{"$schema":"http://cyclonedx.org/schema/bom-1.7.schema.json","bomFormat":"CycloneDX","specVersion":"1.7","serialNumber":"urn:uuid:7673efa8-0607-4cd9-892a-a8a5e96fc7a6","version":1,"metadata":{"timestamp":"2026-11-02T03:07:12Z","tools":{"components":[{"type":"application","author":"anchore","name":"syft","version":"1.55.0"}]},"component":{"bom-ref":"00e36670f5c9f95c","type":"file","name":"notaryproject/notation","version":"v1.3.2"}},"components":[{"bom-ref":"pkg:github/actions/add-to-project@v1.0.2?package-id=33b22f26dfca139e","type":"library","name":"actions/add-to-project","version":"v1.0.2","cpe":"cpe:2.3:a:actions\\/add-to-project:actions\\/add-to-project:v1.0.2:*:*:*:*:*:*:*","purl":"pkg:github/actions/add-to-project@v1.0.2","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/add-to-project:actions\\/add_to_project:v1.0.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/add_to_project:actions\\/add-to-project:v1.0.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/add_to_project:actions\\/add_to_project:v1.0.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/add-to:actions\\/add-to-project:v1.0.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/add-to:actions\\/add_to_project:v1.0.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/add_to:actions\\/add-to-project:v1.0.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/add_to:actions\\/add_to_project:v1.0.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/add:actions\\/add-to-project:v1.0.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/add:actions\\/add_to_project:v1.0.2:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/add-to-project.yml"}]},{"bom-ref":"pkg:github/actions/cache@v4.2.3?package-id=e723910665131819","type":"library","name":"actions/cache","version":"v4.2.3","cpe":"cpe:2.3:a:actions\\/cache:actions\\/cache:v4.2.3:*:*:*:*:*:*:*","purl":"pkg:github/actions/cache@v4.2.3","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:location:0:path","value":"/.github/workflows/build.yml"}]},{"bom-ref":"pkg:github/actions/checkout@4.2.2?package-id=9c981182edbebf17","type":"library","name":"actions/checkout","version":"4.2.2","cpe":"cpe:2.3:a:actions\\/checkout:actions\\/checkout:4.2.2:*:*:*:*:*:*:*","purl":"pkg:github/actions/checkout@4.2.2","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:location:0:path","value":"/.github/workflows/scorecard.yml"}]},{"bom-ref":"pkg:github/actions/checkout@v4.2.2?package-id=3cd6e66a301dc632","type":"library","name":"actions/checkout","version":"v4.2.2","cpe":"cpe:2.3:a:actions\\/checkout:actions\\/checkout:v4.2.2:*:*:*:*:*:*:*","purl":"pkg:github/actions/checkout@v4.2.2","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:location:0:path","value":"/.github/workflows/build.yml"}]},{"bom-ref":"pkg:github/actions/checkout@v4.2.2?package-id=b8fa0c66a39b15d2","type":"library","name":"actions/checkout","version":"v4.2.2","cpe":"cpe:2.3:a:actions\\/checkout:actions\\/checkout:v4.2.2:*:*:*:*:*:*:*","purl":"pkg:github/actions/checkout@v4.2.2","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:location:0:path","value":"/.github/workflows/codeql.yml"}]},{"bom-ref":"pkg:github/actions/checkout@v4.2.2?package-id=5ea25948029aa568","type":"library","name":"actions/checkout","version":"v4.2.2","cpe":"cpe:2.3:a:actions\\/checkout:actions\\/checkout:v4.2.2:*:*:*:*:*:*:*","purl":"pkg:github/actions/checkout@v4.2.2","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:location:0:path","value":"/.github/workflows/release-github.yml"}]},{"bom-ref":"pkg:github/actions/setup-go@v5.4.0?package-id=85f6f5ad6f9e11c4","type":"library","name":"actions/setup-go","version":"v5.4.0","cpe":"cpe:2.3:a:actions\\/setup-go:actions\\/setup-go:v5.4.0:*:*:*:*:*:*:*","purl":"pkg:github/actions/setup-go@v5.4.0","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup-go:actions\\/setup_go