Trivy SBOM 工作流：生成 CycloneDX、SPDX，再用清单复查漏洞

0270

维护与发布方：Aqua Security / Trivy 项目；原页未确认个人作者。本文依据官方 SBOM 文档完整正文译编，示例输出为原文历史记录，未执行扫描。

Trivy 从授权镜像或文件系统生成 CycloneDX 或 SPDX 清单，再以 trivy sbom 进行后续漏洞复查，三步通过制品身份与生成记录关联。
组件盘点与漏洞复查分开进行，同时保存清单范围和制品身份。（未完纪原创示意图，非产品截图）

版本说明：本文对应2026年10月5日读取的官方 latest 文档快照。另保留原始 v0.75 版本路径供定位；该版本路径未能取得正文，因此不声称两份文档相同，也不把下文 CBOM 能力视作已验证适用于v0.75。命令与格式支持应对照实际安装的版本。

软件物料清单（SBOM）描述一个软件制品包含哪些组件、版本、许可证和依赖关系。Trivy 可以在扫描镜像、文件系统和其他受支持目标时导出清单，再把已保存的清单作为后续漏洞扫描输入。这样，组件盘点与漏洞知识更新可以分开进行：制品未变时，无需每次都把原始制品交给复查系统。

但清单只覆盖生成工具实际发现的内容。它本身不证明来源可信，不等于签名、构建证明或“通过安全认证”；生成与复查两步都要记录范围和时间。

从目标生成清单

官方文档支持两类 SBOM 格式：CycloneDX 和 SPDX。对 image、fs、vm 等适用子命令，通过 --format 选择输出格式，并用 --output 指定文件。例如：

trivy image --format spdx-json --output image.spdx.json alpine:3.15
trivy fs --format cyclonedx --output project.cdx.json /app/myproject

与原文差异：原文复用 result.json，这里分别使用 image.spdx.json 和 project.cdx.json，使格式与对象更明确，也避免两个示例互相覆盖。alpine:3.15 和 /app/myproject 保留为原文历史演示目标；前者不是生产镜像版本建议，后者需指向经授权、确实存在的目录。本文没有实际扫描任何目标。

Trivy 能识别操作系统包和语言生态包，但各类包的检测规则并不相同。清单是否完整，取决于包管理器数据库、锁文件、安装产物、目标范围和工具版本；看到文件输出成功，不代表所有依赖都被识别。

读懂 CycloneDX 的结构

按照这份官方文档快照，Trivy 可输出 CycloneDX JSON，尚不支持该处所述的 XML 输出。常规 image、fs、rootfs 等子命令可以使用 --format cyclonedx。

原文展示的清单主要包含以下信息：

字段 作用
bomFormat、specVersion 说明清单类型和采用的 CycloneDX 规范版本。
serialNumber、version 标识清单及其版本；不能替代制品摘要。
metadata 记录生成时间、工具信息和所描述的顶层制品。
components 组件名称、版本、类型、许可证和包 URL 等信息。
dependencies 通过 ref 与 dependsOn 连接组件关系。

例如，原文把镜像列为 container，把 Alpine 列为 operating-system，把 zlib 列为 library。bom-ref 是文档中的关联标识；purl 描述包生态、名称、版本及附加限定信息。镜像的 purl 还包含摘要、仓库地址和架构。Trivy 的附加属性记录镜像 ID、层摘要、源包名与版本等，帮助追踪组件来自哪里。

组件许可证也有独立含义。原文示例中，alpine-baselayout 标为 GPL-2.0-only，zlib 标为 Zlib。这些是对应组件的许可信息，不是整份文档、镜像中全部代码或其他组件共同采用的许可证。

源文保留了一大段清单输出，重复列出包和依赖关系。本译编解释其完整结构与关键字段；原始示例完整保留于文末“原文历史输出附录”，没有改写为新的扫描结果。

SBOM 与漏洞报告要显式区分

CycloneDX 可以表达软件物料清单，也能表达漏洞清单（BOV）。页面明确说明：只指定 --format cyclonedx 时，默认生成 SBOM，不把漏洞加入输出。需要漏洞信息，应显式启用 --scanners vuln：

trivy image --format cyclonedx --output image.cdx.json alpine:3.15
trivy image --scanners vuln --format cyclonedx --output image-with-vulns.cdx.json alpine:3.15

漏洞记录可以包含 CVE 标识、数据源、不同来源的评分与严重程度、CVSS 向量、CWE、公告地址、发布时间、更新时间，以及受影响组件引用。评分来自哪个数据库必须与分数一起理解；不能把某一来源的数值解释为所有来源的共识。

历史示例边界：原文包含 2022 年时间戳、CycloneDX 1.3 与 1.5，以及与 Alpine 3.15 示例并不完全对应的旧漏洞组件引用。有一段位于默认生成示例下的 JSON 还带有 vulnerabilities。这类混合历史样例不能推翻页面对默认扫描器行为的明确说明，更不能当作独立生成、某个当前镜像的漏洞结论或兼容性保证。

这份 latest 文档快照还介绍：容器镜像的 CycloneDX 输出可承载密码材料清单（CBOM），记录发现的证书与密钥，示例使用 --scanners crypto：

trivy image --scanners crypto --format cyclonedx --output image-crypto.cdx.json alpine:3.15

这是该 latest 文档中的补充能力；本文未确认它在原始 v0.75 地址对应版本中的行为。涉及证书、密钥或内部标识的报告，应控制读取与分发权限，不能假定“只是物料清单”便没有敏感信息。

用 SPDX 输出文本或 JSON

SPDX 可通过 --format spdx 输出标签值格式，或通过 --format spdx-json 输出 JSON。两种格式描述同类信息，选择时应确认下游工具接受哪种格式。

trivy image --format spdx --output image.spdx alpine:3.15
trivy image --format spdx-json --output image.spdx.json alpine:3.15

原文 SPDX 样例头部如下，时间与工具版本属于源文记录，不是本文执行结果：

SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: alpine:3.15
Creator: Organization: aquasecurity
Creator: Tool: trivy-0.58.0
Created: 2025-02-11T07:43:38Z

