docs: add complete SBOM, ignore local deployment resources, remove stale third-party references

1 files changed, 625 insertions, 0 deletions

diff --git a/sbom/open-iov-0.1.0.cdx.json b/sbom/open-iov-0.1.0.cdx.json
new file mode 100644
index 0000000..1db09d3
--- /dev/null
+++ b/sbom/open-iov-0.1.0.cdx.json
@@ -0,0 +1,625 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "serialNumber": "urn:uuid:e626c5a1-9697-4546-bb2b-5b4feb58e922",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2026-10-02T06:47:39Z",
+    "authors": [
+      { "name": "The Open-IOV Project" }
+    ],
+    "tools": {
+      "components": [
+        {
+          "type": "application",
+          "bom-ref": "tool:open-iov-inventory-audit",
+          "name": "open-iov-inventory-audit",
+          "version": "1",
+          "supplier": { "name": "The Open-IOV Project" }
+        }
+      ]
+    },
+    "component": {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov@0.1.0",
+      "name": "open-iov",
+      "version": "0.1.0",
+      "description": "Open-source virtualization layer for NVIDIA GPUs: emulates the GSP/GSP-RM interface in a host kernel module so unmodified guest drivers can run in VMs and work executes on the physical GPU.",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov@0.1.0",
+      "externalReferences": [
+        { "type": "vcs", "url": "https://git.vgpu.io/open-iov.git" },
+        { "type": "documentation", "url": "https://git.vgpu.io/open-iov.git/blob/master/docs/README.md" }
+      ],
+      "properties": [
+        { "name": "open-iov:license-policy", "value": "BSD-3-Clause for userspace/tools/scripts/config/docs; GPL-2.0-only for kernel/**; per-file SPDX headers govern" },
+        { "name": "open-iov:compliance", "value": "NTIA minimum elements; CycloneDX 1.6" },
+        { "name": "open-iov:sbom-page", "value": "SBOM.md" }
+      ]
+    },
+    "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+    "properties": [
+      { "name": "open-iov:scope", "value": "All files tracked in the repository plus external build/run dependencies; NVIDIA firmware and drivers are not distributed" },
+      { "name": "open-iov:audited-revision", "value": "parent commit of the commit adding this document (version 0.1.0)" }
+    ]
+  },
+  "components": [
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-vfio@0.1.0",
+      "name": "open-iov-vfio",
+      "version": "0.1.0",
+      "description": "Host VFIO mdev kernel module: virtual GPU device, GSP/GSP-RM emulation, semaphore service, memory model, physical-GPU backend.",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "GPL-2.0-only" } } ],
+      "purl": "pkg:generic/open-iov-vfio@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "kernel/**" } ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:generic/libiov@0.1.0",
+      "name": "libiov",
+      "version": "0.1.0",
+      "description": "Userspace management library (libiov.so, libvgpu.so compatibility link) with RPC emulation helpers.",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/libiov@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "userspace/lib/**, userspace/include/libvgpu.h" } ]
+    },
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-example@0.1.0",
+      "name": "open-iov-example",
+      "version": "0.1.0",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-example@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "userspace/examples/**" } ]
+    },
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-userspace-tests@0.1.0",
+      "name": "open-iov-userspace-tests",
+      "version": "0.1.0",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-userspace-tests@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "userspace/tests/**" } ]
+    },
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-kernel-tests@0.1.0",
+      "name": "open-iov-kernel-tests",
+      "version": "0.1.0",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "GPL-2.0-only" } } ],
+      "purl": "pkg:generic/open-iov-kernel-tests@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "kernel/tests/**" } ]
+    },
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-guest-diag@0.1.0",
+      "name": "open-iov-guest-diag",
+      "version": "0.1.0",
+      "description": "Guest diagnostics and VM cycle tooling: kprobes, pin scanners, CUDA smoke test wrappers, QEMU launch snapshots.",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-guest-diag@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "tools/guest-diag/**" } ]