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup_go:actions\\/setup-go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup_go:actions\\/setup_go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup:actions\\/setup-go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup:actions\\/setup_go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/build.yml"}]},{"bom-ref":"pkg:github/actions/setup-go@v5.4.0?package-id=7a1af050535bee7e","type":"library","name":"actions/setup-go","version":"v5.4.0","cpe":"cpe:2.3:a:actions\\/setup-go:actions\\/setup-go:v5.4.0:*:*:*:*:*:*:*","purl":"pkg:github/actions/setup-go@v5.4.0","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup-go:actions\\/setup_go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup_go:actions\\/setup-go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup_go:actions\\/setup_go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup:actions\\/setup-go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup:actions\\/setup_go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/codeql.yml"}]},{"bom-ref":"pkg:github/actions/setup-go@v5.4.0?package-id=228be7134f8b4dd5","type":"library","name":"actions/setup-go","version":"v5.4.0","cpe":"cpe:2.3:a:actions\\/setup-go:actions\\/setup-go:v5.4.0:*:*:*:*:*:*:*","purl":"pkg:github/actions/setup-go@v5.4.0","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup-go:actions\\/setup_go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup_go:actions\\/setup-go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup_go:actions\\/setup_go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup:actions\\/setup-go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/setup:actions\\/setup_go:v5.4.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/release-github.yml"}]},{"bom-ref":"pkg:github/actions/stale@v9.1.0?package-id=c855a17c4aafdd12","type":"library","name":"actions/stale","version":"v9.1.0","cpe":"cpe:2.3:a:actions\\/stale:actions\\/stale:v9.1.0:*:*:*:*:*:*:*","purl":"pkg:github/actions/stale@v9.1.0","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:location:0:path","value":"/.github/workflows/stale.yml"}]},{"bom-ref":"pkg:github/actions/upload-artifact@v4.6.2?package-id=bc82a3467ab24076","type":"library","name":"actions/upload-artifact","version":"v4.6.2","cpe":"cpe:2.3:a:actions\\/upload-artifact:actions\\/upload-artifact:v4.6.2:*:*:*:*:*:*:*","purl":"pkg:github/actions/upload-artifact@v4.6.2","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/upload-artifact:actions\\/upload_artifact:v4.6.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/upload_artifact:actions\\/upload-artifact:v4.6.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/upload_artifact:actions\\/upload_artifact:v4.6.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/upload:actions\\/upload-artifact:v4.6.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:actions\\/upload:actions\\/upload_artifact:v4.6.2:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/scorecard.yml"}]},{"bom-ref":"pkg:github/codecov/codecov-action@v5.4.2?package-id=cc99589f95466db0","type":"library","name":"codecov/codecov-action","version":"v5.4.2","cpe":"cpe:2.3:a:codecov\\/codecov-action:codecov\\/codecov-action:v5.4.2:*:*:*:*:*:*:*","purl":"pkg:github/codecov/codecov-action@v5.4.2","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:codecov\\/codecov-action:codecov\\/codecov_action:v5.4.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:codecov\\/codecov_action:codecov\\/codecov-action:v5.4.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:codecov\\/codecov_action:codecov\\/codecov_action:v5.4.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:codecov\\/codecov:codecov\\/codecov-action:v5.4.