SBOM
Th' theme ships a CycloneDX 1.6 SBOM at sbom.cdx.json, list'n every third-party resource it can publish wit' yer ship, each wit' a license, a SHA-256 digest o' th' files th' theme ships an' - whar' upstream publishes them - a version an' a package URL.
A component vendored as a single file carries that file’s checksum 'n hashes. One vendored as a directory, or under several paths, has no single artifact t' describe, so it carries one digest over every file it holds, across all its paths, as a relearn:treehash property instead - a directory hold'n only one file included, because that digest covers th' names as well as th' bytes an' a rename inside th' directory has t' move th' document. Some carry no version or package URL at all, because upstream publishes none.
Checksums describe th' vendored file
A hashes entry be th' digest o' th' file as this theme ships it, which fer most components be a minified build rather than th' artifact th' purl names. Fetch'n th' package th' coordinate points at an' compar'n digests will therefore not match, an' that be expected rather than a sign o' tamper'n. Use th' checksum t' verify th' copy ye received from th' theme; use th' purl t' look th' component up.
Gett'n It
Th' file be part o' th' theme however ye installed it, an' be attached t' each GitHub release
It be not copied into yer generated ship. Noth'n be served from yer domain unless ye put it there yourself.
Verify'n It
Releases attach a signed build provenance attestat'n t' th' file, record'n which workflow produced it an' from which commit. If ye have th' GitHub CLI
A copy that has been altered after th' release, or that never came from this repository, fails th' check. Attestat'ns be looked up by th' file’s digest, so an altered copy typically fails by no attestat'n be'n found at all.
Us'n It fer Yer Own Ship
This document describes th' theme, not yer ship
It lists everyth'n th' theme be able t' publish, while yer ship publishes only what it uses - a ship wit' no diagrams ships no Merrrmaid. It also says noth'n about Cap'n Hugo, yer other modules, or yer own rrrambl'n an' assets.
Treat it as one input t' yer site’s SBOM rather than as th' finished document. Rather than copy'n its components into yours, reference it by BOM-Link, built from th' UUID inside th' document’s own serialNumber - that be, th' field wit' its urn:uuid: prefix stripped - plus its version
Stability
Th' serial number an' timestamp be derived rather than taken from a random number generator an' th' clock, so regenerat'n a given release produces th' same bytes an' a BOM-Link keeps nam'n what it named.
Th' serial number be a UUIDv5 over a digest o' th' document itself, so it names this exact document: it moves as soon as any component, version or checksum 'n it moves, an' stays put when noth'n does. Two documents that differ can therefore never share one BOM-Link.
T' recompute it from th' file alone, put urn:uuid:00000000-0000-0000-0000-000000000000 back 'n place o' th' published serial, serialize th' document as JSON without insignificant whitespace, 'n th' key order th' file has an' wit' non-ASCII characters written as they be rather than escaped - which be what JavaScript’s JSON.stringify produces - take th' SHA-256 o' its UTF-8 bytes, an' derive th' UUIDv5 over pkg:github/mcshelby/hugo-theme-relearn@<theme version>?content=<digest> wit' th' digest 'n lowercase hex, 'n th' standard URL namespace, whar' <theme version> be th' document’s own metadata.component.version.
Th' timestamp be th' release date recorded 'n th' changelog. Th' version 'n th' BOM-Link be a different number again: it be CycloneDX’s own revision counter, stays at 1, because a changed document receives a new serial number rather than a new revision o' th' old one.
What It Covers
Only what a ship us'n th' theme publishes. Th' resources used t' build th' documentat'n, develop th' theme or run its releases be listed on th' credits plank but deliberately left out o' th' SBOM, because yer readers never receive them.
Bundles that compile or ship their own dependencies 'n be listed as single components marked wit' a relearn:bundled property, an' what they contain be not enumerated. Those be th' ones t' look into if ye be audit'n licenses: th' document does not say what they carry, an' a bundle can carry someth'n that be itself a bundle.
Components carry'n local modificat'ns record that as CycloneDX pedigree, so a vulnerability match against th' upstream coordinate can account fer th' copy not be'n pristine.