完整文档还包含命名空间、包信息和关系。包字段包括名称、版本、来源、校验和、主要用途、声明或推定的许可证，以及 purl；CONTAINS 表示包含关系，DEPENDS_ON 表示依赖，DESCRIBES 将文档与被描述制品联系起来。原文中 NOASSERTION 表示没有作出相应断言，不能译成“已证明没有”。FilesAnalyzed: false 也提醒读者，清单不必然包含逐文件分析。

DataLicense: CC0-1.0 是 SPDX 文档数据许可字段，不会把其中列出的 GPL、MIT、OpenSSL 等软件组件统一重新许可为 CC0。判断组件使用义务，仍要看相应包的许可和原始材料。

把 SBOM 作为扫描目标

已有 SBOM 可以直接交给 trivy sbom：

trivy sbom ./image.spdx
trivy sbom ./image.spdx.json

原文给出的基本形式为 trivy sbom ./sbom.spdx；这里仅调整文件名，使其衔接上面的输出。复查结论取决于清单中记录的组件身份和版本，也取决于扫描时的漏洞数据库及检测规则。原制品变化后，应重新生成清单；不能长期复用一份已经过期的盘点结果。

SBOM 再扫描并不是重新检查原始制品中的全部内容。例如，未写入清单的依赖、未覆盖的运行时下载组件，不能因为这次扫描没有报告就被视为安全。需要保留生成工具版本、目标平台、镜像摘要或其他制品身份、清单时间和扫描时间，以便结果可追溯。

目标内部的 SBOM 检测，不等于所有目标都支持

该页面列出容器内部可搜索的扩展名：.spdx、.spdx.json、.cdx、.cdx.json，并提到 Bitnami 镜像内 SBOM 的自动识别。页面支持表将内部 SBOM 检测标为启用的目标只有 Container Image、Rootfs 和 VM Image；Filesystem、Git Repository、Kubernetes、AWS 和 SBOM 目标在该表中没有启用标记。

不要混淆两个问题：fs --format cyclonedx 可以生成文件系统清单，不意味着 Filesystem 目标就启用了上述“自动发现内部 SBOM”的能力。容器镜像还可以通过相应发现机制寻找关联清单，原文链接到镜像目标说明；这是另一条发现入口，不是任意嵌入文件都自动可信。

把清单纳入可审查的交付流程

一个可靠流程应先固定并记录制品身份，再生成与该制品相匹配的清单，检查组件范围和格式，随后保存清单与生成记录，最后用更新后的漏洞信息定期复查。若接收第三方清单，应验证它与交付制品的关联及来源；签名和证明材料需要单独建立、验证，SBOM 不会自动附带这类保证。

静态审核结论：示例没有硬编码秘密或拼接执行远程脚本，但镜像扫描可能读取本地容器凭证、访问仓库并下载数据库，文件系统扫描也可能读到内部工程信息。执行前应限定授权目标和输出权限，避免覆盖重要文件。本文只审阅代码和参数，没有运行 Trivy；没有报告漏洞也不等于不存在漏洞。

来源：Aqua Security / Trivy 项目，SBOM 官方文档；保留原始候选版本地址供追溯。原项目 LICENSE 为 Apache License 2.0；清单示例中的各软件组件许可证与 SPDX 的 CC0 数据许可分别保留其含义，未套用到其他材料。

原文历史输出附录

以下逐段保留上述官方页面的原始示例，不是新运行的扫描。英文键名与机器可读值保持原样；...(snip)... 是原文已存在的省略标记，含该标记的示例不是可直接解析的完整JSON。两份CycloneDX、SPDX标签值和SPDX JSON的时间、镜像摘要、包版本及格式版本各自独立，不能拼成同一次扫描。第二份CycloneDX示例的漏洞字段与其前面的默认扫描器提示存在原文历史混用，须以前文解释的默认行为为准。

生成清单示例：CycloneDX 1.3

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.3",
  "serialNumber": "urn:uuid:2be5773d-7cd3-4b4b-90a5-e165474ddace",
  "version": 1,
  "metadata": {
    "timestamp": "2022-02-22T15:11:40.270597Z",
    "tools": [
      {
        "vendor": "aquasecurity",
        "name": "trivy",
        "version": "dev"
      }
    ],
    "component": {
      "bom-ref": "pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64",
      "type": "container",
      "name": "alpine:3.15",
      "version": "",
      "purl": "pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64",
      "properties": [
        {
          "name": "aquasecurity:trivy:SchemaVersion",
          "value": "2"
        },
        {
          "name": "aquasecurity:trivy:ImageID",
          "value": "sha256:c059bfaa849c4d8e4aecaeb3a10c2d9b3d85f5165c66ad3a4d937758128c4d18"
        },
        {
          "name": "aquasecurity:trivy:RepoDigest",
          "value": "alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759"
        },
        {
          "name": "aquasecurity:trivy:RepoTag",
          "value": "alpine:3.15"
        }
      ]
    }
  },
  "components": [
    {
      "bom-ref": "pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0",
      "type": "library",
      "name": "alpine-baselayout",
      "version": "3.2.0-r18",
      "licenses": [
        {
          "expression": "GPL-2.0-only"
        }
      ],
      "purl": "pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0",
      "properties": [
        {
          "name": "aquasecurity:trivy:SrcName",
          "value": "alpine-baselayout"
        },
        {
          "name": "aquasecurity:trivy:SrcVersion",
          "value": "3.2.0-r18"
        },
        {
          "name": "aquasecurity:trivy:LayerDigest",
          "value": "sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3"
        },
        {
          "name": "aquasecurity:trivy:LayerDiffID",
          "value": "sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759"
        }
      ]
    },
    ...(snip)...
    {
      "bom-ref": "pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0",
      "type": "library",
      "name": "zlib",
      "version": "1.2.11-r3",
      "licenses": [
        {
          "expression": "Zlib"
        }
      ],
      "purl": "pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0",
      "properties": [
        {
          "name": "aquasecurity:trivy:SrcName",
          "value": "zlib"
        },
        {
          "name": "aquasecurity:trivy:SrcVersion",
          "value": "1.2.11-r3"
        },
        {
          "name": "aquasecurity:trivy:LayerDigest",
          "value": "sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3"
        },
        {
          "name": "aquasecurity:trivy:LayerDiffID",
          "value": "sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759"
        }
      ]
    },
    {
      "bom-ref": "3da6a469-964d-4b4e-b67d-e94ec7c88d37",
      "type": "operating-system",
      "name": "alpine",
      "version": "3.15.0",
      "properties": [
        {
          "name": "aquasecurity:trivy:Type",
          "value": "alpine"
        },
        {
          "name": "aquasecurity:trivy:Class",
          "value": "os-pkgs"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "3da6a469-964d-4b4e-b67d-e94ec7c88d37",
      "dependsOn": [
        "pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0",
        "pkg:apk/alpine/alpine-keys@2.4-r1?distro=3.15.0",
        "pkg:apk/alpine/apk-tools@2.12.7-r3?distro=3.15.0",
        "pkg:apk/alpine/busybox@1.34.1-r3?distro=3.15.0",
        "pkg:apk/alpine/ca-certificates-bundle@20191127-r7?distro=3.15.0",
        "pkg:apk/alpine/libc-utils@0.7.2-r3?distro=3.15.0",
        "pkg:apk/alpine/libcrypto1.1@1.1.1l-r7?distro=3.15.0",
        "pkg:apk/alpine/libretls@3.3.4-r2?distro=3.15.0",
        "pkg:apk/alpine/libssl1.1@1.1.1l-r7?distro=3.15.0",
        "pkg:apk/alpine/musl@1.2.2-r7?distro=3.15.0",
        "pkg:apk/alpine/musl-utils@1.2.2-r7?distro=3.15.0",
        "pkg:apk/alpine/scanelf@1.3.3-r0?distro=3.15.0",
        "pkg:apk/alpine/ssl_client@1.34.1-r3?distro=3.15.0",
        "pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0"
      ]
    },
    {
      "ref": "pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64",
      "dependsOn": [
        "3da6a469-964d-4b4e-b67d-e94ec7c88d37"
      ]
    }
  ]
}