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:codecov\\/codecov:codecov\\/codecov_action:v5.4.2:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/build.yml"}]},{"bom-ref":"pkg:golang/github.com/azure/go-ntlmssp@v0.0.0-20221128193559-754e69321358?package-id=087f6fc774de4cf1","type":"library","name":"github.com/Azure/go-ntlmssp","version":"v0.0.0-20221128193559-754e69321358","cpe":"cpe:2.3:a:microsoft:go-ntlmssp:v0.0.0-20221128193559-754e69321358:*:*:*:*:go:*:*","purl":"pkg:golang/github.com/Azure/go-ntlmssp@v0.0.0-20221128193559-754e69321358","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8="}]},{"bom-ref":"pkg:golang/github.com/fxamacker/cbor/v2@v2.8.0?package-id=919ad61b27394092","type":"library","name":"github.com/fxamacker/cbor/v2","version":"v2.8.0","cpe":"cpe:2.3:a:fxamacker:cbor\\/v2:v2.8.0:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/fxamacker/cbor/v2@v2.8.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:fFtUGXUzXPHTIUdne5+zzMPTfffl3RD5qYnkY40vtxU="}]},{"bom-ref":"pkg:golang/github.com/go-asn1-ber/asn1-ber@v1.5.7?package-id=72eb4d7c797b3ab9","type":"library","name":"github.com/go-asn1-ber/asn1-ber","version":"v1.5.7","cpe":"cpe:2.3:a:go-asn1-ber:asn1-ber:v1.5.7:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/go-asn1-ber/asn1-ber@v1.5.7","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:go-asn1-ber:asn1_ber:v1.5.7:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:go_asn1_ber:asn1-ber:v1.5.7:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:go_asn1_ber:asn1_ber:v1.5.7:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:go-asn1:asn1-ber:v1.5.7:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:go-asn1:asn1_ber:v1.5.7:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:go_asn1:asn1-ber:v1.5.7:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:go_asn1:asn1_ber:v1.5.7:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:go:asn1-ber:v1.5.7:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:go:asn1_ber:v1.5.7:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk="}]},{"bom-ref":"pkg:golang/github.com/go-ldap/ldap/v3@v3.4.10?package-id=8ae8ab4bb5deb16c","type":"library","name":"github.com/go-ldap/ldap/v3","version":"v3.4.10","cpe":"cpe:2.3:a:go-ldap:ldap\\/v3:v3.4.10:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/go-ldap/ldap/v3@v3.4.10","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:go_ldap:ldap\\/v3:v3.4.10:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:go:ldap\\/v3:v3.4.10:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:ot/iwPOhfpNVgB1o+AVXljizWZ9JTp7YF5oeyONmcJU="}]},{"bom-ref":"pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.2?package-id=175e8f8770db836d","type":"library","name":"github.com/golang-jwt/jwt/v4","version":"v4.5.2","cpe":"cpe:2.3:a:golang-jwt:jwt\\/v4:v4.5.2:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.2","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:golang_jwt:jwt\\/v4:v4.5.2:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:golang:jwt\\/v4:v4.5.2:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI="}]},{"bom-ref":"pkg:golang/github.com/google/uuid@v1.6.0?package-id=f6424607fde0264b","type":"library","name":"github.com/google/uuid","version":"v1.6.0","cpe":"cpe:2.3:a:google:uuid:v1.6.0:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/google/uuid@v1.6.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0="}]},{"bom-ref":"pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0?package-id=f6300927a9f6b106","type":"library","name":"github.com/inconshreveable/mousetrap","version":"v1.1.0","cpe":"cpe:2.3:a:inconshreveable:mousetrap:v1.1.0:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8="}]},{"bom-ref":"pkg:golang/github.com/notaryproject/notation-core-go@v1.3.0?package-id=8716c2cf4c977687","type":"library","name":"github.com/notaryproject/notation-core-go","version":"v1.3.0","cpe":"cpe:2.3:a:notaryproject:notation-core-go:v1.3.0:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/notaryproject/notation-core-go@v1.3.