+    },
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-cuda-ab@0.1.0",
+      "name": "open-iov-cuda-ab",
+      "version": "0.1.0",
+      "description": "CUDA A/B harness comparing host and guest execution of a deterministic vector_add workload.",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-cuda-ab@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "tools/cuda-ab/**" } ]
+    },
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-rmq@0.1.0",
+      "name": "open-iov-rmq",
+      "version": "0.1.0",
+      "description": "RM queue / WPR tooling including a companion kernel module.",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-rmq@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "tools/rmq/**" } ]
+    },
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-ghidra-tools@0.1.0",
+      "name": "open-iov-ghidra-tools",
+      "version": "0.1.0",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-ghidra-tools@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "tools/ghidra/**" } ]
+    },
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-guest-agent@0.1.0",
+      "name": "open-iov-guest-agent",
+      "version": "0.1.0",
+      "description": "Guest test agent (optional; uses PyTorch when available).",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-guest-agent@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "tools/guest_agent/**" } ]
+    },
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-tools-misc@0.1.0",
+      "name": "open-iov-tools-misc",
+      "version": "0.1.0",
+      "description": "VM harness, module operations, debug helpers and test helpers.",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-tools-misc@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "tools/{vm,module_ops,debug,test}/**" } ]
+    },
+    {
+      "type": "data",
+      "bom-ref": "pkg:generic/open-iov-gsp-analysis@570.144W",
+      "name": "open-iov-gsp-analysis",
+      "version": "570.144W",
+      "description": "GSP firmware analysis work product: analysis scripts, function maps, RPC handler maps and reports. No NVIDIA binaries.",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-gsp-analysis@570.144W",
+      "properties": [ { "name": "open-iov:path", "value": "firmware/57X-GSP/570.144/**" } ]
+    },
+    {
+      "type": "data",
+      "bom-ref": "pkg:generic/open-iov-cuda-analysis@570.144",
+      "name": "open-iov-cuda-analysis",
+      "version": "570.144",
+      "description": "CUDA userspace driver (libcuda) analysis: docs, tooling and annotation tables.",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-cuda-analysis@570.144",
+      "properties": [ { "name": "open-iov:path", "value": "userspace/cuda/**" } ]
+    },
+    {
+      "type": "application",
+      "bom-ref": "pkg:generic/open-iov-scripts@0.1.0",
+      "name": "open-iov-scripts",
+      "version": "0.1.0",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-scripts@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "scripts/**, install.sh, validate.sh, Makefile" } ]
+    },
+    {
+      "type": "data",
+      "bom-ref": "pkg:generic/open-iov-config@0.1.0",
+      "name": "open-iov-config",
+      "version": "0.1.0",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-config@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "config/**" } ]
+    },
+    {
+      "type": "data",
+      "bom-ref": "pkg:generic/open-iov-docs@0.1.0",
+      "name": "open-iov-docs",
+      "version": "0.1.0",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-docs@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": "docs/**, README.md, STATE-CURRENT.md" } ]
+    },
+    {
+      "type": "data",
+      "bom-ref": "pkg:generic/open-iov-wiki-archive@2023",
+      "name": "open-iov-wiki-archive",
+      "version": "2023",
+      "description": "Project wiki pages plus an archived scrape of the earlier public wiki. Contains historical third-party media (NOASSERTION).",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-wiki-archive@2023",
+      "properties": [
+        { "name": "open-iov:path", "value": "wiki/**" },
+        { "name": "open-iov:third-party-media", "value": "Archived diagrams/screenshots/logos retain their originating projects' terms; see SBOM.md section 5" }
+      ]
+    },
+    {
+      "type": "data",
+      "bom-ref": "pkg:generic/open-iov-ci@0.1.0",
+      "name": "open-iov-ci",