CycloneDX默认关闭漏洞扫描的原始提示

$ trivy image --format cyclonedx --output result.json alpine:3.15
2022-07-19T07:47:27.624Z        INFO    "--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the CycloneDX report.

CycloneDX 1.5 与漏洞记录历史示例

$ cat result.json | jq .
{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "urn:uuid:2be5773d-7cd3-4b4b-90a5-e165474ddace",
  "version": 1,
  "metadata": {
    "timestamp": "2022-02-22T15:11:40.270597Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "group": "aquasecurity",
          "name": "trivy",
          "version": "dev"
        }
      ]
    },
    "component": {
      "bom-ref": "pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64",
      "type": "container",
      "name": "alpine:3.15",
      "version": "",
      "purl": "pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64",
      "properties": [
        {
          "name": "aquasecurity:trivy:SchemaVersion",
          "value": "2"
        },
        {
          "name": "aquasecurity:trivy:ImageID",
          "value": "sha256:c059bfaa849c4d8e4aecaeb3a10c2d9b3d85f5165c66ad3a4d937758128c4d18"
        },
        {
          "name": "aquasecurity:trivy:RepoDigest",
          "value": "alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300"
        },
        {
          "name": "aquasecurity:trivy:DiffID",
          "value": "sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759"
        },
        {
          "name": "aquasecurity:trivy:RepoTag",
          "value": "alpine:3.15"
        }
      ]
    }
  },
  "components": [
    {
      "bom-ref": "pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0",
      "type": "library",
      "name": "alpine-baselayout",
      "version": "3.2.0-r18",
      "licenses": [
        {
          "expression": "GPL-2.0-only"
        }
      ],
      "purl": "pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0",
      "properties": [
        {
          "name": "aquasecurity:trivy:SrcName",
          "value": "alpine-baselayout"
        },
        {
          "name": "aquasecurity:trivy:SrcVersion",
          "value": "3.2.0-r18"
        },
        {
          "name": "aquasecurity:trivy:LayerDigest",
          "value": "sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3"
        },
        {
          "name": "aquasecurity:trivy:LayerDiffID",
          "value": "sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759"
        }
      ]
    },
    ...(snip)...
    {
      "bom-ref": "pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0",
      "type": "library",
      "name": "zlib",
      "version": "1.2.11-r3",
      "licenses": [
        {
          "expression": "Zlib"
        }
      ],
      "purl": "pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0",
      "properties": [
        {
          "name": "aquasecurity:trivy:SrcName",
          "value": "zlib"
        },
        {
          "name": "aquasecurity:trivy:SrcVersion",
          "value": "1.2.11-r3"
        },
        {
          "name": "aquasecurity:trivy:LayerDigest",
          "value": "sha256:59bf1c3509f33515622619af21ed55bbe26d24913cedbca106468a5fb37a50c3"
        },
        {
          "name": "aquasecurity:trivy:LayerDiffID",
          "value": "sha256:8d3ac3489996423f53d6087c81180006263b79f206d3fdec9e66f0e27ceb8759"
        }
      ]
    },
    {
      "bom-ref": "3da6a469-964d-4b4e-b67d-e94ec7c88d37",
      "type": "operating-system",
      "name": "alpine",
      "version": "3.15.0",
      "properties": [
        {
          "name": "aquasecurity:trivy:Type",
          "value": "alpine"
        },
        {
          "name": "aquasecurity:trivy:Class",
          "value": "os-pkgs"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "3da6a469-964d-4b4e-b67d-e94ec7c88d37",
      "dependsOn": [
        "pkg:apk/alpine/alpine-baselayout@3.2.0-r18?distro=3.15.0",
        "pkg:apk/alpine/alpine-keys@2.4-r1?distro=3.15.0",
        "pkg:apk/alpine/apk-tools@2.12.7-r3?distro=3.15.0",
        "pkg:apk/alpine/busybox@1.34.1-r3?distro=3.15.0",
        "pkg:apk/alpine/ca-certificates-bundle@20191127-r7?distro=3.15.0",
        "pkg:apk/alpine/libc-utils@0.7.2-r3?distro=3.15.0",
        "pkg:apk/alpine/libcrypto1.1@1.1.1l-r7?distro=3.15.0",
        "pkg:apk/alpine/libretls@3.3.4-r2?distro=3.15.0",
        "pkg:apk/alpine/libssl1.1@1.1.1l-r7?distro=3.15.0",
        "pkg:apk/alpine/musl@1.2.2-r7?distro=3.15.0",
        "pkg:apk/alpine/musl-utils@1.2.2-r7?distro=3.15.0",
        "pkg:apk/alpine/scanelf@1.3.3-r0?distro=3.15.0",
        "pkg:apk/alpine/ssl_client@1.34.1-r3?distro=3.15.0",
        "pkg:apk/alpine/zlib@1.2.11-r3?distro=3.15.0"
      ]
    },
    {
      "ref": "pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64",
      "dependsOn": [
        "3da6a469-964d-4b4e-b67d-e94ec7c88d37"
      ]
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2021-42386",
      "source": {
        "name": "alpine",
        "url": "https://secdb.alpinelinux.org/"
      },
      "ratings": [
        {
          "source": {
            "name": "nvd"
          },
          "score": 7.2,
          "severity": "high",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "source": {
            "name": "nvd"
          },
          "score": 6.5,
          "severity": "medium",
          "method": "CVSSv2",
          "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"
        },
        {
          "source": {
            "name": "redhat"
          },
          "score": 6.6,
          "severity": "medium",
          "method": "CVSSv31",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "cwes": [
        416
      ],
      "description": "A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function",
      "advisories": [
        {
          "url": "https://access.redhat.com/security/cve/CVE-2021-42386"
        },
        {
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386"
        }
      ],
      "published": "2021-11-15 21:15:00 +0000 UTC",
      "updated": "2022-01-04 17:14:00 +0000 UTC",
      "affects": [
        {
          "ref": "pkg:apk/alpine/busybox@1.33.1-r3?distro=3.14.2"
        },
        {
          "ref": "pkg:apk/alpine/ssl_client@1.33.1-r3?distro=3.14.2"
        }
      ]
    }
  ]
}

