{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "awacloud-fw-wasm-crypto",
  "documentNamespace": "https://awaforge.eu/sbom/awacloud-fw-wasm-crypto-3db192243e60d589e0a96d5d76c347bf213f8a00.spdx",
  "comment": "generated by awa-sbom-0.1.0 for commit 3db192243e60d589e0a96d5d76c347bf213f8a00; package @awacloud/fw-wasm-crypto: 1 distribution row(s) described (closure); 43 other workspace members counted, not listed; determinism rules: see this tool's README",
  "creationInfo": {
    "created": "2026-09-29T08:58:24Z",
    "creators": [
      "Organization: AwaCloud",
      "Tool: awa-sbom-0.1.0"
    ],
    "comment": "created = committer date of commit 3db192243e60d589e0a96d5d76c347bf213f8a00 (git show -s --format=%ct); the Tool creator names the generator that produced this document"
  },
  "packages": [
    {
      "SPDXID": "SPDXRef-Package-awacloud-fw-wasm-crypto",
      "name": "@awacloud/fw-wasm-crypto",
      "versionInfo": "0.1.0",
      "primaryPackagePurpose": "LIBRARY",
      "supplier": "Organization: AwaCloud",
      "originator": "Organization: AwaCloud",
      "downloadLocation": "NOASSERTION",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "Apache-2.0",
      "copyrightText": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-notice",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/NOTICE"
        },
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-provenance",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json"
        },
        {
          "referenceCategory": "PACKAGE-MANAGER",
          "referenceType": "purl",
          "referenceLocator": "pkg:npm/%40awacloud/fw-wasm-crypto@0.1.0"
        }
      ],
      "comment": "gap:copyright — no in-tree copyright notice; acted identity \"Copyright (c) 2026 AwaCloud SAS\" (tools/pkg-export/src/lib/manifest.ts IDENTITY.copyright) cited, not asserted\ngap:download-location — not published (package.json private:true, version 0.1.0); acted repository https://github.com/awacloud/awa (IDENTITY.repositoryUrl) cited, not asserted\ngap:license-concluded — no owner conclusion recorded\nsource: packages/front/fw-wasm-crypto/package.json (awa.maturity L3, awa.role build-asset); sideEffects false; 6 vendored trees under vendor/ (PROVENANCE.json version 1) — CONTAINS relationships below"
    },
    {
      "SPDXID": "SPDXRef-Package-vendor-bearssl",
      "name": "bearssl",
      "versionInfo": "v0.6",
      "primaryPackagePurpose": "SOURCE",
      "supplier": "Organization: AwaCloud",
      "originator": "Person: Thomas Pornin (pornin@bolet.org)",
      "downloadLocation": "https://bearssl.org/bearssl-0.6.tar.gz",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "MIT",
      "copyrightText": "Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>",
      "externalRefs": [
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-notice",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/NOTICE-bearssl"
        },
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-provenance",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json#trees[id=bearssl]"
        }
      ],
      "comment": "gap:license-concluded — no owner conclusion recorded\nprovenance: PROVENANCE.json trees[id=bearssl] sha256=759d09cd1e850657301e60d6179fba4b1d11d743f7f34de821a5f6dffbb82a1f — a digest of the COMMITTED SUBSET, NOT an archive checksum, therefore not emitted in checksums[] (gap:sha256-semantics)\nsubset: vendored files per vendor/NOTICE-bearssl § Files vendored; upstream notice: BearSSL v0.6 (Thomas Pornin, bearssl.org). v0.6 beta, Aug 2018, never formally audited (accepted-debt per plan risk 2). See vendor/NOTICE-bearssl."