+      "version": "0.1.0",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "purl": "pkg:generic/open-iov-ci@0.1.0",
+      "properties": [ { "name": "open-iov:path", "value": ".github/workflows/ci.yml" } ]
+    },
+    {
+      "type": "file",
+      "bom-ref": "file:vector_add",
+      "name": "vector_add (prebuilt)",
+      "version": "0.1.0",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "hashes": [ { "alg": "SHA-256", "content": "8edc28a8814f108a85b794ca4e636138de03f45f706cb96bd008f420a87e8036" } ],
+      "properties": [
+        { "name": "open-iov:path", "value": "tools/cuda-ab/run/vector_add" },
+        { "name": "open-iov:source", "value": "tools/cuda-ab/vector_add.cu" }
+      ]
+    },
+    {
+      "type": "file",
+      "bom-ref": "file:wpr2_reset",
+      "name": "wpr2_reset (prebuilt)",
+      "version": "0.1.0",
+      "supplier": { "name": "The Open-IOV Project" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "hashes": [ { "alg": "SHA-256", "content": "cae6537a41f0e548349617a7c44f411dc5c38f16000ce1879ba49814e82c2361" } ],
+      "properties": [
+        { "name": "open-iov:path", "value": "tools/rmq/wpr2_reset" },
+        { "name": "open-iov:source", "value": "tools/rmq/wpr2_reset.c" }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:github/cktan/tomlc99@vendored",
+      "name": "tomlc99",
+      "version": "vendored snapshot (version not recorded)",
+      "description": "TOML parser used by the userspace library.",
+      "supplier": { "name": "CK Tan" },
+      "licenses": [ { "license": { "id": "MIT" } } ],
+      "purl": "pkg:github/cktan/tomlc99@vendored",
+      "hashes": [ { "alg": "SHA-256", "content": "ca70a545ce442d878587bb2767de8c7e6219b43ba832fa87c4b8a8c4f4f8221f" } ],
+      "properties": [
+        { "name": "open-iov:path", "value": "userspace/extern/src/toml.c, userspace/extern/inc/toml.h" },
+        { "name": "open-iov:header-sha256", "value": "0c56ba78add80e49073b12de039835718c29410669d7a526e65bc8212e1dc135" }
+      ]
+    },
+    {
+      "type": "library",
+      "bom-ref": "pkg:github/likle/cargs@vendored",
+      "name": "cargs",
+      "version": "vendored snapshot (version not recorded)",
+      "description": "Command-line argument parser used by the userspace library.",
+      "supplier": { "name": "Leonard Iklo" },
+      "licenses": [ { "license": { "id": "MIT" } } ],
+      "purl": "pkg:github/likle/cargs@vendored",
+      "hashes": [ { "alg": "SHA-256", "content": "d6c88f89b1d948f4b221c54103f17f6575bd580fcaffb0de3dfbceb2dd6136ab" } ],
+      "properties": [
+        { "name": "open-iov:path", "value": "userspace/extern/src/cargs.c, userspace/extern/inc/cargs.h" },
+        { "name": "open-iov:header-sha256", "value": "93d3e1cb40d6eb646b7f50051ee9ad3f664ffe21d103164f98e89e9775bb91cb" }
+      ]
+    },
+    {
+      "type": "file",
+      "bom-ref": "file:nv-hypervisor.h",
+      "name": "nv-hypervisor.h",
+      "version": "570.144",
+      "supplier": { "name": "NVIDIA CORPORATION" },
+      "licenses": [ { "license": { "id": "MIT" } } ],
+      "hashes": [ { "alg": "SHA-256", "content": "733409c43ab65708bf5563b76e4dea9d1dfbe1d5cfa0d846fbba511a1186f932" } ],
+      "properties": [ { "name": "open-iov:path", "value": "kernel/include/nv-hypervisor.h" } ]
+    },
+    {
+      "type": "file",
+      "bom-ref": "file:nv-vgpu-vfio-interface.h",
+      "name": "nv-vgpu-vfio-interface.h",
+      "version": "570.144",
+      "supplier": { "name": "NVIDIA CORPORATION" },
+      "licenses": [ { "license": { "id": "MIT" } } ],
+      "hashes": [ { "alg": "SHA-256", "content": "83908a89a7f6df2631d24bb2518bbb5643c4f1fb270300d20b76a04a0af735b6" } ],
+      "properties": [ { "name": "open-iov:path", "value": "kernel/include/nv-vgpu-vfio-interface.h" } ]
+    },
+    {
+      "type": "file",
+      "bom-ref": "file:nvstatus.h",
+      "name": "nvstatus.h",
+      "version": "570.144",
+      "supplier": { "name": "NVIDIA CORPORATION" },
+      "licenses": [ { "license": { "id": "MIT" } } ],
+      "hashes": [ { "alg": "SHA-256", "content": "e8267172a1f7a56420d612c6734b3554b9ff6a3d33fdda21b1371ff4ce4b8675" } ],
+      "properties": [ { "name": "open-iov:path", "value": "kernel/include/nvstatus.h" } ]
+    },
+    {
+      "type": "file",
+      "bom-ref": "file:nvtypes.h",
+      "name": "nvtypes.h",
+      "version": "570.144",
+      "supplier": { "name": "NVIDIA CORPORATION" },
+      "licenses": [ { "license": { "id": "MIT" } } ],
