{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0ef6eb40-9b58-562a-8a1d-9eb237b396ab",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-02T00:01:35Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "group": "hMailServer",
          "name": "build/asset-sbom.py",
          "supplier": {
            "name": "Progressive Robot Ltd",
            "url": [
              "https://www.progressiverobot.com"
            ]
          },
          "externalReferences": [
            {
              "type": "vcs",
              "url": "https://gitlab.com/hmailserver/hmailserver"
            }
          ]
        }
      ]
    },
    "component": {
      "type": "application",
      "bom-ref": "asset",
      "supplier": {
        "name": "Progressive Robot Ltd",
        "url": [
          "https://www.progressiverobot.com"
        ]
      },
      "name": "hMailServer",
      "version": "6.3.8",
      "description": "hmailserver-6.3.8.tar.gz, the source tarball: Progressive Robot's fork of hMailServer, a mail server for SMTP, IMAP and POP3",
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "0aea5d97923ce19f89fc52f136aa18ddb2a14731a05135c17f7b33d019ca8315"
        },
        {
          "alg": "SHA-512",
          "content": "4d3d83cd57c887314521a55b590602d08d4195380d03ebbf6b518d9fb703c520b12105aa9c11fc474938e9507f4d34b7c25190d430155ced143536df02920f52"
        }
      ],
      "licenses": [
        {
          "license": {
            "id": "AGPL-3.0-or-later"
          }
        }
      ],
      "purl": "pkg:generic/hmailserver@6.3.8?file_name=hmailserver-6.3.8.tar.gz",
      "externalReferences": [
        {
          "type": "vcs",
          "url": "https://gitlab.com/hmailserver/hmailserver"
        },
        {
          "type": "website",
          "url": "https://gitlab.com/hmailserver/hmailserver"
        }
      ],
      "properties": [
        {
          "name": "hmailserver:asset-file",
          "value": "hmailserver-6.3.8.tar.gz"
        },
        {
          "name": "hmailserver:asset-kind",
          "value": "source"
        },
        {
          "name": "hmailserver:asset-size",
          "value": "24388336"
        },
        {
          "name": "hmailserver:commit",
          "value": "3a2fc29b7fb52a27e7c1a6b8e25c99d94a4756ba"
        }
      ]
    },
    "supplier": {
      "name": "Progressive Robot Ltd",
      "url": [
        "https://www.progressiverobot.com"
      ]
    },
    "properties": [
      {
        "name": "hmailserver:describes",
        "value": "the compiled release asset named in metadata.component, by its SHA-256; how to check it: SECURITY.md, 'Software bills of materials'"
      }
    ]
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "source-quickjs",
      "name": "QuickJS",
      "description": "Fabrice Bellard's JavaScript engine, compiled into the Linux server",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/source/Server/quickjs"
        }
      ],
      "version": "2026-06-04",
      "purl": "pkg:generic/quickjs@2026-06-04",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-mime",
      "name": "MIME encoder and decoder (Jeff Lee)",
      "description": "the MIME message encoder and analyser",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/source/Server/Common/Mime"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/mime@6.3.8",
      "licenses": [
        {
          "license": {
            "name": "BSD-style notice"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-cstdstring",
      "name": "CStdString (Joseph M. O'Leary)",
      "description": "the string class",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/source/Server/Common/Util/StdString.h"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/cstdstring@6.3.8",
      "licenses": [
        {
          "license": {
            "name": "its own permissive notice"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-rfc7208-tests",
      "name": "RFC 7208 test suite",
      "description": "the SPF conformance tests spf-tests runs",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/source/Server/SMTP/SPF/Conformance/rfc7208-tests.yml"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/rfc7208-tests@6.3.8",
      "licenses": [
        {
          "license": {
            "name": "BSD-style notice"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-public-suffix-list",
      "name": "Public Suffix List",
      "description": "the list's rules, compiled into the server",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/source/Server/Common/AntiSpam/DMARC/PublicSuffixListData.h"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/public-suffix-list@6.3.8",
      "licenses": [
        {
          "license": {
            "id": "MPL-2.0"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-unicode-idna-data",
      "name": "Unicode Character Database for UTS 46 (Unicode 18.0.0)",
      "description": "the IDNA mapping table and the normalisation, bidi and joining data, compiled into the server as tables",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/source/Server/Common/Idna/ucd"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/unicode-idna-data@6.3.8",
      "licenses": [
        {
          "license": {
            "id": "Unicode-3.0"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-whatwg-html-named-references",
