{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "cryptin-firmware-sbom",
  "documentNamespace": "https://cryptin.lake8.dev/sbom/cryptin-firmware-sbom.json",
  "documentDescribes": ["SPDXRef-cryptin-firmware"],
  "creationInfo": {
    "created": "2026-07-30T00:00:00Z",
    "creators": [
      "Tool: PlatformIO",
      "Organization: lake8.dev"
    ]
  },
  "packages": [
    {
      "SPDXID": "SPDXRef-cryptin-firmware",
      "name": "cryptin-firmware",
      "versionInfo": "beta-2026-09",
      "downloadLocation": "https://github.com/jaffa2970/Krypt",
      "filesAnalyzed": false,
      "licenseConcluded": "NOASSERTION",
      "licenseDeclared": "NOASSERTION",
      "copyrightText": "Copyright 2026 lake8.dev"
    },
    {
      "SPDXID": "SPDXRef-monocypher",
      "name": "Monocypher",
      "versionInfo": "4.0.3",
      "downloadLocation": "https://github.com/LoupVaillant/Monocypher/releases/tag/4.0.3",
      "filesAnalyzed": false,
      "licenseConcluded": "BSD-2-Clause OR CC0-1.0",
      "licenseDeclared": "BSD-2-Clause OR CC0-1.0",
      "copyrightText": "Copyright (c) 2017-2023, Loup Vaillant; Copyright (c) 2017-2019, Michael Savage; Copyright (c) 2017-2023, Fabio Scotoni",
      "comment": "Vendored under firmware/src/crypto/. Header comment says 'Monocypher version __git__' (unsubstituted template placeholder from an untagged git checkout); version was identified by SHA-256 comparison of monocypher.c, monocypher.h, monocypher-ed25519.c and monocypher-ed25519.h against the official 4.0.3 release tag -- all four files are byte-for-byte identical to that release."
    },
    {
      "SPDXID": "SPDXRef-arduino-esp32",
      "name": "arduino-esp32",
      "versionInfo": "3.3.9",
      "downloadLocation": "https://github.com/espressif/arduino-esp32/releases/tag/3.3.9",
      "filesAnalyzed": false,
      "licenseConcluded": "LGPL-2.1-only",
      "licenseDeclared": "LGPL-2.1-only",
      "copyrightText": "Copyright 2015-2024 Espressif Systems",
      "comment": "Resolved via PlatformIO package framework-arduinoespressif32, pulled in by the pinned platform (SPDXRef-platform-espressif32); not directly pinned in platformio.ini."
    },
    {
      "SPDXID": "SPDXRef-esp-idf",
      "name": "ESP-IDF",
      "versionInfo": "5.5.4+sha.735507283d",
      "downloadLocation": "https://github.com/espressif/esp-idf/releases/tag/v5.5.4",
      "filesAnalyzed": false,
      "licenseConcluded": "Apache-2.0",
      "licenseDeclared": "Apache-2.0",
      "copyrightText": "Copyright 2016-2024 Espressif Systems",
      "comment": "Resolved via PlatformIO package framework-arduinoespressif32-libs (precompiled ESP-IDF component libraries); not directly pinned in platformio.ini."
    },
    {
      "SPDXID": "SPDXRef-platform-espressif32",
      "name": "platform-espressif32 (pioarduino mirror)",
      "versionInfo": "55.03.39",
      "downloadLocation": "https://github.com/pioarduino/platform-espressif32/releases/tag/55.03.39",
      "filesAnalyzed": false,
      "licenseConcluded": "Apache-2.0",
      "licenseDeclared": "Apache-2.0",
      "copyrightText": "NOASSERTION",
      "comment": "Pinned exactly in firmware/platformio.ini as 'platform = https://github.com/pioarduino/platform-espressif32.git#55.03.39'. This is the build-time PlatformIO platform definition (determines the arduino-esp32 and ESP-IDF versions above), not code shipped in the firmware image."
    },
    {
      "SPDXID": "SPDXRef-hidapi-python",
      "name": "hidapi (Python)",
      "versionInfo": "0.15.0",
      "downloadLocation": "https://pypi.org/project/hidapi/0.15.0/",
      "filesAnalyzed": false,
      "licenseConcluded": "BSD-3-Clause OR GPL-3.0-only",
      "licenseDeclared": "BSD-3-Clause OR GPL-3.0-only",
      "copyrightText": "NOASSERTION",
      "comment": "Host-side tooling only (tools/), not part of the firmware image. Exact-pinned in tools/requirements.txt as 'hidapi==0.15.0'."
    },
    {
      "SPDXID": "SPDXRef-pynacl",
      "name": "PyNaCl",
      "versionInfo": "1.6.2",
      "downloadLocation": "https://pypi.org/project/PyNaCl/1.6.2/",
      "filesAnalyzed": false,
      "licenseConcluded": "Apache-2.0",
      "licenseDeclared": "Apache-2.0",
      "copyrightText": "NOASSERTION",
      "comment": "Host-side tooling only (tools/), not part of the firmware image. Exact-pinned in tools/requirements.txt as 'pynacl==1.6.2'."
    },
    {
      "SPDXID": "SPDXRef-cryptography-python",
      "name": "cryptography (Python)",
      "versionInfo": "49.0.0",
      "downloadLocation": "https://pypi.org/project/cryptography/49.0.0/",
      "filesAnalyzed": false,
      "licenseConcluded": "Apache-2.0 OR BSD-3-Clause",
      "licenseDeclared": "Apache-2.0 OR BSD-3-Clause",
      "copyrightText": "NOASSERTION",
      "comment": "Host-side tooling only (tools/), not part of the firmware image. Exact-pinned in tools/requirements.txt as 'cryptography==49.0.0'."
    }
  ],
  "relationships": [
    {
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relationshipType": "DESCRIBES",
      "relatedSpdxElement": "SPDXRef-cryptin-firmware"
    },
    {
      "spdxElementId": "SPDXRef-cryptin-firmware",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-monocypher"
    },
    {
      "spdxElementId": "SPDXRef-cryptin-firmware",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-arduino-esp32"
    },
    {
      "spdxElementId": "SPDXRef-cryptin-firmware",
      "relationshipType": "DEPENDS_ON",
      "relatedSpdxElement": "SPDXRef-esp-idf"
    },
    {
      "spdxElementId": "SPDXRef-cryptin-firmware",
      "relationshipType": "BUILD_TOOL_OF",
      "relatedSpdxElement": "SPDXRef-platform-espressif32"
    },
    {
      "spdxElementId": "SPDXRef-cryptin-firmware",
      "relationshipType": "DEV_DEPENDENCY_OF",
      "relatedSpdxElement": "SPDXRef-hidapi-python"
    },
    {
      "spdxElementId": "SPDXRef-cryptin-firmware",
      "relationshipType": "DEV_DEPENDENCY_OF",
      "relatedSpdxElement": "SPDXRef-pynacl"
    },
    {
      "spdxElementId": "SPDXRef-cryptin-firmware",
      "relationshipType": "DEV_DEPENDENCY_OF",
      "relatedSpdxElement": "SPDXRef-cryptography-python"
    }
  ]
}