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject:notation_core_go:v1.3.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:mWJaw1QBpBxpjLSiKOjzbZvB+xh2Abzk14FHWQ+9Kfs="}]},{"bom-ref":"pkg:golang/github.com/notaryproject/notation-go@v1.3.2?package-id=4d3866d7a8e1b7e2","type":"library","name":"github.com/notaryproject/notation-go","version":"v1.3.2","cpe":"cpe:2.3:a:notaryproject:notation-go:v1.3.2:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/notaryproject/notation-go@v1.3.2","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:4223iLXOHhEV7ZPzIUJEwwMkhlgzoYFCsMJvSH1Chb8="}]},{"bom-ref":"pkg:golang/github.com/notaryproject/notation-plugin-framework-go@v1.0.0?package-id=28bd3292129a9a08","type":"library","name":"github.com/notaryproject/notation-plugin-framework-go","version":"v1.0.0","cpe":"cpe:2.3:a:notaryproject:notation-plugin-framework-go:v1.0.0:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/notaryproject/notation-plugin-framework-go@v1.0.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject:notation_plugin_framework_go:v1.0.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:6Qzr7DGXoCgXEQN+1gTZWuJAZvxh3p8Lryjn5FaLzi4="}]},{"bom-ref":"pkg:golang/github.com/notaryproject/tspclient-go@v1.0.1-0.20250306063739-4f55b14d9f01?package-id=fa0fe71b53a60477","type":"library","name":"github.com/notaryproject/tspclient-go","version":"v1.0.1-0.20250306063739-4f55b14d9f01","cpe":"cpe:2.3:a:notaryproject:tspclient-go:v1.0.1-0.20250306063739-4f55b14d9f01:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/notaryproject/tspclient-go@v1.0.1-0.20250306063739-4f55b14d9f01","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject:tspclient_go:v1.0.1-0.20250306063739-4f55b14d9f01:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:Ay72jBeHKqBFk6TbJWywfwzefN3Ei7Py2OzCiWU/7nk="}]},{"bom-ref":"pkg:golang/github.com/opencontainers/go-digest@v1.0.0?package-id=19989b5d142f3073","type":"library","name":"github.com/opencontainers/go-digest","version":"v1.0.0","cpe":"cpe:2.3:a:opencontainers:go-digest:v1.0.0:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/opencontainers/go-digest@v1.0.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:opencontainers:go_digest:v1.0.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U="}]},{"bom-ref":"pkg:golang/github.com/opencontainers/image-spec@v1.1.1?package-id=10613df95c6a2b3e","type":"library","name":"github.com/opencontainers/image-spec","version":"v1.1.1","cpe":"cpe:2.3:a:opencontainers:image-spec:v1.1.1:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/opencontainers/image-spec@v1.1.1","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:opencontainers:image_spec:v1.1.1:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040="}]},{"bom-ref":"pkg:golang/github.com/sirupsen/logrus@v1.9.3?package-id=0a1f05f2e6d2daa5","type":"library","name":"github.com/sirupsen/logrus","version":"v1.9.3","cpe":"cpe:2.3:a:turbopuffer:logrus:v1.9.3:*:*:*:*:go:*:*","purl":"pkg:golang/github.com/sirupsen/logrus@v1.9.3","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ="}]},{"bom-ref":"pkg:golang/github.com/spf13/cobra@v1.9.1?package-id=68dcc3b1ce534ce2","type":"library","name":"github.com/spf13/cobra","version":"v1.9.1","cpe":"cpe:2.3:a:spf13:cobra:v1.9.1:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/spf13/cobra@v1.9.1","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo="}]},{"bom-ref":"pkg:golang/github.com/spf13/pflag@v1.0.6?package-id=614dd7b514b55164","type":"library","name":"github.com/spf13/pflag","version":"v1.0.6","cpe":"cpe:2.3:a:spf13:pflag:v1.0.6:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/spf13/pflag@v1.0.6","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o="}]},{"bom-ref":"pkg:golang/github.com/veraison/go-cose@v1.3.0?package-id=8c92a26ef0232e1b","type":"library","name":"github.com/veraison/go-cose","version":"v1.3.0","cpe":"cpe:2.3:a:veraison:go-cose:v1.3.0:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/veraison/go-cose@v1.3.