SPDX 2.3 标签值原始示例

SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: alpine:3.15
DocumentNamespace: http://trivy.dev/container_image/alpine:3.15-12db86e1-4aa4-40ec-900b-5aaa5d82461b
Creator: Organization: aquasecurity
Creator: Tool: trivy-0.58.0
Created: 2025-02-11T07:43:38Z

##### Package: alpine:3.15

PackageName: alpine:3.15
SPDXID: SPDXRef-ContainerImage-d8b2a386253047e7
PackageDownloadLocation: NONE
PrimaryPackagePurpose: CONTAINER
FilesAnalyzed: false
ExternalRef: PACKAGE-MANAGER purl pkg:oci/alpine@sha256%3A19b4bcc4f60e99dd5ebdca0cbce22c503bbcff197549d7e19dab4f22254dc864?arch=amd64&repository_url=index.docker.io%2Flibrary%2Falpine

##### Package: alpine

PackageName: alpine
SPDXID: SPDXRef-OperatingSystem-c24750c3b737d897
PackageVersion: 3.15.11
PackageDownloadLocation: NONE
PrimaryPackagePurpose: OPERATING-SYSTEM
FilesAnalyzed: false

##### Package: libretls

PackageName: libretls
SPDXID: SPDXRef-Package-343391d704e00fbd
PackageVersion: 3.3.4-r3
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: 67dfefe5456c45192b60d76ade98c501b0ae814f
PackageSourceInfo: built package from: libretls 3.3.4-r3
PackageLicenseConcluded: ISC AND BSD-3-Clause AND MIT
PackageLicenseDeclared: ISC AND BSD-3-Clause AND MIT
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/libretls@3.3.4-r3?arch=x86_64&distro=3.15.11

##### Package: libc-utils

PackageName: libc-utils
SPDXID: SPDXRef-Package-43343abe5c1a0439
PackageVersion: 0.7.2-r3
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: 798de3ebb57f3e28f408080746935f213a099722
PackageSourceInfo: built package from: libc-dev 0.7.2-r3
PackageLicenseConcluded: BSD-2-Clause AND BSD-3-Clause
PackageLicenseDeclared: BSD-2-Clause AND BSD-3-Clause
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/libc-utils@0.7.2-r3?arch=x86_64&distro=3.15.11

##### Package: alpine-baselayout

PackageName: alpine-baselayout
SPDXID: SPDXRef-Package-64b7e662458dcd5f
PackageVersion: 3.2.0-r18
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: 132992eab020986b3b5d886a77212889680467a0
PackageSourceInfo: built package from: alpine-baselayout 3.2.0-r18
PackageLicenseConcluded: GPL-2.0-only
PackageLicenseDeclared: GPL-2.0-only
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/alpine-baselayout@3.2.0-r18?arch=x86_64&distro=3.15.11

##### Package: busybox

PackageName: busybox
SPDXID: SPDXRef-Package-6c7c9dac75e301b7
PackageVersion: 1.34.1-r7
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: 21f9265e7a34c795fba4e99c8ae37b57f31cd1a2
PackageSourceInfo: built package from: busybox 1.34.1-r7
PackageLicenseConcluded: GPL-2.0-only
PackageLicenseDeclared: GPL-2.0-only
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/busybox@1.34.1-r7?arch=x86_64&distro=3.15.11

##### Package: ca-certificates-bundle

PackageName: ca-certificates-bundle
SPDXID: SPDXRef-Package-702c9bf0cfddb42e
PackageVersion: 20230506-r0
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: 99894c0b834a3f5955e6e5d5f0d804943f05ff52
PackageSourceInfo: built package from: ca-certificates 20230506-r0
PackageLicenseConcluded: MPL-2.0 AND MIT
PackageLicenseDeclared: MPL-2.0 AND MIT
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/ca-certificates-bundle@20230506-r0?arch=x86_64&distro=3.15.11

