{
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "tang-0.14-2.oe2403sp4.aarch64.rpm",
  "spdxVersion": "SPDX-2.2",
  "creationInfo": {
    "created": "2026-07-04T04:28:12.092529219Z",
    "creators": [
      "openeuler_creator"
    ]
  },
  "dataLicense": "CC0-1.0",
  "documentNamespace": "https://sbom.openEuler.org/tang-0.14-2.oe2403sp4.aarch64.rpm",
  "packages": [
    {
      "SPDXID": "SPDXRef-rpm-tang-14",
      "name": "tang",
      "licenseConcluded": "GPLv3+",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "ac97e102c50a59e0f792384d2d9d29492ce48be66984f30ec01efef23e9839c5"
        }
      ],
      "description": "This package is a server for binding data to network presence.\nFirst, the client gets a list of the Tang server's advertised asymmetric keys.\nThis can happen online by a simple HTTP GET. Alternatively, since the keys are\nasymmetric, the public key list can be distributed out of band.\nSecond, the client uses one of these public keys to generate a unique,\ncryptographically strong encryption key. The data is then encrypted using this\nkey. Once the data is encrypted, the key is discarded. Some small metadata is\nproduced as part of this operation which the client should store in a convenient\nlocation. This process of encrypting data is the provisioning step.\nThird, when the client is ready to access its data, it simply loads the metadata\nproduced in the provisioning step and performs an HTTP POST in order to recover\nthe encryption key. This process is the recovery step.",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/tang@14-2.oe2403sp4?arch=aarch64&epoch=0&upstream=tang-14-2.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "https://github.com/latchset/tang",
      "licenseDeclared": "GPLv3+",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "Server for binding data to network presence",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "0:14-2.oe2403sp4"
    },
    {
      "SPDXID": "SPDXRef-rpm-bash-5.2.15",
      "name": "bash",
      "licenseConcluded": "GPLv3",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "9e44c67402e88f8c3409ae71f375e1239d0fe67abb011f90acd3cff8eed95a11"
        }
      ],
      "description": "Bash is the GNU Project's shell. Bash is the Bourne Again SHell. Bash is an sh-compatible\nshell that incorporates useful features from the Korn shell (ksh) and C shell (csh). It is\nintended to conform to the IEEE POSIX P1003.2/ISO 9945.2 Shell and Tools standard. It offers\nfunctional improvements over sh for both programming and interactive use. In addition, most\nsh scripts can be run by Bash without modification.",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/bash@5.2.15-19.oe2403sp4?arch=aarch64&epoch=0&upstream=bash-5.2.15-19.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "https://www.gnu.org/software/bash",
      "licenseDeclared": "GPLv3",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "It is the Bourne Again Shell",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "0:5.2.15-19.oe2403sp4"
    },
    {
      "SPDXID": "SPDXRef-rpm-coreutils-9.4",
      "name": "coreutils",
      "licenseConcluded": "GPLv3+",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "9a45326d88eefd6f8a0018a1626f7decc11e3649f47296d7ce55e5ce473c3296"
        }
      ],
      "description": "These are the GNU core utilities.  This package is the combination of\nthe old GNU fileutils, sh-utils, and textutils packages.",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/coreutils@9.4-22.oe2403sp4?arch=aarch64&epoch=0&upstream=coreutils-9.4-22.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "https://www.gnu.org/software/coreutils/",
      "licenseDeclared": "GPLv3+",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "A set of basic GNU tools commonly used in shell scripts",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "0:9.4-22.oe2403sp4"
    },
    {
      "SPDXID": "SPDXRef-rpm-glibc-2.38",
      "name": "glibc",
      "licenseConcluded": "LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net-2.0 and ISC and Public Domain and GFDL-1.3-only",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "972f6f0ead2fbc0f525623aa566baec969734e89308b0c92aa05a9f8d3c7299f"
        }
      ],