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:veraison:go_cose:v1.3.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:2/H5w8kdSpQJyVtIhx8gmwPJ2uSz1PkyWFx0idbd7rk="}]},{"bom-ref":"pkg:golang/github.com/x448/float16@v0.8.4?package-id=413366d78e6a286c","type":"library","name":"github.com/x448/float16","version":"v0.8.4","cpe":"cpe:2.3:a:x448:float16:v0.8.4:*:*:*:*:*:*:*","purl":"pkg:golang/github.com/x448/float16@v0.8.4","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM="}]},{"bom-ref":"pkg:github/github/codeql-action@v3.28.15?package-id=98aae2ae86603cfe#analyze","type":"library","name":"github/codeql-action/analyze","version":"v3.28.15","cpe":"cpe:2.3:a:github\\/codeql-action\\/analyze:github\\/codeql-action\\/analyze:v3.28.15:*:*:*:*:*:*:*","purl":"pkg:github/github/codeql-action@v3.28.15#analyze","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql-action\\/analyze:github\\/codeql_action\\/analyze:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql_action\\/analyze:github\\/codeql-action\\/analyze:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql_action\\/analyze:github\\/codeql_action\\/analyze:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql:github\\/codeql-action\\/analyze:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql:github\\/codeql_action\\/analyze:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/codeql.yml"}]},{"bom-ref":"pkg:github/github/codeql-action@v3.28.15?package-id=910a22b02b2cf73f#init","type":"library","name":"github/codeql-action/init","version":"v3.28.15","cpe":"cpe:2.3:a:github\\/codeql-action\\/init:github\\/codeql-action\\/init:v3.28.15:*:*:*:*:*:*:*","purl":"pkg:github/github/codeql-action@v3.28.15#init","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql-action\\/init:github\\/codeql_action\\/init:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql_action\\/init:github\\/codeql-action\\/init:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql_action\\/init:github\\/codeql_action\\/init:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql:github\\/codeql-action\\/init:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql:github\\/codeql_action\\/init:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/codeql.yml"}]},{"bom-ref":"pkg:github/github/codeql-action@v3.28.15?package-id=99a39ef734b8b2c0#upload-sarif","type":"library","name":"github/codeql-action/upload-sarif","version":"v3.28.15","cpe":"cpe:2.3:a:github\\/codeql-action\\/upload-sarif:github\\/codeql-action\\/upload-sarif:v3.28.15:*:*:*:*:*:*:*","purl":"pkg:github/github/codeql-action@v3.28.15#upload-sarif","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql-action\\/upload-sarif:github\\/codeql_action\\/upload_sarif:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql_action\\/upload_sarif:github\\/codeql-action\\/upload-sarif:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql_action\\/upload_sarif:github\\/codeql_action\\/upload_sarif:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql-action\\/upload:github\\/codeql-action\\/upload-sarif:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql-action\\/upload:github\\/codeql_action\\/upload_sarif:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql_action\\/upload:github\\/codeql-action\\/upload-sarif:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql_action\\/upload:github\\/codeql_action\\/upload_sarif:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql:github\\/codeql-action\\/upload-sarif:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:github\\/codeql:github\\/codeql_action\\/upload_sarif:v3.28.15:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/scorecard.yml"}]},{"bom-ref":"pkg:golang/golang.org/x/crypto@v0.37.0?package-id=3425d74d4abfcd9b","type":"library","name":"golang.org/x/crypto","version":"v0.37.0","cpe":"cpe:2.3:a:golang:crypto:v0.37.0:*:*:*:*:go:*:*","purl":"pkg:golang/golang.org/x/crypto@v0.37.