    },
    {
      "SPDXID": "SPDXRef-Package-vendor-fiat-crypto",
      "name": "fiat-crypto",
      "versionInfo": "v0.1.6",
      "primaryPackagePurpose": "SOURCE",
      "supplier": "Organization: AwaCloud",
      "originator": "Organization: the fiat-crypto authors",
      "downloadLocation": "https://github.com/mit-plv/fiat-crypto/archive/refs/tags/v0.1.6.tar.gz",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "MIT AND BSD-1-Clause AND Apache-2.0",
      "copyrightText": "MIT: Copyright (c) 2015-2020 the fiat-crypto authors\nApache-2.0: Copyright 2015-2020 the fiat-crypto authors\nBSD-1-Clause: Copyright (c) 2015-2020 the fiat-crypto authors",
      "externalRefs": [
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-notice",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/NOTICE-fiat-crypto"
        },
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-provenance",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json#trees[id=fiat-crypto]"
        }
      ],
      "comment": "gap:license-concluded — no owner conclusion recorded\nprovenance: PROVENANCE.json trees[id=fiat-crypto] sha256=b6a4a6ce5563b5b86ba1161801e0bbba60dd0c689b5b06abde36d91ab84b979a — a digest of the COMMITTED SUBSET, NOT an archive checksum, therefore not emitted in checksums[] (gap:sha256-semantics)\nsubset: vendored files per vendor/NOTICE-fiat-crypto § Files vendored; upstream notice: fiat-crypto machine-verified P-256/P-384/P-521 field arithmetic. See vendor/NOTICE-fiat-crypto."
    },
    {
      "SPDXID": "SPDXRef-Package-vendor-libsodium",
      "name": "libsodium",
      "versionInfo": "1.0.22-RELEASE",
      "primaryPackagePurpose": "SOURCE",
      "supplier": "Organization: AwaCloud",
      "originator": "Organization: Frank Denis and contributors",
      "downloadLocation": "https://github.com/jedisct1/libsodium/archive/refs/tags/1.0.22-RELEASE.tar.gz",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "ISC",
      "copyrightText": "Copyright (c) 2013-2024\nFrank Denis and contributors",
      "externalRefs": [
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-notice",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/NOTICE-libsodium"
        },
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-provenance",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json#trees[id=libsodium]"
        }
      ],
      "comment": "gap:license-concluded — no owner conclusion recorded\nprovenance: PROVENANCE.json trees[id=libsodium] sha256=acb6837051b26fd4cb80405d9a2a9d96b25184c3e65ac04bc4894008e6554688 — a digest of the COMMITTED SUBSET, NOT an archive checksum, therefore not emitted in checksums[] (gap:sha256-semantics)\nsubset: vendored files per vendor/NOTICE-libsodium § Files vendored; upstream notice: libsodium 1.0.22 ed25519 + curve25519 ref10 closure (jedisct1/libsodium, ISC). Field path fe_25_5 (32-bit); SHA-512+randombytes+sodium-utils seamed to the package's own csrc. See vendor/NOTICE-libsodium."
    },
    {
      "SPDXID": "SPDXRef-Package-vendor-mlkem-native",
      "name": "mlkem-native",
      "versionInfo": "v1.2.0",
      "primaryPackagePurpose": "SOURCE",
      "supplier": "Organization: AwaCloud",
      "originator": "Organization: The mlkem-native project authors",
      "downloadLocation": "https://github.com/pq-code-package/mlkem-native/archive/refs/tags/v1.2.0.tar.gz",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "Apache-2.0 AND MIT AND ISC AND CC0-1.0",
      "copyrightText": "Copyright (c) The mlkem-native project authors\nCopyright (c) 2020 Dougall Johnson\nCopyright (c) 2022 Arm Limited",
      "externalRefs": [
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-notice",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/NOTICE-mlkem-native"
        },
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-provenance",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json#trees[id=mlkem-native]"
        }
      ],
      "comment": "gap:license-concluded — no owner conclusion recorded\nprovenance: PROVENANCE.json trees[id=mlkem-native] sha256=377f0960ebab767ab2e4ad4bdb10d615dfcd530d575feeb572feb83e4aecbd33 — a digest of the COMMITTED SUBSET, NOT an archive checksum, therefore not emitted in checksums[] (gap:sha256-semantics)\nsubset: vendored files per vendor/NOTICE-mlkem-native § Files vendored; upstream notice: mlkem-native v1.2.0 (PQ Code Package / PQCA). See vendor/NOTICE-mlkem-native."
