.0",
     9                "type":"application",
    10                "name":"Acme Application",
    11                "version":"1.0"
    12            }
    13        },
    14        "components":[
    15            {
    16                "bom-ref":"pkg:maven/partner/shaded-library@1.0",
    17                "type":"library",
    18                "name":"Partner Shaded Library",
    19                "version":"1.0",
    20                "purl":"pkg:maven/partner/shaded-library@1.0",
    21                "components":[
    22                    {
    23                        "bom-ref":"pkg:maven/ossproject/library@2.0",
    24                        "type":"library",
    25                        "name":"Some Opensource Library",
    26                        "version":"2.0",
    27                        "purl":"pkg:maven/ossproject/library@2.0"
    28                    }
    29                ]
    30            },
    31            {
    32                "type":"library",
    33                "name":"Acme Library",
    34                "version":"3.0",
    35                "purl":"pkg:maven/acme/library@3.0"
    36            }
    37        ],
    38        "dependencies":[
    39            {
    40                "ref":"acme-application-1.0",
    41                "dependsOn":[
    42                    "pkg:maven/partner/shaded-library@1.0",
    43                    "pkg:maven/acme/library@3.0"
    44                ]
    45            }
    46        ],
    47        "compositions":[
    48            {
    49                "aggregate":"complete",
    50                "assemblies":[
    51                    "pkg:maven/partner/shaded-library@1.0"
    52                ],
    53                "dependencies":[
    54                    "acme-application-1.0"
    55                ]
    56            },
    57            {
    58                "aggregate":"unknown",
    59                "assemblies":[
    60                    "pkg:maven/acme/library@3.0"
    61                ]
    62            }
    63        ]
    64    }