      "description": "The GNU C Library project provides the core libraries for the GNU system and\nGNU/Linux systems, as well as many other systems that use Linux as the kernel.\nThese libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD,\nOS-specific APIs and more. These APIs include such foundational facilities as\nopen, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt,\n login, exit and more.",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/glibc@2.38-107.oe2403sp4?arch=aarch64&epoch=0&upstream=glibc-2.38-107.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "http://www.gnu.org/software/glibc/",
      "licenseDeclared": "LGPLv2+ and LGPLv2+ with exceptions and GPLv2+ and GPLv2+ with exceptions and BSD and Inner-Net-2.0 and ISC and Public Domain and GFDL-1.3-only",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "The GNU libc libraries",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "0:2.38-107.oe2403sp4"
    },
    {
      "SPDXID": "SPDXRef-rpm-grep-3.11",
      "name": "grep",
      "licenseConcluded": "GPLv3+",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "4a5a2ca0089455cc95979c7057e83cbeaf584e27d48e562810c22ad335cb607b"
        }
      ],
      "description": "Grep searches one or more input files for lines containing a match to\na specified pattern. By default, Grep outputs the matching lines.",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/grep@3.11-5.oe2403sp4?arch=aarch64&epoch=0&upstream=grep-3.11-5.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "https://www.gnu.org/software/grep",
      "licenseDeclared": "GPLv3+",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "A string search utility",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "0:3.11-5.oe2403sp4"
    },
    {
      "SPDXID": "SPDXRef-rpm-http-parser-2.9.4",
      "name": "http-parser",
      "licenseConcluded": "MIT",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "3c394991acd6e60e2e55b10ec4bb3dfa36dab7aa6c4b21138cfa78fbde769846"
        }
      ],
      "description": "http-parser parses the HTTP request headers and body. As such, it acts as\na barrier in the policy to guarantee that the entire content has been received\nbefore any other filters are invoked.The parser filter forces the server\nto do \"store-and-forward\" routing instead of the default \"cut-through\" routing,\nwhere the request is only parsed on-demand. This filter can be used as a simple test\nto ensure that the message is XML, for example.\n\nFeatures:\n\n  * No dependencies\n  * Handles persistent streams (keep-alive)\n  * Decodes chunked encoding\n  * Upgrade support\n  * Defends against buffer overflow attacks",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/http-parser@2.9.4-3.oe2403sp4?arch=aarch64&epoch=0&upstream=http-parser-2.9.4-3.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "https://gitee.com/openeuler/http-parser",
      "licenseDeclared": "MIT",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "HTTP request/response parser for C",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "0:2.9.4-3.oe2403sp4"
    },
    {
      "SPDXID": "SPDXRef-rpm-jansson-2.14",
      "name": "jansson",
      "licenseConcluded": "MIT",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "20f1d3d3bcb91ee91010faf701a28e021b74e38c11cbdce4e563717ada85edaa"
        }
      ],
      "description": "Jansson is a C library for encoding, decoding and manipulating JSON data.",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/jansson@2.14-4.oe2403sp4?arch=aarch64&epoch=0&upstream=jansson-2.14-4.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "http://www.digip.org/jansson/",
      "licenseDeclared": "MIT",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "A C library for encoding, decoding and manipulating JSON data",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "0:2.14-4.oe2403sp4"
    },
    {
      "SPDXID": "SPDXRef-rpm-jose-14",
      "name": "jose",
      "licenseConcluded": "ASL 2.0",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "cd2313b3223e1ffdeda7d5af03b9189425253a42d87e53422cd6dc383e2381b4"
        }
      ],
      "description": "José is a C-language implementation of the Javascript Object\nSigning and Encryption standards. José provides a command-line\nutility which encompasses most of the JOSE features. This allows\nfor easy integration into your project and one-off scripts.",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/jose@14-1.oe2403sp4?arch=aarch64&epoch=0&upstream=jose-14-1.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "https://github.com/latchset/jose",