##### Package: musl-utils

PackageName: musl-utils
SPDXID: SPDXRef-Package-92eb9ab29b057905
PackageVersion: 1.2.2-r9
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: f69aa6d6a57c90358005ce61ccb4ad96cdc303f4
PackageSourceInfo: built package from: musl 1.2.2-r9
PackageLicenseConcluded: MIT AND BSD-3-Clause AND GPL-2.0-or-later
PackageLicenseDeclared: MIT AND BSD-3-Clause AND GPL-2.0-or-later
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/musl-utils@1.2.2-r9?arch=x86_64&distro=3.15.11

##### Package: scanelf

PackageName: scanelf
SPDXID: SPDXRef-Package-988bca2f70cf58f6
PackageVersion: 1.3.3-r0
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: d7f7590e450870a4f79671c2369b31b5bb07349a
PackageSourceInfo: built package from: pax-utils 1.3.3-r0
PackageLicenseConcluded: GPL-2.0-only
PackageLicenseDeclared: GPL-2.0-only
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/scanelf@1.3.3-r0?arch=x86_64&distro=3.15.11

##### Package: apk-tools

PackageName: apk-tools
SPDXID: SPDXRef-Package-aa2e51a695e95cb9
PackageVersion: 2.12.7-r3
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: ddf3ddf8545768bc323649559feaae1560f29273
PackageSourceInfo: built package from: apk-tools 2.12.7-r3
PackageLicenseConcluded: GPL-2.0-only
PackageLicenseDeclared: GPL-2.0-only
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/apk-tools@2.12.7-r3?arch=x86_64&distro=3.15.11

##### Package: libcrypto1.1

PackageName: libcrypto1.1
SPDXID: SPDXRef-Package-ba5f079c5c32fc8
PackageVersion: 1.1.1w-r1
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: e378634f5c8af32ca75ac56f41ecf4e8d49584a0
PackageSourceInfo: built package from: openssl 1.1.1w-r1
PackageLicenseConcluded: OpenSSL
PackageLicenseDeclared: OpenSSL
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/libcrypto1.1@1.1.1w-r1?arch=x86_64&distro=3.15.11

##### Package: alpine-keys

PackageName: alpine-keys
SPDXID: SPDXRef-Package-be18726b6be779d1
PackageVersion: 2.4-r1
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: 903176b2d2a8ddefd1ba6940f19ad17c2c1d4aff
PackageSourceInfo: built package from: alpine-keys 2.4-r1
PackageLicenseConcluded: MIT
PackageLicenseDeclared: MIT
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/alpine-keys@2.4-r1?arch=x86_64&distro=3.15.11

##### Package: ssl_client

PackageName: ssl_client
SPDXID: SPDXRef-Package-d9ad92ed9413c93b
PackageVersion: 1.34.1-r7
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: dddfa62dd51bd8807ee1d8660e860574a9dd78ed
PackageSourceInfo: built package from: busybox 1.34.1-r7
PackageLicenseConcluded: GPL-2.0-only
PackageLicenseDeclared: GPL-2.0-only
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/ssl_client@1.34.1-r7?arch=x86_64&distro=3.15.11

##### Package: musl

PackageName: musl
SPDXID: SPDXRef-Package-ee9b5186331e7a76
PackageVersion: 1.2.2-r9
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: 7ebdef6cf7f9b58c0e213b333db946d22b00b777
PackageSourceInfo: built package from: musl 1.2.2-r9
PackageLicenseConcluded: MIT
PackageLicenseDeclared: MIT
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/musl@1.2.2-r9?arch=x86_64&distro=3.15.11

##### Package: libssl1.1

PackageName: libssl1.1
SPDXID: SPDXRef-Package-f00669065070476c
PackageVersion: 1.1.1w-r1
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: 9306ed15b3bdfc7553d5c14c472d87a41fef8541
PackageSourceInfo: built package from: openssl 1.1.1w-r1
PackageLicenseConcluded: OpenSSL
PackageLicenseDeclared: OpenSSL
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/libssl1.1@1.1.1w-r1?arch=x86_64&distro=3.15.11

##### Package: zlib

PackageName: zlib
SPDXID: SPDXRef-Package-fcb106f21773cad3
PackageVersion: 1.2.12-r3
PackageSupplier: NOASSERTION
PackageDownloadLocation: NONE
PrimaryPackagePurpose: LIBRARY
FilesAnalyzed: false
PackageChecksum: SHA1: ab98d0416bf1dcd245c7b0800f99cbceacfa48b3
PackageSourceInfo: built package from: zlib 1.2.12-r3
PackageLicenseConcluded: Zlib
PackageLicenseDeclared: Zlib
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/zlib@1.2.12-r3?arch=x86_64&distro=3.15.11

