{
  "bomFormat": "CycloneDX",
  "specVersion": "1.7",
  "serialNumber": "urn:uuid:3c3c3c3c-0000-4000-8000-00000noadmin",
  "version": 1,
  "$comment": "EXAMPLE CBOM — CONFORMS to profile pkic.example.interface-disclosure v0.7. The subject is a library with no administrative surface: there is nothing to configure, so there is no management interface to declare. Before profile v0.6 this document failed product rule P2 while hiding nothing, which is what the revision recorded in the profile's changelog fixed. It now satisfies P2 by stating the absence — 'managementInterfaceAbsence: no-configuration-surface', a reason drawn from the profile's vocabulary — rather than by having an interface. Silence would still fail: a structural rule is satisfied by presence or by a declared absence, which is the disclosure model applied to structure rather than to an attribute. Coverage is 'all' rather than 'all-external', because for a library every interface it has is in the document. Subject: an example TLS client library. Carrier format: CycloneDX 1.7. Profile attributes CycloneDX has no first-class field for are carried under component.properties with the pkic:profile: namespace.",
  "metadata": {
    "timestamp": "2026-07-16T09:00:00Z",
    "component": {
      "type": "library",
      "bom-ref": "lib:libexample",
      "name": "libexample",
      "version": "2.1.0",
      "purl": "pkg:generic/libexample@2.1.0",
      "description": "TLS client library with no configuration surface (example subject)",
      "properties": [
        {
          "name": "pkic:profile:coverage",
          "value": "all"
        },
        {
          "name": "pkic:profile:managementInterfaceAbsence",
          "value": "no-configuration-surface"
        }
      ]
    }
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "lib:openssl",
      "name": "OpenSSL",
      "version": "3.4.0",
      "purl": "pkg:generic/openssl@3.4.0",
      "description": "Crypto provider for the TLS client interface"
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto:protocol:svc-tls",
      "name": "TLS client interface (TLS 1.3)",
      "description": "Cryptographic relationship (edge): TLS 1.3 session the library opens to a remote server on behalf of the calling application.",
      "cryptoProperties": {
        "assetType": "protocol",
        "protocolProperties": {
          "type": "tls",
          "version": "1.3",
          "cipherSuites": [
            {
              "name": "TLS_AES_256_GCM_SHA384",
              "algorithms": [
                "crypto:algo:aes-256-gcm",
                "crypto:algo:x25519",
                "crypto:algo:ecdsa-p256"
              ],
              "identifiers": [
                "0x13,0x02"
              ]
            }
          ],
          "cryptoRefArray": [
            "crypto:algo:aes-256-gcm",
            "crypto:algo:x25519",
            "crypto:algo:ecdsa-p256"
          ]
        }
      },
      "properties": [
        {
          "name": "pkic:profile:interfaceId",
          "value": "svc-tls"
        },
        {
          "name": "pkic:profile:interfaceType",
          "value": "service"
        },
        {
          "name": "pkic:profile:lifecycleStage",
          "value": "implemented"
        },
        {
          "name": "pkic:profile:endpointRole:client",
          "value": "endpoint:calling-application"
        },
        {
          "name": "pkic:profile:endpointRole:server",
          "value": "endpoint:remote-service"
        },
        {
          "name": "pkic:profile:implementationPurl",
          "value": "pkg:generic/openssl@3.4.0"
        }
      ]
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto:algo:aes-256-gcm",
      "name": "AES-256-GCM",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "ae",
          "parameterSetIdentifier": "256",
          "mode": "gcm",
          "cryptoFunctions": [
            "encrypt",
            "decrypt"
          ],
          "nistQuantumSecurityLevel": 1
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto:algo:x25519",
      "name": "X25519",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "key-agree",
          "curve": "x25519",
          "cryptoFunctions": [
            "keygen",
            "keyagreement"
          ],
          "nistQuantumSecurityLevel": 0
        }
      }
    },
    {
      "type": "cryptographic-asset",
      "bom-ref": "crypto:algo:ecdsa-p256",
      "name": "ECDSA-P256",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": {
          "primitive": "signature",
          "curve": "P-256",
          "cryptoFunctions": [
            "sign",
            "verify"
          ],
          "nistQuantumSecurityLevel": 0
        }
      }
    }
  ],
  "dependencies": [
    {
      "ref": "lib:libexample",
      "dependsOn": [
        "lib:openssl",
        "crypto:protocol:svc-tls"
      ]
    },
    {
      "ref": "crypto:protocol:svc-tls",
      "dependsOn": [
        "lib:openssl",
        "crypto:algo:aes-256-gcm",
        "crypto:algo:x25519",
        "crypto:algo:ecdsa-p256"
      ]
    }
  ]
}