{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:f942db04-1177-41a0-a738-669ec79d891d",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-24T09:00:00+09:00",
    "tools": {
      "components": [
        {
          "type": "application",
          "author": "HadayaLab",
          "name": "Sovereign Supply-Chain Attestation Engine",
          "version": "15.3.0",
          "externalReferences": [
            {
              "type": "website",
              "url": "https://hadayalab.com/security"
            }
          ]
        }
      ]
    },
    "authors": [
      {
        "name": "Hajime Chiba",
        "email": "hadayalab@gmail.com"
      }
    ],
    "component": {
      "type": "application",
      "bom-ref": "app-production-app",
      "name": "production-app",
      "version": "1.0.0",
      "purl": "pkg:oci/production-app@sha256:7b91d3e12c43141f6a117094b8307db18549646b95b8d2cb3780360a747908b8",
      "description": "Inspected production artifact for PAIN-2026-005 (HL-R5-DOCKERBASE)"
    },
    "properties": [
      {
        "name": "hadayalab:attestation_status",
        "value": "REMEDIATION_ATTESTED"
      },
      {
        "name": "hadayalab:valid_from",
        "value": "2026-10-24"
      },
      {
        "name": "hadayalab:valid_until",
        "value": "2026-10-31"
      },
      {
        "name": "hadayalab:auditor_authority",
        "value": "45x Google Cloud & DeepMind Skill Badges"
      },
      {
        "name": "hadayalab:verification_url",
        "value": "https://hadayalab.com/verify?id=HL-2026-2026-005"
      }
    ]
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "comp-PAIN-2026-005",
      "name": "Docker & AWS Lambda Stale Base Image Supply-Chain Blindspot",
      "version": "1.0.0",
      "purl": "pkg:oci/production-app@sha256:7b91d3e12c43141f6a117094b8307db18549646b95b8d2cb3780360a747908b8",
      "scope": "required",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "a2a8e6c3032206086dc53711a309b08114a20952ed814799530248ca35523256"
        }
      ]
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "vuln-PAIN-2026-005",
      "id": "OCI-BASE-STALE-2026",
      "source": {
        "name": "NVD",
        "url": "https://cyclonedx.org/specification/overview/"
      },
      "ratings": [
        {
          "source": {
            "name": "HadayaLab Sovereign Engine"
          },
          "score": 9.5,
          "severity": "critical",
          "method": "CVSSv31"
        }
      ],
      "analysis": {
        "state": "resolved",
        "justification": "protected_by_mitigating_control",
        "response": [
          "will_not_fix",
          "mitigation_implemented"
        ]
      },
      "affects": [
        {
          "ref": "comp-PAIN-2026-005"
        }
      ]
    }
  ],
  "signature": {
    "algorithm": "Ed25519",
    "keyId": "hadayalab-attest-2026-ed25519-k1",
    "publicKey": {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "nV4M1AVcxd3xieTvSXTiRAupKYbukg2V4IwXYaZ7o9Q"
    },
    "value": "hhO97Q0GCC+SUQVJ3Qr/TCIf0gB5NVjyI020cIqsZtEa0T/KB/RqfVKwOuaBMu+H/ZfCSo073XOW0JQN52XJBA=="
  }
}