{"@context":"https://spdx.org/rdf/3.0.1/spdx-context.jsonld","@graph":[{"type":"CreationInfo","@id":"_:CreationInfo0","created":"2011-04-05T23:00:00Z","createdBy":["http://spdx.org/spdxdocs/bitbake-addba517-4804-5ae3-87c2-0c3a1a5812ba/bitbake/agent/OpenEmbedded"],"createdUsing":["http://spdx.org/spdxdocs/bitbake-addba517-4804-5ae3-87c2-0c3a1a5812ba/bitbake/tool/oe-spdx-creator_1_0"],"specVersion":"3.0.1"},{"type":"CreationInfo","@id":"_:CreationInfo1","created":"2025-08-30T08:39:01Z","createdBy":["http://spdx.org/spdxdocs/bitbake-addba517-4804-5ae3-87c2-0c3a1a5812ba/bitbake/agent/OpenEmbedded"],"createdUsing":["http://spdx.org/spdxdocs/bitbake-addba517-4804-5ae3-87c2-0c3a1a5812ba/bitbake/tool/oe-spdx-creator_1_0"],"specVersion":"3.0.1"},{"type":"Organization","spdxId":"http://spdx.org/spdxdocs/bitbake-addba517-4804-5ae3-87c2-0c3a1a5812ba/bitbake/agent/OpenEmbedded","creationInfo":"_:CreationInfo0","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias"}],"name":"OpenEmbedded"},{"type":"Tool","spdxId":"http://spdx.org/spdxdocs/bitbake-addba517-4804-5ae3-87c2-0c3a1a5812ba/bitbake/tool/oe-spdx-creator_1_0","creationInfo":"_:CreationInfo0","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias"}],"name":"oe-spdx-creator 1.0"},{"type":"build_Build","spdxId":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/build/recipe","creationInfo":"_:CreationInfo1","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias","https://rdf.openembedded.org/spdx/3.0/alias":"http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/build/recipe"}],"name":"harfbuzz:do_create_spdx:recipe","build_buildType":"http://openembedded.org/bitbake/do_create_spdx/recipe"},{"type":"SpdxDocument","spdxId":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/document/recipe-harfbuzz","creationInfo":"_:CreationInfo1","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias","https://rdf.openembedded.org/spdx/3.0/alias":"http://spdxdocs.org/openembedded-alias/doc/harfbuzz/recipe-harfbuzz/harfbuzz/UNIHASH/document/recipe-harfbuzz","https://rdf.openembedded.org/spdx/3.0/link-name":"4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742"}],"name":"recipe-harfbuzz","profileConformance":["build","core","security","simpleLicensing","software"],"rootElement":["http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/build/recipe"]},{"type":"simplelicensing_LicenseExpression","spdxId":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/license/3_27_0/MIT","creationInfo":"_:CreationInfo1","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias","https://rdf.openembedded.org/spdx/3.0/alias":"http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/license/3_27_0/MIT"}],"simplelicensing_licenseExpression":"MIT","simplelicensing_licenseListVersion":"3.27.0"},{"type":"LifecycleScopedRelationship","spdxId":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/relationship/3f1d27c0975ecb9396d2a6ee357ffe9e","creationInfo":"_:CreationInfo1","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias","https://rdf.openembedded.org/spdx/3.0/alias":"http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/relationship/3f1d27c0975ecb9396d2a6ee357ffe9e"}],"from":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/build/recipe","relationshipType":"hasInput","to":["http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/source/1","http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/source/2"],"scope":"build"},{"type":"Relationship","spdxId":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/relationship/5e25a75b0ca620fe1d6eff0d7427e397","creationInfo":"_:CreationInfo1","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias","https://rdf.openembedded.org/spdx/3.0/alias":"http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/relationship/5e25a75b0ca620fe1d6eff0d7427e397"}],"from":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/source/2","relationshipType":"hasDeclaredLicense","to":["http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/license/3_27_0/MIT"]},{"type":"LifecycleScopedRelationship","spdxId":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/relationship/81b0152d8d8b1b787b29ff1544d9330f","creationInfo":"_:CreationInfo1","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias","https://rdf.openembedded.org/spdx/3.0/alias":"http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/relationship/81b0152d8d8b1b787b29ff1544d9330f"}],"from":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/build/recipe","relationshipType":"dependsOn","to":["http://spdxdocs.org/openembedded-alias/by-doc-hash/135d465a523919