{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "serialNumber": "urn:uuid:a96ca23f-1f0a-57a3-9b0f-9320248cd2a3",
  "metadata": {
    "timestamp": "2026-11-08T16:00:00Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "VunFisher tools/build_sbom.py"
        }
      ]
    },
    "component": {
      "type": "application",
      "bom-ref": "vunfisher",
      "name": "VunFisher",
      "version": "1.4.0+2026102674",
      "supplier": {
        "name": "TX Cyber"
      },
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "5a7c95f5b9f357f44ed21e70110847dfbbd828c43f1a09a935a7df067b358e28"
        }
      ],
      "properties": [
        {
          "name": "vunfisher:package",
          "value": "VunFisher-Windows-2026102674.zip"
        }
      ]
    },
    "properties": [
      {
        "name": "vunfisher:scope",
        "value": "Third-party components shipped in the Windows package. VunFisher's own code is the metadata component."
      }
    ]
  },
  "components": [
    {
      "type": "framework",
      "bom-ref": "cpython",
      "name": "cpython",
      "version": "3.14.7",
      "purl": "pkg:generic/cpython@3.14.7",
      "licenses": [
        {
          "license": {
            "id": "PSF-2.0"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700"
        }
      ],
      "description": "Embedded Python runtime shipped in runtime/."
    },
    {
      "type": "library",
      "bom-ref": "runtime-openssl",
      "name": "openssl",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958"
        },
        {
          "alg": "SHA-256",
          "content": "b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001"
        }
      ],
      "properties": [
        {
          "name": "vunfisher:file",
          "value": "runtime/libcrypto-3.dll"
        },
        {
          "name": "vunfisher:file",
          "value": "runtime/libssl-3.dll"
        }
      ],
      "version": "3.5.7",
      "purl": "pkg:generic/openssl@3.5.7",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "runtime-sqlite",
      "name": "sqlite",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "d3e60dd22e62c9fbdb64b31b1b8c48782e1d4958d04d0bf830cffd31ace3275f"
        }
      ],
      "properties": [
        {
          "name": "vunfisher:file",
          "value": "runtime/sqlite3.dll"
        },
        {
          "name": "vunfisher:version",
          "value": "not recorded in the binary"
        },
        {
          "name": "sqlite:source_id",
          "value": "2025-07-30 19:33:53 4d8adfb30e03f9cf27f800a2c1ba3c48fb4ca1b08b0f5ed59a4d5ecbf45e20a3"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "blessing"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "runtime-libffi",
      "name": "libffi",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a"
        }
      ],
      "properties": [
        {
          "name": "vunfisher:file",
          "value": "runtime/libffi-8.dll"
        },
        {
          "name": "vunfisher:version",
          "value": "not recorded in the binary"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "runtime-libtommath",
      "name": "libtommath",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "bf18448a56de62e56adb5a50040c08648f0bcf556217de90eca283490ee8c0c3"
        }
      ],
      "properties": [
        {
          "name": "vunfisher:file",
          "value": "runtime/libtommath.dll"
        },
        {
          "name": "vunfisher:version",
          "value": "not recorded in the binary"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "Unlicense"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "runtime-microsoft-visual-cpp-runtime",
      "name": "microsoft-visual-cpp-runtime",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7"
        },
        {
          "alg": "SHA-256",
          "content": "a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e"
        }
      ],
      "properties": [
        {
          "name": "vunfisher:file",
          "value": "runtime/vcruntime140.dll"
        },
        {
          "name": "vunfisher:file",
          "value": "runtime/vcruntime140_1.dll"
        },
        {
          "name": "vunfisher:version",
          "value": "not recorded in the binary"
        }
      ],
      "licenses": [
        {
          "license": {
            "name": "Microsoft Visual C++ Redistributable license"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pypi-cffi",
      "name": "cffi",
      "version": "2.1.1",
      "purl": "pkg:pypi/cffi@2.1.1",
      "licenses": [
        {
          "license": {
            "id": "MIT-0"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "3222ba5d678f80a030e6afbcc33dc1ae5cb45facabb61cee2c7016b8432fde48"
        }
      ],