##### Relationships

Relationship: SPDXRef-ContainerImage-d8b2a386253047e7 CONTAINS SPDXRef-OperatingSystem-c24750c3b737d897
Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-ContainerImage-d8b2a386253047e7
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-343391d704e00fbd
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-43343abe5c1a0439
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-64b7e662458dcd5f
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-6c7c9dac75e301b7
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-702c9bf0cfddb42e
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-92eb9ab29b057905
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-988bca2f70cf58f6
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-aa2e51a695e95cb9
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-ba5f079c5c32fc8
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-be18726b6be779d1
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-d9ad92ed9413c93b
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-ee9b5186331e7a76
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-f00669065070476c
Relationship: SPDXRef-OperatingSystem-c24750c3b737d897 CONTAINS SPDXRef-Package-fcb106f21773cad3
Relationship: SPDXRef-Package-343391d704e00fbd DEPENDS_ON SPDXRef-Package-702c9bf0cfddb42e
Relationship: SPDXRef-Package-343391d704e00fbd DEPENDS_ON SPDXRef-Package-ba5f079c5c32fc8
Relationship: SPDXRef-Package-343391d704e00fbd DEPENDS_ON SPDXRef-Package-ee9b5186331e7a76
Relationship: SPDXRef-Package-343391d704e00fbd DEPENDS_ON SPDXRef-Package-f00669065070476c
Relationship: SPDXRef-Package-43343abe5c1a0439 DEPENDS_ON SPDXRef-Package-92eb9ab29b057905
Relationship: SPDXRef-Package-64b7e662458dcd5f DEPENDS_ON SPDXRef-Package-6c7c9dac75e301b7
Relationship: SPDXRef-Package-64b7e662458dcd5f DEPENDS_ON SPDXRef-Package-ee9b5186331e7a76
Relationship: SPDXRef-Package-6c7c9dac75e301b7 DEPENDS_ON SPDXRef-Package-ee9b5186331e7a76
Relationship: SPDXRef-Package-92eb9ab29b057905 DEPENDS_ON SPDXRef-Package-988bca2f70cf58f6
Relationship: SPDXRef-Package-92eb9ab29b057905 DEPENDS_ON SPDXRef-Package-ee9b5186331e7a76
Relationship: SPDXRef-Package-988bca2f70cf58f6 DEPENDS_ON SPDXRef-Package-ee9b5186331e7a76
Relationship: SPDXRef-Package-aa2e51a695e95cb9 DEPENDS_ON SPDXRef-Package-702c9bf0cfddb42e
Relationship: SPDXRef-Package-aa2e51a695e95cb9 DEPENDS_ON SPDXRef-Package-ba5f079c5c32fc8
Relationship: SPDXRef-Package-aa2e51a695e95cb9 DEPENDS_ON SPDXRef-Package-ee9b5186331e7a76
Relationship: SPDXRef-Package-aa2e51a695e95cb9 DEPENDS_ON SPDXRef-Package-f00669065070476c
Relationship: SPDXRef-Package-aa2e51a695e95cb9 DEPENDS_ON SPDXRef-Package-fcb106f21773cad3
Relationship: SPDXRef-Package-ba5f079c5c32fc8 DEPENDS_ON SPDXRef-Package-ee9b5186331e7a76
Relationship: SPDXRef-Package-d9ad92ed9413c93b DEPENDS_ON SPDXRef-Package-343391d704e00fbd
Relationship: SPDXRef-Package-d9ad92ed9413c93b DEPENDS_ON SPDXRef-Package-ee9b5186331e7a76
Relationship: SPDXRef-Package-f00669065070476c DEPENDS_ON SPDXRef-Package-ba5f079c5c32fc8
Relationship: SPDXRef-Package-f00669065070476c DEPENDS_ON SPDXRef-Package-ee9b5186331e7a76
Relationship: SPDXRef-Package-fcb106f21773cad3 DEPENDS_ON SPDXRef-Package-ee9b5186331e7a76