    },
    {
      "SPDXID": "SPDXRef-Package-vendor-openssl-slh-dsa",
      "name": "openssl-slh-dsa",
      "versionInfo": "openssl-3.5.0",
      "primaryPackagePurpose": "SOURCE",
      "supplier": "Organization: AwaCloud",
      "originator": "Organization: The OpenSSL Project Authors",
      "downloadLocation": "https://github.com/openssl/openssl/archive/refs/tags/openssl-3.5.0.tar.gz",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "Apache-2.0",
      "copyrightText": "Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.",
      "externalRefs": [
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-notice",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/NOTICE-openssl-slh-dsa"
        },
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-provenance",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json#trees[id=openssl-slh-dsa]"
        }
      ],
      "comment": "gap:license-concluded — no owner conclusion recorded\nprovenance: PROVENANCE.json trees[id=openssl-slh-dsa] sha256=20a5f860014d4008b95084cb40c5df85c5e6694dbef89ac755136be5396ef7a0 — a digest of the COMMITTED SUBSET, NOT an archive checksum, therefore not emitted in checksums[] (gap:sha256-semantics)\nsubset: vendored files per vendor/NOTICE-openssl-slh-dsa § Files vendored; upstream notice: OpenSSL FIPS-205 SLH-DSA core (crypto/slh_dsa, openssl-3.5.0). Apache-2.0; see vendor/NOTICE-openssl-slh-dsa.\ntag commit 02192e014a72972a398eee3106f0ec369eabc1f1 (NOTICE); portable FIPS-205 core only, EVP-coupled TUs replaced by csrc/slhdsa"
    },
    {
      "SPDXID": "SPDXRef-Package-vendor-pqclean",
      "name": "pqclean",
      "versionInfo": "202a8f96315f9ed219387a50f7e40d04af037ea8",
      "primaryPackagePurpose": "SOURCE",
      "supplier": "Organization: AwaCloud",
      "originator": "NOASSERTION",
      "downloadLocation": "git+https://github.com/PQClean/PQClean@202a8f96315f9ed219387a50f7e40d04af037ea8",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "CC0-1.0",
      "copyrightText": "NOASSERTION",
      "externalRefs": [
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-notice",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/NOTICE-pqclean"
        },
        {
          "referenceCategory": "OTHER",
          "referenceType": "awa-provenance",
          "referenceLocator": "packages/front/fw-wasm-crypto/vendor/PROVENANCE.json#trees[id=pqclean]"
        }
      ],
      "comment": "gap:copyright — NOTICE-pqclean carries no copyright line\ngap:license-concluded — no owner conclusion recorded\ngap:originator — NOTICE-pqclean names no author or copyright holder\nprovenance: PROVENANCE.json trees[id=pqclean] sha256=517bffa8694b3e50f9ce5a68c316b6a24c4e1067a543c03083e77190b038b2c0 — a digest of the COMMITTED SUBSET, NOT an archive checksum, therefore not emitted in checksums[] (gap:sha256-semantics)\nsubset: vendored files per vendor/NOTICE-pqclean § Files vendored; upstream notice: PQClean (rolling, commit 202a8f9). Per-file SPDX; see vendor/NOTICE-pqclean."
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relationshipType": "DESCRIBES",
      "relatedSpdxElement": "SPDXRef-Package-awacloud-fw-wasm-crypto"
    },
    {
      "spdxElementId": "SPDXRef-Package-awacloud-fw-wasm-crypto",
      "relationshipType": "CONTAINS",
      "relatedSpdxElement": "SPDXRef-Package-vendor-bearssl"
    },
    {
      "spdxElementId": "SPDXRef-Package-awacloud-fw-wasm-crypto",
      "relationshipType": "CONTAINS",
      "relatedSpdxElement": "SPDXRef-Package-vendor-fiat-crypto"
    },
    {
      "spdxElementId": "SPDXRef-Package-awacloud-fw-wasm-crypto",
      "relationshipType": "CONTAINS",
      "relatedSpdxElement": "SPDXRef-Package-vendor-libsodium"
    },
    {
      "spdxElementId": "SPDXRef-Package-awacloud-fw-wasm-crypto",
      "relationshipType": "CONTAINS",
      "relatedSpdxElement": "SPDXRef-Package-vendor-mlkem-native"
    },
    {
      "spdxElementId": "SPDXRef-Package-awacloud-fw-wasm-crypto",
      "relationshipType": "CONTAINS",
      "relatedSpdxElement": "SPDXRef-Package-vendor-openssl-slh-dsa"
    },
    {
      "spdxElementId": "SPDXRef-Package-awacloud-fw-wasm-crypto",
      "relationshipType": "CONTAINS",
      "relatedSpdxElement": "SPDXRef-Package-vendor-pqclean"
    }
  ]
}