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://files.pythonhosted.org/packages/a7/06/1c3e01e3ba14c39f6d10bfbac52753b7e22259e38088e5cfe1d704918690/cffi-2.1.1-cp314-cp314-win_amd64.whl"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pypi-cryptography",
      "name": "cryptography",
      "version": "50.0.1",
      "purl": "pkg:pypi/cryptography@50.0.1",
      "licenses": [
        {
          "expression": "Apache-2.0 OR BSD-3-Clause"
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "aed8db4f6d71c51efb89530e12d9464e7bf2923d46c3205dc794a2a93f8c0648"
        }
      ],
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://files.pythonhosted.org/packages/42/8b/cb12b1b60c91b074ca6bf0fdd59aa8f10d8bc5f73af8faece86ef0421b37/cryptography-50.0.1-cp311-abi3-win_amd64.whl"
        }
      ],
      "components": [
        {
          "type": "library",
          "name": "cryptography-cffi",
          "version": "0.50.1",
          "licenses": [
            {
              "expression": "Apache-2.0 OR BSD-3-Clause"
            }
          ],
          "purl": "pkg:cargo/cryptography-cffi@0.50.1?download_url=file://cryptography-cffi",
          "bom-ref": "pypi-cryptography/cryptography-cffi@0.50.1"
        },
        {
          "type": "library",
          "name": "cryptography-crypto",
          "version": "0.50.1",
          "licenses": [
            {
              "expression": "Apache-2.0 OR BSD-3-Clause"
            }
          ],
          "purl": "pkg:cargo/cryptography-crypto@0.50.1?download_url=file://cryptography-crypto",
          "bom-ref": "pypi-cryptography/cryptography-crypto@0.50.1"
        },
        {
          "type": "library",
          "name": "cryptography-keepalive",
          "version": "0.50.1",
          "licenses": [
            {
              "expression": "Apache-2.0 OR BSD-3-Clause"
            }
          ],
          "purl": "pkg:cargo/cryptography-keepalive@0.50.1?download_url=file://cryptography-keepalive",
          "bom-ref": "pypi-cryptography/cryptography-keepalive@0.50.1"
        },
        {
          "type": "library",
          "name": "cryptography-key-parsing",
          "version": "0.50.1",
          "licenses": [
            {
              "expression": "Apache-2.0 OR BSD-3-Clause"
            }
          ],
          "purl": "pkg:cargo/cryptography-key-parsing@0.50.1?download_url=file://cryptography-key-parsing",
          "bom-ref": "pypi-cryptography/cryptography-key-parsing@0.50.1"
        },
        {
          "type": "library",
          "name": "cryptography-openssl",
          "version": "0.50.1",
          "licenses": [
            {
              "expression": "Apache-2.0 OR BSD-3-Clause"
            }
          ],
          "purl": "pkg:cargo/cryptography-openssl@0.50.1?download_url=file://cryptography-openssl",
          "bom-ref": "pypi-cryptography/cryptography-openssl@0.50.1"
        },
        {
          "type": "library",
          "name": "cryptography-x509",
          "version": "0.50.1",
          "licenses": [
            {
              "expression": "Apache-2.0 OR BSD-3-Clause"
            }
          ],
          "purl": "pkg:cargo/cryptography-x509@0.50.1?download_url=file://cryptography-x509",
          "bom-ref": "pypi-cryptography/cryptography-x509@0.50.1"
        },
        {
          "type": "library",
          "name": "cryptography-x509-verification",
          "version": "0.50.1",
          "licenses": [
            {
              "expression": "Apache-2.0 OR BSD-3-Clause"
            }
          ],
          "purl": "pkg:cargo/cryptography-x509-verification@0.50.1?download_url=file://cryptography-x509-verification",
          "bom-ref": "pypi-cryptography/cryptography-x509-verification@0.50.1"
        },
        {
          "type": "library",
          "name": "asn1",
          "version": "0.24.1",
          "description": "ASN.1 (DER) parser and writer for Rust.",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "c9795210620c0cb3f9a7ce4f882808c38e1ef7b347c90591dceae0886e031fb1"
            }
          ],
          "licenses": [
            {
              "expression": "BSD-3-Clause"
            }
          ],
          "purl": "pkg:cargo/asn1@0.24.1",
          "bom-ref": "pypi-cryptography/asn1@0.24.1"
        },
        {
          "type": "library",
          "name": "asn1_derive",
          "version": "0.24.1",
          "description": "#[derive] support for asn1",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "909e307f1cc32bb8bccbd98f446e6d1bf03fa30f7b53a4337da7181ad30fa11a"
            }
          ],
          "licenses": [
            {
              "expression": "BSD-3-Clause"
            }
          ],
          "purl": "pkg:cargo/asn1_derive@0.24.1",
          "bom-ref": "pypi-cryptography/asn1_derive@0.24.1"