SPDX 2.3 JSON 原始示例

{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "alpine:3.15",
  "documentNamespace": "http://trivy.dev/container_image/alpine:3.15-bbe0096f-0ed0-47b4-bbea-82121a9201f1",
  "creationInfo": {
    "creators": [
      "Organization: aquasecurity",
      "Tool: trivy-0.58.0"
    ],
    "created": "2025-02-13T12:22:22Z"
  },
  "packages": [
    {
      "name": "alpine:3.15",
      "SPDXID": "SPDXRef-ContainerImage-d8b2a386253047e7",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:oci/alpine@sha256%3A19b4bcc4f60e99dd5ebdca0cbce22c503bbcff197549d7e19dab4f22254dc864?arch=amd64\u0026repository_url=index.docker.io%2Flibrary%2Falpine"
        }
      ],
      "primaryPackagePurpose": "CONTAINER",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "DiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "ImageID: sha256:32b91e3161c8fc2e3baf2732a594305ca5093c82ff4e0c9f6ebbd2a879468e1d"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "RepoDigest: alpine@sha256:19b4bcc4f60e99dd5ebdca0cbce22c503bbcff197549d7e19dab4f22254dc864"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "RepoTag: alpine:3.15"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "SchemaVersion: 2"
        }
      ]
    },
    {
      "name": "alpine-baselayout",
      "SPDXID": "SPDXRef-Package-64b7e662458dcd5f",
      "versionInfo": "3.2.0-r18",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "132992eab020986b3b5d886a77212889680467a0"
        }
      ],
      "sourceInfo": "built package from: alpine-baselayout 3.2.0-r18",
      "licenseConcluded": "GPL-2.0-only",
      "licenseDeclared": "GPL-2.0-only",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/alpine-baselayout@3.2.0-r18?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: alpine-baselayout@3.2.0-r18"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "alpine-keys",
      "SPDXID": "SPDXRef-Package-be18726b6be779d1",
      "versionInfo": "2.4-r1",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "903176b2d2a8ddefd1ba6940f19ad17c2c1d4aff"
        }
      ],
      "sourceInfo": "built package from: alpine-keys 2.4-r1",
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/alpine-keys@2.4-r1?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: alpine-keys@2.4-r1"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "apk-tools",
      "SPDXID": "SPDXRef-Package-aa2e51a695e95cb9",
      "versionInfo": "2.12.7-r3",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "ddf3ddf8545768bc323649559feaae1560f29273"
        }
      ],
      "sourceInfo": "built package from: apk-tools 2.12.7-r3",
      "licenseConcluded": "GPL-2.0-only",
      "licenseDeclared": "GPL-2.0-only",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/apk-tools@2.12.7-r3?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: apk-tools@2.12.7-r3"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "busybox",
      "SPDXID": "SPDXRef-Package-6c7c9dac75e301b7",
      "versionInfo": "1.34.1-r7",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "21f9265e7a34c795fba4e99c8ae37b57f31cd1a2"
        }
      ],
      "sourceInfo": "built package from: busybox 1.34.1-r7",
      "licenseConcluded": "GPL-2.0-only",
      "licenseDeclared": "GPL-2.0-only",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/busybox@1.34.1-r7?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: busybox@1.34.1-r7"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "ca-certificates-bundle",
      "SPDXID": "SPDXRef-Package-702c9bf0cfddb42e",
      "versionInfo": "20230506-r0",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "99894c0b834a3f5955e6e5d5f0d804943f05ff52"
        }
      ],
      "sourceInfo": "built package from: ca-certificates 20230506-r0",
      "licenseConcluded": "MPL-2.0 AND MIT",
      "licenseDeclared": "MPL-2.0 AND MIT",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/ca-certificates-bundle@20230506-r0?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: ca-certificates-bundle@20230506-r0"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "libc-utils",
      "SPDXID": "SPDXRef-Package-43343abe5c1a0439",
      "versionInfo": "0.7.2-r3",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "798de3ebb57f3e28f408080746935f213a099722"
        }
      ],
      "sourceInfo": "built package from: libc-dev 0.7.2-r3",
      "licenseConcluded": "BSD-2-Clause AND BSD-3-Clause",
      "licenseDeclared": "BSD-2-Clause AND BSD-3-Clause",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/libc-utils@0.7.2-r3?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: libc-utils@0.7.2-r3"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "libcrypto1.1",
      "SPDXID": "SPDXRef-Package-ba5f079c5c32fc8",
      "versionInfo": "1.1.1w-r1",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "e378634f5c8af32ca75ac56f41ecf4e8d49584a0"
        }
      ],
      "sourceInfo": "built package from: openssl 1.1.1w-r1",
      "licenseConcluded": "OpenSSL",
      "licenseDeclared": "OpenSSL",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/libcrypto1.1@1.1.1w-r1?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: libcrypto1.1@1.1.1w-r1"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "libretls",
      "SPDXID": "SPDXRef-Package-343391d704e00fbd",
      "versionInfo": "3.3.4-r3",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "67dfefe5456c45192b60d76ade98c501b0ae814f"
        }
      ],
      "sourceInfo": "built package from: libretls 3.3.4-r3",
      "licenseConcluded": "ISC AND BSD-3-Clause AND MIT",
      "licenseDeclared": "ISC AND BSD-3-Clause AND MIT",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/libretls@3.3.4-r3?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: libretls@3.3.4-r3"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "libssl1.1",
      "SPDXID": "SPDXRef-Package-f00669065070476c",
      "versionInfo": "1.1.1w-r1",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "9306ed15b3bdfc7553d5c14c472d87a41fef8541"
        }
      ],
      "sourceInfo": "built package from: openssl 1.1.1w-r1",
      "licenseConcluded": "OpenSSL",
      "licenseDeclared": "OpenSSL",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/libssl1.1@1.1.1w-r1?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: libssl1.1@1.1.1w-r1"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "musl",
      "SPDXID": "SPDXRef-Package-ee9b5186331e7a76",
      "versionInfo": "1.2.2-r9",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "7ebdef6cf7f9b58c0e213b333db946d22b00b777"
        }
      ],
      "sourceInfo": "built package from: musl 1.2.2-r9",
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/musl@1.2.2-r9?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: musl@1.2.2-r9"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "musl-utils",
      "SPDXID": "SPDXRef-Package-92eb9ab29b057905",
      "versionInfo": "1.2.2-r9",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "f69aa6d6a57c90358005ce61ccb4ad96cdc303f4"
        }
      ],
      "sourceInfo": "built package from: musl 1.2.2-r9",
      "licenseConcluded": "MIT AND BSD-3-Clause AND GPL-2.0-or-later",
      "licenseDeclared": "MIT AND BSD-3-Clause AND GPL-2.0-or-later",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/musl-utils@1.2.2-r9?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: musl-utils@1.2.2-r9"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "scanelf",
      "SPDXID": "SPDXRef-Package-988bca2f70cf58f6",
      "versionInfo": "1.3.3-r0",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "d7f7590e450870a4f79671c2369b31b5bb07349a"
        }
      ],
      "sourceInfo": "built package from: pax-utils 1.3.3-r0",
      "licenseConcluded": "GPL-2.0-only",
      "licenseDeclared": "GPL-2.0-only",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/scanelf@1.3.3-r0?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: scanelf@1.3.3-r0"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "ssl_client",
      "SPDXID": "SPDXRef-Package-d9ad92ed9413c93b",
      "versionInfo": "1.34.1-r7",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "dddfa62dd51bd8807ee1d8660e860574a9dd78ed"
        }
      ],
      "sourceInfo": "built package from: busybox 1.34.1-r7",
      "licenseConcluded": "GPL-2.0-only",
      "licenseDeclared": "GPL-2.0-only",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/ssl_client@1.34.1-r7?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: ssl_client@1.34.1-r7"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "zlib",
      "SPDXID": "SPDXRef-Package-fcb106f21773cad3",
      "versionInfo": "1.2.12-r3",
      "supplier": "NOASSERTION",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "checksums": [
        {
          "algorithm": "SHA1",
          "checksumValue": "ab98d0416bf1dcd245c7b0800f99cbceacfa48b3"
        }
      ],
      "sourceInfo": "built package from: zlib 1.2.12-r3",
      "licenseConcluded": "Zlib",
      "licenseDeclared": "Zlib",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:apk/alpine/zlib@1.2.12-r3?arch=x86_64\u0026distro=3.15.11"
        }
      ],
      "primaryPackagePurpose": "LIBRARY",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDiffID: sha256:2879a4821959ab702528e28a1c59cd26c4956112497f6d1dbfd86c8d88003983"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "LayerDigest: sha256:d078792c4f9122259f14b539315bd92cbd9490ed73e08255a08689122b143108"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgID: zlib@1.2.12-r3"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "PkgType: alpine"
        }
      ]
    },
    {
      "name": "alpine",
      "SPDXID": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "versionInfo": "3.15.11",
      "downloadLocation": "NONE",
      "filesAnalyzed": false,
      "primaryPackagePurpose": "OPERATING-SYSTEM",
      "annotations": [
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "Class: os-pkgs"
        },
        {
          "annotator": "Tool: trivy-0.58.0",
          "annotationDate": "2025-02-13T12:22:22Z",
          "annotationType": "OTHER",
          "comment": "Type: alpine"
        }
      ]
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-ContainerImage-d8b2a386253047e7",
      "relatedSpdxElement": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relatedSpdxElement": "SPDXRef-ContainerImage-d8b2a386253047e7",
      "relationshipType": "DESCRIBES"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-343391d704e00fbd",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-43343abe5c1a0439",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-64b7e662458dcd5f",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-6c7c9dac75e301b7",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-702c9bf0cfddb42e",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-92eb9ab29b057905",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-988bca2f70cf58f6",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-aa2e51a695e95cb9",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-ba5f079c5c32fc8",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-be18726b6be779d1",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-d9ad92ed9413c93b",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-f00669065070476c",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-OperatingSystem-c24750c3b737d897",
      "relatedSpdxElement": "SPDXRef-Package-fcb106f21773cad3",
      "relationshipType": "CONTAINS"
    },
    {
      "spdxElementId": "SPDXRef-Package-343391d704e00fbd",
      "relatedSpdxElement": "SPDXRef-Package-702c9bf0cfddb42e",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-343391d704e00fbd",
      "relatedSpdxElement": "SPDXRef-Package-ba5f079c5c32fc8",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-343391d704e00fbd",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-343391d704e00fbd",
      "relatedSpdxElement": "SPDXRef-Package-f00669065070476c",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-43343abe5c1a0439",
      "relatedSpdxElement": "SPDXRef-Package-92eb9ab29b057905",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-64b7e662458dcd5f",
      "relatedSpdxElement": "SPDXRef-Package-6c7c9dac75e301b7",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-64b7e662458dcd5f",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-6c7c9dac75e301b7",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-92eb9ab29b057905",
      "relatedSpdxElement": "SPDXRef-Package-988bca2f70cf58f6",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-92eb9ab29b057905",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-988bca2f70cf58f6",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-aa2e51a695e95cb9",
      "relatedSpdxElement": "SPDXRef-Package-702c9bf0cfddb42e",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-aa2e51a695e95cb9",
      "relatedSpdxElement": "SPDXRef-Package-ba5f079c5c32fc8",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-aa2e51a695e95cb9",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-aa2e51a695e95cb9",
      "relatedSpdxElement": "SPDXRef-Package-f00669065070476c",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-aa2e51a695e95cb9",
      "relatedSpdxElement": "SPDXRef-Package-fcb106f21773cad3",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-ba5f079c5c32fc8",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-d9ad92ed9413c93b",
      "relatedSpdxElement": "SPDXRef-Package-343391d704e00fbd",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-d9ad92ed9413c93b",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-f00669065070476c",
      "relatedSpdxElement": "SPDXRef-Package-ba5f079c5c32fc8",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-f00669065070476c",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "DEPENDS_ON"
    },
    {
      "spdxElementId": "SPDXRef-Package-fcb106f21773cad3",
      "relatedSpdxElement": "SPDXRef-Package-ee9b5186331e7a76",
      "relationshipType": "DEPENDS_ON"
    }
  ]
}

