@techreport{nobuo-scitt-protected-object-binding-00,
    number =    {draft-nobuo-scitt-protected-object-binding-00},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-nobuo-scitt-protected-object-binding/00/},
    author =    {Nobuo Aoki},
    title =     {{SCITT Statement Relationship and Protected Object Binding}},
    pagetotal = 21,
    year =      2026,
    month =     jul,
    day =       6,
    abstract =  {This document defines a small common model for relating Supply Chain Integrity, Transparency, and Trust (SCITT) Signed Statements to the supply-chain objects that those statements describe, measure, authorize, revoke, or audit. The model can be used for software artifacts, firmware artifacts, hardware components, device instances, cloud compute resources, and other objects that appear in supply- chain evidence. The document also defines a relationship vocabulary and an optional Statement Graph Manifest. These parts help verifiers connect heterogeneous SCITT statements without requiring SCITT to define the payload formats of those statements. This document does not define SBOM, HBOM, CBOM, attestation, audit, vulnerability, or regulatory payload formats. It only defines a common binding and graph layer around SCITT statements and receipts.},
}