      "name": "HTML named character references (the WHATWG HTML standard's entities.json)",
      "description": "every named reference HTML defines, compiled into the server as the table its link reader reads an HTML part's references with",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/source/Server/Common/AntiSpam/whatwg"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/whatwg-html-named-references@6.3.8",
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-feather-icons",
      "name": "Feather icons (Cole Bemis)",
      "description": "the icons the webmail's page and the Control Deck's page are drawn after, the webmail's compiled into the server",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/source/Server/Common/Util/Portal.html"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/feather-icons@6.3.8",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-fluent-ui-system-icons",
      "name": "Fluent UI System Icons (Microsoft)",
      "description": "the Control Panel's glyphs, as a screenshot of it among the documents' pictures shows them",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/docs/images/control-panel-welcome.png"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/fluent-ui-system-icons@6.3.8",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-atl-script-host",
      "name": "ATL Active Script host (VisionTech Limited)",
      "description": "compiled into hMailServer.exe only",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/source/Server/Common/Scripting/ScriptSite.h"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/atl-script-host@6.3.8",
      "licenses": [
        {
          "license": {
            "name": "its own permissive notice"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-commonmark-js",
      "name": "commonmark.js 0.31.2 (John MacFarlane)",
      "description": "parts of its block and inline parsers, ported to Python in the check of the release jobs",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "build/check-release-chain.py"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/commonmark-js@6.3.8",
      "licenses": [
        {
          "license": {
            "id": "BSD-2-Clause"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-gitlab-secret-detection-rules",
      "name": "GitLab secret detection rules 0.25.1 (GitLab B.V.)",
      "description": "two of its rules' regular expressions, which the check of .gitleaksignore holds",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "build/check-gitleaksignore.py"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/gitlab-secret-detection-rules@6.3.8",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-contributor-covenant",
      "name": "Contributor Covenant 2.1 (Coraline Ada Ehmke and its contributors)",
      "description": "the text the project's code of conduct is adapted from",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "CODE_OF_CONDUCT.md"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/contributor-covenant@6.3.8",
      "licenses": [
        {
          "license": {
            "id": "CC-BY-4.0"
          }
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "source-mail-dkim-corpus",
      "name": "DKIM test messages (Mail::DKIM's corpus)",
      "description": "test data the Windows suite and the fuzzing seeds read",
      "scope": "required",
      "properties": [
        {
          "name": "hmailserver:kind",
          "value": "vendored"
        },
        {
          "name": "hmailserver:vendored-at",
          "value": "hmailserver/test/TestData/DKIM"
        }
      ],
      "purl": "pkg:generic/hmailserver-vendored/mail-dkim-corpus@6.3.8",
      "licenses": [
        {
          "expression": "GPL-1.0-or-later OR Artistic-1.0-Perl"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "asset",
      "dependsOn": [
        "source-quickjs",
        "source-mime",
        "source-cstdstring",
        "source-rfc7208-tests",
        "source-public-suffix-list",
        "source-unicode-idna-data",
        "source-whatwg-html-named-references",
        "source-feather-icons",
        "source-fluent-ui-system-icons",
        "source-atl-script-host",
        "source-commonmark-js",
        "source-gitlab-secret-detection-rules",
        "source-contributor-covenant",
        "source-mail-dkim-corpus"
      ]
    },
    {
      "ref": "source-quickjs",
      "dependsOn": []
    },
    {
      "ref": "source-mime",
      "dependsOn": []
    },
    {
      "ref": "source-cstdstring",
      "dependsOn": []
    },
    {
      "ref": "source-rfc7208-tests",
      "dependsOn": []
    },
    {
      "ref": "source-public-suffix-list",
      "dependsOn": []
    },
    {
      "ref": "source-unicode-idna-data",
      "dependsOn": []
    },
    {
      "ref": "source-whatwg-html-named-references",
      "dependsOn": []
    },
    {
      "ref": "source-feather-icons",
      "dependsOn": []
    },
    {
      "ref": "source-fluent-ui-system-icons",
      "dependsOn": []
    },
    {
      "ref": "source-atl-script-host",
      "dependsOn": []
    },
    {
      "ref": "source-commonmark-js",
      "dependsOn": []
    },
    {
      "ref": "source-gitlab-secret-detection-rules",
      "dependsOn": []
    },
    {
      "ref": "source-contributor-covenant",
      "dependsOn": []
    },
    {
      "ref": "source-mail-dkim-corpus",
      "dependsOn": []
    }
  ]
}