相关代码版权及许可

Trivy 上游项目的完整 Apache License 2.0 与实际 NOTICE 如下。此处保留相关示例代码版权与许可；SPDX 的 CC0 数据字段和列表中各软件组件许可证分别具有自己的范围，不会互相替代。中文译编、安全边界解释与输出文件名调整由未完纪于2026-10-05增加或修改。来源：LICENSE、NOTICE。

                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

   1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.

      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.

   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

   END OF TERMS AND CONDITIONS

   APPENDIX: How to apply the Apache License to your work.

      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.

   Copyright [yyyy] [name of copyright owner]

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

Trivy
Copyright 2019-2020 Aqua Security Software Ltd. 

This product includes software developed by Aqua Security (https://aquasec.com).
© 版权声明
文章版权归作者所有，未经允许请勿转载。
THE END
技术译文
# Trivy# SBOM# CycloneDX# SPDX# 软件供应链
喜欢就支持一下吧
点赞0 分享
彩雨伞的头像-未完纪钻石会员
Self-introduction-未完纪
Self-introduction
Self-introduction
8天前 72
使用宝塔为 AList 配置反向代理与 HTTPS-未完纪
使用宝塔为 AList 配置反向代理与 HTTPS
使用宝塔为 AList 配置反向代理与 HTTPS
前天 59
AingDesk：在电脑上部署 DeepSeek-未完纪
AingDesk：在电脑上部署 DeepSeek
AingDesk：在电脑上部署 DeepSeek
2天前 57
新一代垃圾回收器 ZGC 的探索与实践：重读美团 JDK 11 调优案例-未完纪
新一代垃圾回收器 ZGC 的探索与实践：重读美团 JDK 11 调优案例
新一代垃圾回收器 ZGC 的探索与实践：重读美团 JDK 11 调优案例
8小时前 57
WordPress 接入 Microsoft Clarity Cookie 同意与偏好设置-未完纪
WordPress 接入 Microsoft Clarity Cookie 同意与偏好设置
WordPress 接入 Microsoft Clarity Cookie 同意与偏好设置
前天 56
注册区块变体，同时在插入器中隐藏它-未完纪
注册区块变体，同时在插入器中隐藏它
注册区块变体，同时在插入器中隐藏它
前天 56
相关推荐
新一代垃圾回收器 ZGC 的探索与实践：重读美团 JDK 11 调优案例-未完纪
新一代垃圾回收器 ZGC 的探索与实践：重读美团 JDK 11 调优案例
新一代垃圾回收器 ZGC 的探索与实践：重读美团 JDK 11 调优案例
8小时前 57
注册区块变体，同时在插入器中隐藏它-未完纪
注册区块变体，同时在插入器中隐藏它
注册区块变体，同时在插入器中隐藏它
前天 56
用内部审计器测试数百个网页的 Cookie 行为-未完纪
用内部审计器测试数百个网页的 Cookie 行为
用内部审计器测试数百个网页的 Cookie 行为
昨天 55
从用户序列到扩展规律：Meta 广告排序的多阶段架构-未完纪
从用户序列到扩展规律：Meta 广告排序的多阶段架构
从用户序列到扩展规律：Meta 广告排序的多阶段架构
昨天 55
用 Ansible 定制 Loki 部署-未完纪
用 Ansible 定制 Loki 部署
用 Ansible 定制 Loki 部署
昨天 55
用维度表加速字符串聚合-未完纪
用维度表加速字符串聚合
用维度表加速字符串聚合
前天 54
评论 抢沙发

请登录后发表评论

    暂无评论内容