github.com/CycloneDX/sbom-utility@v0.16.0/test/cyclonedx/1.6/specification/valid-metadata-tool-1.6.json (about)

     1  {
     2    "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
     3    "bomFormat": "CycloneDX",
     4    "specVersion": "1.6",
     5    "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
     6    "version": 1,
     7    "metadata": {
     8      "tools": {
     9        "components": [
    10          {
    11            "type": "application",
    12            "group": "Awesome Vendor",
    13            "name": "Awesome Tool",
    14            "version": "9.1.2",
    15            "hashes": [
    16              {
    17                "alg": "SHA-1",
    18                "content": "25ed8e31b995bb927966616df2a42b979a2717f0"
    19              },
    20              {
    21                "alg": "SHA-256",
    22                "content": "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df"
    23              }
    24            ]
    25          }
    26        ],
    27        "services": [
    28          {
    29            "provider": {
    30              "name": "Acme Org",
    31              "url": [
    32                "https://example.com"
    33              ]
    34            },
    35            "group": "com.example",
    36            "name": "Acme Signing Server",
    37            "description": "Signs artifacts",
    38            "endpoints": [
    39              "https://example.com/sign",
    40              "https://example.com/verify",
    41              "https://example.com/tsa"
    42            ]
    43          }
    44        ]
    45      }
    46    },
    47    "components": []
    48  }