github.com/CycloneDX/sbom-utility@v0.16.0/test/cyclonedx/1.6/specification/valid-metadata-tool-1.6.json (about) 1 { 2 "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", 3 "bomFormat": "CycloneDX", 4 "specVersion": "1.6", 5 "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79", 6 "version": 1, 7 "metadata": { 8 "tools": { 9 "components": [ 10 { 11 "type": "application", 12 "group": "Awesome Vendor", 13 "name": "Awesome Tool", 14 "version": "9.1.2", 15 "hashes": [ 16 { 17 "alg": "SHA-1", 18 "content": "25ed8e31b995bb927966616df2a42b979a2717f0" 19 }, 20 { 21 "alg": "SHA-256", 22 "content": "a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df" 23 } 24 ] 25 } 26 ], 27 "services": [ 28 { 29 "provider": { 30 "name": "Acme Org", 31 "url": [ 32 "https://example.com" 33 ] 34 }, 35 "group": "com.example", 36 "name": "Acme Signing Server", 37 "description": "Signs artifacts", 38 "endpoints": [ 39 "https://example.com/sign", 40 "https://example.com/verify", 41 "https://example.com/tsa" 42 ] 43 } 44 ] 45 } 46 }, 47 "components": [] 48 }