{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:8d7c1c1e-6f9a-4b62-9e2a-2f6a1f0c4a02",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-02T16:40:00Z",
    "tools": [
      {
        "vendor": "EmbedHarbor",
        "name": "sample-fixture",
        "version": "1.0.0"
      }
    ],
    "component": {
      "type": "firmware",
      "bom-ref": "harbor-gateway-hg100-fw-1.4.3",
      "name": "Harbor Gateway HG-100 firmware",
      "version": "1.4.3",
      "supplier": {
        "name": "Harbor Devices GmbH"
      },
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "3c1d8e6b7a3c5d9f0e1a2b3c4d5e6f708192a3b4c5d6e7f809129f2e5b0f4f2a"
        }
      ]
    }
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:generic/openssl@3.0.13",
      "name": "openssl",
      "version": "3.0.13",
      "purl": "pkg:generic/openssl@3.0.13",
      "supplier": {
        "name": "OpenSSL Software Foundation"
      },
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "components": [
        {
          "type": "library",
          "bom-ref": "pkg:generic/openssl-libcrypto@3.0.13",
          "name": "openssl-libcrypto",
          "version": "3.0.13",
          "purl": "pkg:generic/openssl-libcrypto@3.0.13"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:generic/busybox@1.36.1",
      "name": "busybox",
      "version": "1.36.1",
      "purl": "pkg:generic/busybox@1.36.1",
      "supplier": {
        "name": "BusyBox Project"
      },
      "licenses": [
        {
          "license": {
            "id": "GPL-2.0-only"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:generic/mbedtls@2.28.8",
      "name": "mbedtls",
      "version": "2.28.8",
      "purl": "pkg:generic/mbedtls@2.28.8",
      "supplier": {
        "name": "Trusted Firmware"
      }
    },
    {
      "type": "library",
      "bom-ref": "pkg:generic/curl@8.5.0",
      "name": "libcurl",
      "version": "8.5.0",
      "purl": "pkg:generic/curl@8.5.0",
      "supplier": {
        "name": "curl project"
      }
    },
    {
      "type": "library",
      "bom-ref": "pkg:generic/dropbear@2022.83",
      "name": "dropbear",
      "version": "2022.83",
      "purl": "pkg:generic/dropbear@2022.83"
    },
    {
      "type": "library",
      "bom-ref": "pkg:generic/sqlite@3.44.0",
      "name": "sqlite",
      "version": "3.44.0",
      "purl": "pkg:generic/sqlite@3.44.0"
    },
    {
      "type": "library",
      "bom-ref": "pkg:generic/zlib@1.3.1",
      "name": "zlib",
      "version": "1.3.1",
      "purl": "pkg:generic/zlib@1.3.1"
    },
    {
      "type": "library",
      "bom-ref": "pkg:github/DaveGamble/cJSON@v1.7.18",
      "name": "cJSON",
      "version": "1.7.18",
      "purl": "pkg:github/DaveGamble/cJSON@v1.7.18"
    },
    {
      "type": "library",
      "bom-ref": "pkg:generic/lwip@2.1.3",
      "name": "lwip",
      "version": "2.1.3",
      "purl": "pkg:generic/lwip@2.1.3",
      "supplier": {
        "name": "lwIP project"
      }
    },
    {
      "type": "library",
      "bom-ref": "pkg:generic/libmodbus@3.1.10",
      "name": "libmodbus",
      "version": "3.1.10",
      "purl": "pkg:generic/libmodbus@3.1.10",
      "supplier": {
        "name": "libmodbus project"
      }
    },
    {
      "type": "library",
      "bom-ref": "pkg:npm/%40harbor/agent@2.5.0",
      "name": "@harbor/agent",
      "version": "2.5.0",
      "purl": "pkg:npm/%40harbor/agent@2.5.0",
      "supplier": {
        "name": "Harbor Devices GmbH"
      }
    },
    {
      "type": "library",
      "bom-ref": "pkg:pypi/harbor-telemetry@1.9.0",
      "name": "harbor-telemetry",
      "version": "1.9.0",
      "purl": "pkg:pypi/harbor-telemetry@1.9.0"
    },
    {
      "type": "library",
      "bom-ref": "vendor-component-harbor-radio-fw",
      "name": "harbor-radio-fw",
      "version": "1.2.0",
      "supplier": {
        "name": "Nordic Radio Systems"
      },
      "description": "Pre-compiled radio firmware blob supplied by the module vendor. No package identity is published."
    },
    {
      "type": "library",
      "bom-ref": "pkg:npm/%40harbor/ui-bundle@latest",
      "name": "@harbor/ui-bundle",
      "version": "latest",
      "purl": "pkg:npm/%40harbor/ui-bundle@latest",
      "supplier": {
        "name": "Harbor Devices GmbH"
      },
      "description": "Pinned to the npm dist-tag 'latest' in the build; the manifest does not record a resolved version."
    }
  ],
  "dependencies": [
    {
      "ref": "harbor-gateway-hg100-fw-1.4.3",
      "dependsOn": [
        "pkg:generic/openssl@3.0.13",
        "pkg:generic/busybox@1.36.1"
      ]
    },
    {
      "ref": "pkg:generic/openssl@3.0.13",
      "dependsOn": [
        "pkg:generic/openssl-libcrypto@3.0.13"
      ]
    },
    {
      "ref": "pkg:generic/busybox@1.36.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:generic/mbedtls@2.28.8",
      "dependsOn": []
    },
    {
      "ref": "pkg:generic/curl@8.5.0",
      "dependsOn": [
        "pkg:generic/zlib@1.3.1"
      ]
    },
    {
      "ref": "pkg:generic/dropbear@2022.83",
      "dependsOn": []
    },
    {
      "ref": "pkg:generic/sqlite@3.44.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:generic/zlib@1.3.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:github/DaveGamble/cJSON@v1.7.18",
      "dependsOn": []
    },
    {
      "ref": "pkg:generic/lwip@2.1.3",
      "dependsOn": []
    },
    {
      "ref": "pkg:generic/libmodbus@3.1.10",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/%40harbor/agent@2.5.0",
      "dependsOn": [
        "pkg:generic/zlib@1.3.1"
      ]
    },
    {
      "ref": "pkg:pypi/harbor-telemetry@1.9.0",
      "dependsOn": [
        "pkg:generic/zlib@1.3.1"
      ]
    },
    {
      "ref": "vendor-component-harbor-radio-fw",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/%40harbor/ui-bundle@latest",
      "dependsOn": []
    }
  ]
}