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:cpe23","value":"cpe:2.3:a:go:ssh:v0.37.0:*:*:*:*:go:*:*"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE="}]},{"bom-ref":"pkg:golang/golang.org/x/mod@v0.24.0?package-id=0ab7d18217876fde","type":"library","name":"golang.org/x/mod","version":"v0.24.0","cpe":"cpe:2.3:a:golang:x\\/mod:v0.24.0:*:*:*:*:*:*:*","purl":"pkg:golang/golang.org/x/mod@v0.24.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU="}]},{"bom-ref":"pkg:golang/golang.org/x/sync@v0.10.0?package-id=6749f45ab35ced91","type":"library","name":"golang.org/x/sync","version":"v0.10.0","cpe":"cpe:2.3:a:golang:x\\/sync:v0.10.0:*:*:*:*:*:*:*","purl":"pkg:golang/golang.org/x/sync@v0.10.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ="}]},{"bom-ref":"pkg:golang/golang.org/x/sys@v0.32.0?package-id=e5c91e29f2a84801","type":"library","name":"golang.org/x/sys","version":"v0.32.0","cpe":"cpe:2.3:a:golang:x\\/sys:v0.32.0:*:*:*:*:*:*:*","purl":"pkg:golang/golang.org/x/sys@v0.32.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20="}]},{"bom-ref":"pkg:golang/golang.org/x/term@v0.31.0?package-id=ad7dce5951cb578c","type":"library","name":"golang.org/x/term","version":"v0.31.0","cpe":"cpe:2.3:a:golang:x\\/term:v0.31.0:*:*:*:*:*:*:*","purl":"pkg:golang/golang.org/x/term@v0.31.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o="}]},{"bom-ref":"pkg:github/goreleaser/goreleaser-action@v6.3.0?package-id=efd559395ebda72d","type":"library","name":"goreleaser/goreleaser-action","version":"v6.3.0","cpe":"cpe:2.3:a:goreleaser\\/goreleaser-action:goreleaser\\/goreleaser-action:v6.3.0:*:*:*:*:*:*:*","purl":"pkg:github/goreleaser/goreleaser-action@v6.3.0","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:goreleaser\\/goreleaser-action:goreleaser\\/goreleaser_action:v6.3.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:goreleaser\\/goreleaser_action:goreleaser\\/goreleaser-action:v6.3.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:goreleaser\\/goreleaser_action:goreleaser\\/goreleaser_action:v6.3.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:goreleaser\\/goreleaser:goreleaser\\/goreleaser-action:v6.3.0:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:goreleaser\\/goreleaser:goreleaser\\/goreleaser_action:v6.3.0:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/release-github.yml"}]},{"bom-ref":"pkg:github/notaryproject/notation-core-go@main?package-id=5bfc0d3e10502ac6#.github/workflows/reusable-license-checker.yml","type":"library","name":"notaryproject/notation-core-go/.github/workflows/reusable-license-checker.yml","version":"main","cpe":"cpe:2.3:a:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:main:*:*:*:*:*:*:*","purl":"pkg:github/notaryproject/notation-core-go@main#.github/workflows/reusable-license-checker.yml","properties":[{"name":"syft:package:foundBy","value":"github-action-workflow-usage-cataloger"},{"name":"syft:package:type","value":"github-action-workflow"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation-core:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation-core:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation_core:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation_core:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation:notaryproject\\/notation-core-go\\/.github\\/workflows\\/reusable-license-checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:notaryproject\\/notation:notaryproject\\/notation_core_go\\/.github\\/workflows\\/reusable_license_checker.yml:main:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