ff8bf03e11ab4280c2d9625fd876d728639a461a41e43976de/gcc-runtime/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/3d4ceabb7db09c3738e3348d9ed94c3eb745dd9756fae5bbc6d2a18eca0e8b7c/meson-native/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/4bc7265a8d95fb6774e61a856476a7b26d04136989bb288bc14aa0562e1cfa79/glib-2.0-native/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/4f85d23f04f7107632034fe7f9a7f6aa396ad03a503af13cde3f455b90606f51/ninja-native/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/6e3a79560a305461bb2406261874ff96dc4d8cf2e0730370562b781db6cacdd2/cairo/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/7dd0cffd98dab687fbb61503db6ecc5a94cb621b4d1d59aa4cb99b6dace629a3/gtk-doc-native/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/8bcc50109a89a2a5b45d13a5cd9a3fb7e276afd2bf762de4772a02f224c2f6bf/glibc/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/93568712d80e4314002e6bce0a6f7d446df9df352c9434a050248fcd2259d209/icu/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/a99e029532bd32332b3abbc83f6448bff7b86a18c436c4d2304c17282c332d40/python3-native/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/bbdd8d771d43ab958fdc500fc604f5c5c73ee12ef0eb9118668516ac3a42ea7a/gcc-cross-aarch64/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/c07b112b9f63935e1c33b3627039e4a27ca0bb24542a71bcbe1ae805d0d69207/pkgconfig-native/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/c8d755670219c10bdc093947386070b8b7c7c4137b26ce7d87f15af749ebf5f6/qemu-native/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/cd98f189c2c558e4754c4ea87a78b4a9fe914d2be300bf23c17d4a64d52446be/gobject-introspection-native/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/dbd966e0321c64ca30265924e212b5cd834705441f159c65c5748d2fca824e97/glib-2.0/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/df3e4c3bc165c09daef57e6b7909b25f95164985567131503424c1f27703fec2/freetype/UNIHASH/build/recipe","http://spdxdocs.org/openembedded-alias/by-doc-hash/e24db7025bd0a094ac2c0e4b0dfff13eb2b22e642bec69b234c1cc56a56643a9/gobject-introspection/UNIHASH/build/recipe"],"scope":"build"},{"type":"Relationship","spdxId":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/relationship/f879e92724f99685a0fc3553dd7ac14e","creationInfo":"_:CreationInfo1","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias","https://rdf.openembedded.org/spdx/3.0/alias":"http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/relationship/f879e92724f99685a0fc3553dd7ac14e"}],"from":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/source/1","relationshipType":"hasDeclaredLicense","to":["http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/license/3_27_0/MIT"]},{"type":"software_Package","spdxId":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/source/1","creationInfo":"_:CreationInfo1","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias","https://rdf.openembedded.org/spdx/3.0/alias":"http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/source/1"}],"name":"harfbuzz-11.4.5.tar.xz","verifiedUsing":[{"type":"Hash","algorithm":"sha256","hashValue":"0f052eb4ab01d8bae98ba971c954becb32be57d7250f18af343b1d27892e03fa"}],"software_primaryPurpose":"source","software_downloadLocation":"https://github.com/harfbuzz/harfbuzz/releases//download/11.4.5/harfbuzz-11.4.5.tar.xz"},{"type":"software_File","spdxId":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/source/2","creationInfo":"_:CreationInfo1","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias","https://rdf.openembedded.org/spdx/3.0/alias":"http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/source/2"}],"name":"CVE-2026-22693.patch","verifiedUsing":[{"type":"Hash","algorithm":"sha256","hashValue":"8ebd8d8ce3dc8290c66edd8ab9dbbfeb33984622dfe230d2b077de7e37abdb26"}],"software_primaryPurpose":"patch"},{"type":"security_Vulnerability","spdxId":"http://spdx.org/spdxdocs/harfbuzz-53d1536b-19ac-575f-9e53-9dfc0205d192/eeead865cbe4ed97c4dd314d01502f9ff9a6b08ceec0cd08ff912265b1e67356/vulnerability/CVE-2026-22693","creationInfo":"_:CreationInfo1","extension":[{"type":"https://rdf.openembedded.org/spdx/3.0/id-alias","https://rdf.openembedded.org/spdx/3.0/alias":"http://spdxdocs.org/openembedded-alias/by-doc-hash/4373c067b169f4f81422377866c78852c1d1dc8188013c93564cabba5f7dd742/harfbuzz/UNIHASH/vulnerability/CVE-2026-22693"}],"externalIdentifier":[{"type":"ExternalIdentifier","externalIdentifierType":"cve","identifier":"CVE-2026-22693","identifierLocator":["https://cveawg.mitre.org/api/cve/CVE-2026-22693","https://www.cve.org/CVERecord?id=CVE-2026-22693"]}]}]}