        },
        {
          "type": "library",
          "name": "base64",
          "version": "0.23.0",
          "description": "encodes and decodes base64 as bytes or utf8",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "b25655df2c3cdd83c5e5b293b88acd880332b2ddadd7c30ac43144fdc0033da9"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/base64@0.23.0",
          "bom-ref": "pypi-cryptography/base64@0.23.0"
        },
        {
          "type": "library",
          "name": "bitflags",
          "version": "2.13.1",
          "description": "A macro to generate structures which behave like bitflags. ",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/bitflags@2.13.1",
          "bom-ref": "pypi-cryptography/bitflags@2.13.1"
        },
        {
          "type": "library",
          "name": "cc",
          "version": "1.4.0",
          "description": "A build-time dependency for Cargo build scripts to assist in invoking the native C compiler to compile native C code into a static archive to be linked into Rust code. ",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/cc@1.4.0",
          "bom-ref": "pypi-cryptography/cc@1.4.0"
        },
        {
          "type": "library",
          "name": "cfg-if",
          "version": "1.0.4",
          "description": "A macro to ergonomically define an item depending on a large number of #[cfg] parameters. Structured like an if-else chain, the first matching branch is the item that gets emitted. ",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/cfg-if@1.0.4",
          "bom-ref": "pypi-cryptography/cfg-if@1.0.4"
        },
        {
          "type": "library",
          "name": "find-msvc-tools",
          "version": "0.1.9",
          "description": "Find windows-specific tools, read MSVC versions from the registry and from COM interfaces",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/find-msvc-tools@0.1.9",
          "bom-ref": "pypi-cryptography/find-msvc-tools@0.1.9"
        },
        {
          "type": "library",
          "name": "foreign-types-shared",
          "version": "0.1.1",
          "description": "An internal crate used by foreign-types",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/foreign-types-shared@0.1.1",
          "bom-ref": "pypi-cryptography/foreign-types-shared@0.1.1"
        },
        {
          "type": "library",
          "name": "foreign-types",
          "version": "0.3.2",
          "description": "A framework for Rust wrappers over C APIs",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/foreign-types@0.3.2",
          "bom-ref": "pypi-cryptography/foreign-types@0.3.2"
        },
        {
          "type": "library",
          "name": "heck",
          "version": "0.5.0",
          "description": "heck is a case conversion library.",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/heck@0.5.0",
          "bom-ref": "pypi-cryptography/heck@0.5.0"
        },
        {
          "type": "library",
          "name": "itoa",
          "version": "1.0.18",
          "description": "Fast integer primitive to string conversion",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/itoa@1.0.18",
          "bom-ref": "pypi-cryptography/itoa@1.0.18"
        },
        {
          "type": "library",
          "name": "libc",
          "version": "0.2.189",
          "description": "Raw FFI bindings to platform libraries like libc.",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/libc@0.2.189",
          "bom-ref": "pypi-cryptography/libc@0.2.189"
        },
        {
          "type": "library",
          "name": "once_cell",
          "version": "1.21.4",
          "description": "Single assignment cells and lazy values.",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/once_cell@1.21.4",
          "bom-ref": "pypi-cryptography/once_cell@1.21.4"
        },
        {
          "type": "library",
          "name": "openssl-macros",
          "version": "0.1.1",
          "description": "Internal macros used by the openssl crate.",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/openssl-macros@0.1.1",
          "bom-ref": "pypi-cryptography/openssl-macros@0.1.1"
        },
        {
          "type": "library",
          "name": "openssl-sys",
          "version": "0.9.117",
          "description": "FFI bindings to OpenSSL",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
            }
          ],
          "licenses": [
            {
              "expression": "MIT"
            }
          ],
          "purl": "pkg:cargo/openssl-sys@0.9.117",
          "bom-ref": "pypi-cryptography/openssl-sys@0.9.117"
        },
        {
          "type": "library",
          "name": "openssl",
          "version": "0.10.81",