/license-checker.yml"}]},{"bom-ref":"pkg:golang/oras.land/oras-go/v2@v2.5.0?package-id=522d022bbdf363b1","type":"library","name":"oras.land/oras-go/v2","version":"v2.5.0","cpe":"cpe:2.3:a:linuxfoundation:oras:v2.5.0:*:*:*:*:go:*:*","purl":"pkg:golang/oras.land/oras-go/v2@v2.5.0","properties":[{"name":"syft:package:foundBy","value":"go-module-file-cataloger"},{"name":"syft:package:language","value":"go"},{"name":"syft:package:type","value":"go-module"},{"name":"syft:package:metadataType","value":"go-module-entry"},{"name":"syft:location:0:path","value":"/go.mod"},{"name":"syft:metadata:h1Digest","value":"h1:o8Me9kLY74Vp5uw07QXPiitjsw7qNXi8Twd+19Zf02c="}]},{"bom-ref":"pkg:github/ossf/scorecard-action@v2.4.1?package-id=d6d7333a1080056e","type":"library","name":"ossf/scorecard-action","version":"v2.4.1","cpe":"cpe:2.3:a:ossf\\/scorecard-action:ossf\\/scorecard-action:v2.4.1:*:*:*:*:*:*:*","purl":"pkg:github/ossf/scorecard-action@v2.4.1","properties":[{"name":"syft:package:foundBy","value":"github-actions-usage-cataloger"},{"name":"syft:package:type","value":"github-action"},{"name":"syft:package:metadataType","value":"github-actions-use-statement"},{"name":"syft:cpe23","value":"cpe:2.3:a:ossf\\/scorecard-action:ossf\\/scorecard_action:v2.4.1:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:ossf\\/scorecard_action:ossf\\/scorecard-action:v2.4.1:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:ossf\\/scorecard_action:ossf\\/scorecard_action:v2.4.1:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:ossf\\/scorecard:ossf\\/scorecard-action:v2.4.1:*:*:*:*:*:*:*"},{"name":"syft:cpe23","value":"cpe:2.3:a:ossf\\/scorecard:ossf\\/scorecard_action:v2.4.1:*:*:*:*:*:*:*"},{"name":"syft:location:0:path","value":"/.github/workflows/scorecard.yml"}]},{"bom-ref":"14538ffcb9374d9e","type":"file","name":"/.github/workflows/add-to-project.yml","hashes":[{"alg":"SHA-1","content":"d85bb0a97d644ae4cca9773ac5df9457ae9372df"},{"alg":"SHA-256","content":"0382b30968f4de8c4c6afe6e57a26f383b627fbfe92ccd83964d86f9be288417"}]},{"bom-ref":"ebff2c81fbaf921b","type":"file","name":"/.github/workflows/build.yml","hashes":[{"alg":"SHA-1","content":"d728e10ac3980a775117a6eaa7d57aea1f2e0de1"},{"alg":"SHA-256","content":"d4d5bca5789077ca3871b7ec4926723062fe945e4a786884f1305d12cc88eac8"}]},{"bom-ref":"f4fe0eee66e1ba99","type":"file","name":"/.github/workflows/codeql.yml","hashes":[{"alg":"SHA-1","content":"4252a7cacd7bceafa97d3495244acf9843b885e4"},{"alg":"SHA-256","content":"dca96d1ec9f3d6d127ae9ecddd28ac8ae511a67823e8843b76dc61bb0463decd"}]},{"bom-ref":"c26564c8b66e953b","type":"file","name":"/.github/workflows/license-checker.yml","hashes":[{"alg":"SHA-1","content":"dc60e576ee5d3a2bdded87bde526d51670b9bfb3"},{"alg":"SHA-256","content":"e39c0b6600e2d22701386a2bb3dda827b8451442dc50d4762b5fb8c8578e9a15"}]},{"bom-ref":"275d35bc6a2ce592","type":"file","name":"/.github/workflows/release-github.yml","hashes":[{"alg":"SHA-1","content":"5c631cdcc9aa62750a8dcf57866255bcf9b91a4a"},{"alg":"SHA-256","content":"74a22dafdc35e88fc9f0d649dbefdc65d4c0a83b25939370ffeb6d21e3cd1949"}]},{"bom-ref":"f175f3b2ff568407","type":"file","name":"/.github/workflows/scorecard.yml","hashes":[{"alg":"SHA-1","content":"6420f147bf02dee36879c480a678074fbbfb4838"},{"alg":"SHA-256","content":"b354b8f3bfc215bb04feae7596e6824a85ce02258509280ca75708aada0f06a8"}]},{"bom-ref":"ffd6ebf112245b93","type":"file","name":"/.github/workflows/stale.yml","hashes":[{"alg":"SHA-1","content":"c1b82362b54d4e18d249e53610842d99ff4191ed"},{"alg":"SHA-256","content":"5187305e2a53c32614dd4d7764f02f1b1b207b741da5322a9c88718cd92e0c1d"}]},{"bom-ref":"3fc5a8d3d86e9790","type":"file","name":"/go.mod","hashes":[{"alg":"SHA-1","content":"15e721d25aeaa1af39ccbb2982943f84f3339627"},{"alg":"SHA-256","content":"4f077590ae332a379c73c51b8886c8267d86e2f2f89024890442e4a5679f5dae"}]}]}