      "licenseDeclared": "ASL 2.0",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "José is a command line utility for performing various tasks on JSON  objects",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "0:14-1.oe2403sp4"
    },
    {
      "SPDXID": "SPDXRef-rpm-sed-4.9",
      "name": "sed",
      "licenseConcluded": "GPLv3+",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "e4156e50c8dca5f4d1dfce1f9d670f997e51ca7670445822226e54f12c21dfbf"
        }
      ],
      "description": "Sed is a non-interactive command-line text editor. A stream editor is used\nto per-form basic text transformations on an input stream (a file or input\nfrom a pipeline).",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/sed@4.9-5.oe2403sp4?arch=aarch64&epoch=0&upstream=sed-4.9-5.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "https://www.gnu.org/software/sed/",
      "licenseDeclared": "GPLv3+",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "non-interactive command-line text editor",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "0:4.9-5.oe2403sp4"
    },
    {
      "SPDXID": "SPDXRef-rpm-shadow-4.14.3",
      "name": "shadow",
      "licenseConcluded": "BSD and GPLv2+",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "12132c219b316b027d3910effca343da906065d681eb641bf8fbdec42b8b242f"
        }
      ],
      "description": "This package includes the necessary programs for converting plain\npassword files to the shadow password format and to manage user and\ngroup accounts.",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/shadow@4.14.3-8.oe2403sp4?arch=aarch64&epoch=2&upstream=shadow-4.14.3-8.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "http://pkg-shadow.alioth.debian.org/",
      "licenseDeclared": "BSD and GPLv2+",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "Tools for managing accounts and shadow password files",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "2:4.14.3-8.oe2403sp4"
    },
    {
      "SPDXID": "SPDXRef-rpm-systemd-255",
      "name": "systemd",
      "licenseConcluded": "MIT and LGPLv2+ and GPLv2+",
      "checksums": [
        {
          "algorithm": "SHA256",
          "checksumValue": "9cd0808d44a64af9f3cbc48e55078e63635c050abc77b644485604a5f12bf3b2"
        }
      ],
      "description": "systemd is a system and service manager that runs as PID 1 and starts\nthe rest of the system.",
      "downloadLocation": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:rpm/systemd@255-59.oe2403sp4?arch=aarch64&epoch=0&upstream=systemd-255-59.oe2403sp4.src.rpm",
          "referenceType": "purl"
        }
      ],
      "filesAnalyzed": false,
      "homepage": "https://systemd.io/",
      "licenseDeclared": "MIT and LGPLv2+ and GPLv2+",
      "sourceInfo": "acquired package info from repodata DB: repodata/f1f85c23079e7764ad00378a9fc5d660b89a03657290e75426caf7be5b7da462-primary.sqlite.bz2",
      "summary": "System and Service Manager",
      "supplier": "Organization: http://openeuler.org",
      "versionInfo": "0:255-59.oe2403sp4"
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-rpm-tang-14",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-rpm-bash-5.2.15"
    },
    {
      "spdxElementId": "SPDXRef-rpm-tang-14",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-rpm-coreutils-9.4"
    },
    {
      "spdxElementId": "SPDXRef-rpm-tang-14",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-rpm-glibc-2.38"
    },
    {
      "spdxElementId": "SPDXRef-rpm-tang-14",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-rpm-grep-3.11"
    },
    {
      "spdxElementId": "SPDXRef-rpm-tang-14",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-rpm-http-parser-2.9.4"
    },
    {
      "spdxElementId": "SPDXRef-rpm-tang-14",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-rpm-jansson-2.14"
    },
    {
      "spdxElementId": "SPDXRef-rpm-tang-14",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-rpm-jose-14"
    },
    {
      "spdxElementId": "SPDXRef-rpm-tang-14",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-rpm-sed-4.9"
    },
    {
      "spdxElementId": "SPDXRef-rpm-tang-14",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-rpm-shadow-4.14.3"
    },
    {
      "spdxElementId": "SPDXRef-rpm-tang-14",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-rpm-systemd-255"
    }
  ]
}