          "description": "OpenSSL bindings",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
            }
          ],
          "licenses": [
            {
              "expression": "Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/openssl@0.10.81",
          "bom-ref": "pypi-cryptography/openssl@0.10.81"
        },
        {
          "type": "library",
          "name": "pem",
          "version": "4.0.0",
          "description": "Parse and encode PEM-encoded data.",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120"
            }
          ],
          "licenses": [
            {
              "expression": "MIT"
            }
          ],
          "purl": "pkg:cargo/pem@4.0.0",
          "bom-ref": "pypi-cryptography/pem@4.0.0"
        },
        {
          "type": "library",
          "name": "pkg-config",
          "version": "0.3.33",
          "description": "A library to run the pkg-config system tool at build time in order to be used in Cargo build scripts. ",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/pkg-config@0.3.33",
          "bom-ref": "pypi-cryptography/pkg-config@0.3.33"
        },
        {
          "type": "library",
          "name": "portable-atomic",
          "version": "1.14.0",
          "description": "Portable atomic types including support for 128-bit atomics, atomic float, etc. ",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
            }
          ],
          "licenses": [
            {
              "expression": "Apache-2.0 OR MIT"
            }
          ],
          "purl": "pkg:cargo/portable-atomic@1.14.0",
          "bom-ref": "pypi-cryptography/portable-atomic@1.14.0"
        },
        {
          "type": "library",
          "name": "proc-macro2",
          "version": "1.0.107",
          "description": "A substitute implementation of the compiler's `proc_macro` API to decouple token-based libraries from the procedural macro use case.",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/proc-macro2@1.0.107",
          "bom-ref": "pypi-cryptography/proc-macro2@1.0.107"
        },
        {
          "type": "library",
          "name": "pyo3-build-config",
          "version": "0.29.0",
          "description": "Build configuration for the PyO3 ecosystem",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/pyo3-build-config@0.29.0",
          "bom-ref": "pypi-cryptography/pyo3-build-config@0.29.0"
        },
        {
          "type": "library",
          "name": "pyo3-ffi",
          "version": "0.29.0",
          "description": "Python-API bindings for the PyO3 ecosystem",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/pyo3-ffi@0.29.0",
          "bom-ref": "pypi-cryptography/pyo3-ffi@0.29.0"
        },
        {
          "type": "library",
          "name": "pyo3-macros-backend",
          "version": "0.29.0",
          "description": "Code generation for PyO3 package",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/pyo3-macros-backend@0.29.0",
          "bom-ref": "pypi-cryptography/pyo3-macros-backend@0.29.0"
        },
        {
          "type": "library",
          "name": "pyo3-macros",
          "version": "0.29.0",
          "description": "Proc macros for PyO3 package",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/pyo3-macros@0.29.0",
          "bom-ref": "pypi-cryptography/pyo3-macros@0.29.0"
        },
        {
          "type": "library",
          "name": "pyo3",
          "version": "0.29.0",
          "description": "Bindings to Python interpreter",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/pyo3@0.29.0",
          "bom-ref": "pypi-cryptography/pyo3@0.29.0"
        },
        {
          "type": "library",
          "name": "quote",
          "version": "1.0.47",
          "description": "Quasi-quoting macro quote!(...)",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/quote@1.0.47",
          "bom-ref": "pypi-cryptography/quote@1.0.47"
        },
        {
          "type": "library",
          "name": "self_cell",
          "version": "1.3.0",
          "description": "Safe-to-use proc-macro-free self-referential structs in stable Rust.",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813"
            }
          ],
          "licenses": [
            {
              "expression": "Apache-2.0 OR GPL-2.0-only"
            }
          ],
          "purl": "pkg:cargo/self_cell@1.3.0",
          "bom-ref": "pypi-cryptography/self_cell@1.3.0"
        },
        {
          "type": "library",
          "name": "shlex",
          "version": "2.0.1",
          "description": "Split a string into shell words, like Python's shlex.",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/shlex@2.0.1",
          "bom-ref": "pypi-cryptography/shlex@2.0.1"