+      "hashes": [ { "alg": "SHA-256", "content": "e647e23504fe4b6cc2337836b2155c49918ed174bd9a3d806125e7c12e894f2a" } ],
+      "properties": [ { "name": "open-iov:path", "value": "kernel/include/nvtypes.h" } ]
+    },
+    {
+      "type": "operating-system",
+      "bom-ref": "dep:linux-kernel",
+      "name": "Linux kernel",
+      "version": ">=6.1 (tested 6.8.0-142; CI 6.1/6.6/6.8)",
+      "description": "Host kernel providing VFIO, mdev, IOMMU and DMA interfaces.",
+      "supplier": { "name": "Linux kernel community" },
+      "licenses": [ { "license": { "id": "GPL-2.0-only" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:qemu",
+      "name": "QEMU",
+      "version": "distribution version",
+      "supplier": { "name": "QEMU Project" },
+      "licenses": [ { "license": { "id": "GPL-2.0-only" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "library",
+      "bom-ref": "dep:vfio-mdev",
+      "name": "VFIO / mdev",
+      "version": "in-kernel",
+      "supplier": { "name": "Linux kernel community" },
+      "licenses": [ { "license": { "id": "GPL-2.0-only" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "library",
+      "bom-ref": "dep:libvirt",
+      "name": "libvirt",
+      "version": "distribution version",
+      "supplier": { "name": "libvirt Project" },
+      "licenses": [ { "license": { "id": "LGPL-2.1-only" } } ],
+      "scope": "optional"
+    },
+    {
+      "type": "firmware",
+      "bom-ref": "dep:ovmf",
+      "name": "OVMF",
+      "version": "distribution version",
+      "supplier": { "name": "TianoCore" },
+      "licenses": [ { "license": { "id": "BSD-2-Clause-Patent" } } ],
+      "scope": "optional"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:nvidia-guest-driver",
+      "name": "NVIDIA guest driver (nvidia.ko, libcuda.so)",
+      "version": "570.144",
+      "description": "The unmodified guest driver served by Open-IOV. Not distributed by this project.",
+      "supplier": { "name": "NVIDIA Corporation" },
+      "licenses": [ { "license": { "name": "NVIDIA proprietary EULA" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "firmware",
+      "bom-ref": "dep:nvidia-gsp-firmware",
+      "name": "NVIDIA GSP firmware (TU102)",
+      "version": "570.144W",
+      "description": "Fetched at install time from public NVIDIA linux-firmware; pinned MD5 13ce12a392a31eeb79a2e6ebd3a4a93a. Never committed.",
+      "supplier": { "name": "NVIDIA Corporation" },
+      "licenses": [ { "license": { "name": "NVIDIA proprietary (redistribution restricted)" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:nvidia-host-driver",
+      "name": "NVIDIA host distribution driver",
+      "version": "570.211.01",
+      "supplier": { "name": "NVIDIA Corporation" },
+      "licenses": [ { "license": { "name": "NVIDIA proprietary EULA" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:nvidia-openrm",
+      "name": "NVIDIA open-gpu-kernel-modules",
+      "version": "610.57.04 (pinned tag)",
+      "description": "Cloned at a pinned tag by install.sh for build glue; patched locally; never committed.",
+      "supplier": { "name": "NVIDIA Corporation" },
+      "licenses": [ { "expression": "MIT OR GPL-2.0-only" } ],
+      "scope": "optional"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:cuda-toolkit",
+      "name": "NVIDIA CUDA toolkit",
+      "version": "12.4",
+      "supplier": { "name": "NVIDIA Corporation" },
+      "licenses": [ { "license": { "name": "NVIDIA proprietary EULA" } } ],
+      "scope": "optional"
+    },
+    {
+      "type": "operating-system",
+      "bom-ref": "dep:ubuntu-guest",
+      "name": "Ubuntu",
+      "version": "24.04 LTS",
+      "supplier": { "name": "Canonical" },
+      "licenses": [ { "license": { "name": "Various free software licenses" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:gcc",
+      "name": "GCC",
+      "version": "11-13",
+      "supplier": { "name": "GNU Project" },
+      "licenses": [ { "license": { "id": "GPL-3.0-or-later" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:binutils",
+      "name": "GNU binutils",
+      "version": "distribution version",
+      "supplier": { "name": "GNU Project" },
+      "licenses": [ { "license": { "id": "GPL-3.0-or-later" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:make",
+      "name": "GNU make",
+      "version": "distribution version",
+      "supplier": { "name": "GNU Project" },
+      "licenses": [ { "license": { "id": "GPL-3.0-or-later" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:python3",