        },
        {
          "type": "library",
          "name": "syn",
          "version": "2.0.119",
          "description": "Parser for Rust source code",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/syn@2.0.119",
          "bom-ref": "pypi-cryptography/syn@2.0.119"
        },
        {
          "type": "library",
          "name": "target-lexicon",
          "version": "0.13.5",
          "description": "LLVM target triple types",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
            }
          ],
          "licenses": [
            {
              "expression": "Apache-2.0 WITH LLVM-exception"
            }
          ],
          "purl": "pkg:cargo/target-lexicon@0.13.5",
          "bom-ref": "pypi-cryptography/target-lexicon@0.13.5"
        },
        {
          "type": "library",
          "name": "unicode-ident",
          "version": "1.0.24",
          "description": "Determine whether characters have the XID_Start or XID_Continue properties according to Unicode Standard Annex #31",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
            }
          ],
          "licenses": [
            {
              "expression": "(MIT OR Apache-2.0) AND Unicode-3.0"
            }
          ],
          "purl": "pkg:cargo/unicode-ident@1.0.24",
          "bom-ref": "pypi-cryptography/unicode-ident@1.0.24"
        },
        {
          "type": "library",
          "name": "vcpkg",
          "version": "0.2.15",
          "description": "A library to find native dependencies in a vcpkg tree at build time in order to be used in Cargo build scripts. ",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
            }
          ],
          "licenses": [
            {
              "expression": "MIT OR Apache-2.0"
            }
          ],
          "purl": "pkg:cargo/vcpkg@0.2.15",
          "bom-ref": "pypi-cryptography/vcpkg@0.2.15"
        },
        {
          "type": "library",
          "name": "openssl",
          "version": "4.0.2",
          "purl": "pkg:generic/openssl@4.0.2?download_url=https://github.com/openssl/openssl/releases/download/openssl-4.0.2/openssl-4.0.2.tar.gz",
          "hashes": [
            {
              "alg": "SHA-256",
              "content": "736b467530f916737b7031310ccb21d8218c6229e61e8e160cd1d3458cd543a8"
            }
          ],
          "bom-ref": "pypi-cryptography/openssl@4.0.2"
        }
      ],
      "properties": [
        {
          "name": "vunfisher:nested_sbom",
          "value": "Components below come from the SBOM shipped inside this wheel."
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pypi-pycparser",
      "name": "pycparser",
      "version": "3.0",
      "purl": "pkg:pypi/pycparser@3.0",
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992"
        }
      ],
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pypi-segno",
      "name": "segno",
      "version": "1.6.6",
      "purl": "pkg:pypi/segno@1.6.6",
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "28c7d081ed0cf935e0411293a465efd4d500704072cdb039778a2ab8736190c7"
        }
      ],
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://files.pythonhosted.org/packages/d6/02/12c73fd423eb9577b97fc1924966b929eff7074ae6b2e15dd3d30cb9e4ae/segno-1.6.6-py3-none-any.whl"
        }
      ],
      "properties": [
        {
          "name": "vunfisher:vendored",
          "value": "Source copied into segno/ in the package."
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pypi-defusedxml",
      "name": "defusedxml",
      "version": "0.7.1",
      "purl": "pkg:pypi/defusedxml@0.7.1",
      "licenses": [
        {
          "license": {
            "id": "PSF-2.0"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61"
        }
      ],
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://files.pythonhosted.org/packages/07/6c/aa3f2f849e01cb6a001cd8554a88d4c77c5c1a31c95bdf1cf9301e6d9ef4/defusedxml-0.7.1-py2.py3-none-any.whl"
        }
      ],
      "properties": [
        {
          "name": "vunfisher:vendored",
          "value": "Unmodified copies of three modules in txvf/_vendor/defusedxml/ in the package."
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "vunfisher",
      "dependsOn": [
        "cpython",
        "pypi-cryptography",
        "pypi-segno",
        "pypi-defusedxml"
      ]
    },
    {
      "ref": "pypi-cryptography",
      "dependsOn": [
        "pypi-cffi"
      ]
    },
    {
      "ref": "pypi-cffi",
      "dependsOn": [
        "pypi-pycparser"
      ]
    },
    {
      "ref": "cpython",
      "dependsOn": [
        "runtime-openssl",
        "runtime-sqlite",
        "runtime-libffi",
        "runtime-libtommath",
        "runtime-microsoft-visual-cpp-runtime"
      ]
    }
  ]
}