+      "name": "Python",
+      "version": ">=3.10",
+      "supplier": { "name": "Python Software Foundation" },
+      "licenses": [ { "license": { "id": "PSF-2.0" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "library",
+      "bom-ref": "dep:pytorch",
+      "name": "PyTorch",
+      "version": "distribution version",
+      "supplier": { "name": "PyTorch Foundation" },
+      "licenses": [ { "license": { "id": "BSD-3-Clause" } } ],
+      "scope": "optional"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:gdb",
+      "name": "GDB",
+      "version": "distribution version",
+      "supplier": { "name": "GNU Project" },
+      "licenses": [ { "license": { "id": "GPL-3.0-or-later" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:ghidra",
+      "name": "Ghidra",
+      "version": "11.x",
+      "supplier": { "name": "NSA / Ghidra Project" },
+      "licenses": [ { "license": { "id": "Apache-2.0" } } ],
+      "scope": "optional"
+    },
+    {
+      "type": "application",
+      "bom-ref": "dep:openjdk",
+      "name": "OpenJDK",
+      "version": "21",
+      "supplier": { "name": "OpenJDK community" },
+      "licenses": [ { "expression": "GPL-2.0-only WITH Classpath-exception-2.0" } ],
+      "scope": "optional"
+    },
+    {
+      "type": "library",
+      "bom-ref": "dep:openssl",
+      "name": "OpenSSL",
+      "version": "distribution version",
+      "supplier": { "name": "OpenSSL Project" },
+      "licenses": [ { "license": { "id": "Apache-2.0" } } ],
+      "scope": "required"
+    },
+    {
+      "type": "library",
+      "bom-ref": "dep:libelf",
+      "name": "libelf",
+      "version": "distribution version",
+      "supplier": { "name": "elfutils / Linux community" },
+      "licenses": [ { "expression": "LGPL-2.1-or-later OR GPL-2.0-or-later" } ],
+      "scope": "required"
+    }
+  ],
+  "dependencies": [
+    {
+      "ref": "pkg:generic/open-iov@0.1.0",
+      "dependsOn": [
+        "pkg:generic/open-iov-vfio@0.1.0",
+        "pkg:generic/libiov@0.1.0",
+        "pkg:generic/open-iov-example@0.1.0",
+        "pkg:generic/open-iov-userspace-tests@0.1.0",
+        "pkg:generic/open-iov-kernel-tests@0.1.0",
+        "pkg:generic/open-iov-guest-diag@0.1.0",
+        "pkg:generic/open-iov-cuda-ab@0.1.0",
+        "pkg:generic/open-iov-rmq@0.1.0",
+        "pkg:generic/open-iov-ghidra-tools@0.1.0",
+        "pkg:generic/open-iov-guest-agent@0.1.0",
+        "pkg:generic/open-iov-tools-misc@0.1.0",
+        "pkg:generic/open-iov-gsp-analysis@570.144W",
+        "pkg:generic/open-iov-cuda-analysis@570.144",
+        "pkg:generic/open-iov-scripts@0.1.0",
+        "pkg:generic/open-iov-config@0.1.0",
+        "pkg:generic/open-iov-docs@0.1.0",
+        "pkg:generic/open-iov-wiki-archive@2023",
+        "pkg:generic/open-iov-ci@0.1.0",
+        "dep:linux-kernel",
+        "dep:qemu",
+        "dep:nvidia-guest-driver",
+        "dep:nvidia-gsp-firmware",
+        "dep:ubuntu-guest"
+      ]
+    },
+    {
+      "ref": "pkg:generic/open-iov-vfio@0.1.0",
+      "dependsOn": [
+        "dep:linux-kernel",
+        "dep:vfio-mdev",
+        "file:nv-hypervisor.h",
+        "file:nv-vgpu-vfio-interface.h",
+        "file:nvstatus.h",
+        "file:nvtypes.h"
+      ]
+    },
+    {
+      "ref": "pkg:generic/libiov@0.1.0",
+      "dependsOn": [
+        "pkg:github/cktan/tomlc99@vendored",
+        "pkg:github/likle/cargs@vendored"
+      ]
+    },
+    {
+      "ref": "pkg:generic/open-iov-cuda-ab@0.1.0",
+      "dependsOn": [
+        "dep:cuda-toolkit",
+        "file:vector_add"
+      ]
+    },
+    {
+      "ref": "pkg:generic/open-iov-rmq@0.1.0",
+      "dependsOn": [
+        "file:wpr2_reset"
+      ]
+    },
+    {
+      "ref": "pkg:generic/open-iov-ghidra-tools@0.1.0",
+      "dependsOn": [
+        "dep:ghidra",
+        "dep:openjdk"
+      ]
+    },
+    {
+      "ref": "pkg:generic/open-iov-guest-agent@0.1.0",
+      "dependsOn": [
+        "dep:python3",
+        "dep:pytorch"
+      ]
+    },
+    {
+      "ref": "pkg:generic/open-iov-guest-diag@0.1.0",
+      "dependsOn": [
+        "dep:python3",
+        "dep:gdb",
+        "dep:qemu"
+      ]
+    },
+    {
+      "ref": "pkg:generic/open-iov-scripts@0.1.0",
+      "dependsOn": [
+        "dep:gcc",
+        "dep:make",
+        "dep:binutils",
+        "dep:openssl",
+        "dep:libelf",
+        "dep:python3"
+      ]
+    }
+  ]
+}