def METHOD_NAME(package_info: dict, maven_packages: dict) -> dict:
  """Creates a dict representing an SBOM.
  Args:
    package_info: dict of data from packages_used output.
    maven_packages: packages gleaned from Maven lock file.
  Returns:
    dict of SBOM data
  """
  now = datetime.datetime.now(datetime.timezone.utc)
  ret = {
      "spdxVersion": "SPDX-2.3",
      "dataLicense": "CC0-1.0",
      "SPDXID": "SPDXRef-DOCUMENT",
      "documentNamespace": (
          "https://spdx.google/be852459-4c54-4c50-9d2f-0e48890418fc"
      ),
      "name": package_info["top_level_target"],
      "creationInfo": {
          "licenseListVersion": "",
          "creators": [
              "Tool: github.com/bazelbuild/bazel/tools/compliance/write_sbom",
              "Organization: Google LLC",
          ],
          "created": now.isoformat(),
      },
  }
  packages = []
  relationships = []
  relationships.append({
      "spdxElementId": "SPDXRef-DOCUMENT",
      "relatedSpdxElement": "SPDXRef-Package-main",
      "relationshipType": "DESCRIBES"
  })
  # This is bazel private shenanigans.
  magic_file_suffix = "//file:file"
  for pkg in package_info["packages"]:
    tmp_id = hashlib.md5()
    tmp_id.update(pkg.encode("utf-8"))
    spdxid = "SPDXRef-GooglePackage-%s" % tmp_id.hexdigest()
    pi = {
        "name": pkg,
        "downloadLocation": "NOASSERTION",
        "SPDXID": spdxid,
        # TODO(aiuto): Fill in the rest
        # "supplier": "Organization: Google LLC",
        # "licenseConcluded": "License-XXXXXX",
        # "copyrightText": ""
    }
    have_maven = None
    if pkg.startswith("@maven//:"):
      have_maven = maven_packages.get(pkg[9:])
    elif pkg.endswith(magic_file_suffix):
      # Bazel hacks jvm_external to add //file:file as a target, then we depend
      # on that rather than the correct thing.
      # Example: @org_apache_tomcat_tomcat_annotations_api_8_0_5//file:file
      # Check for just the versioned root
      have_maven = maven_packages.get(pkg[1 : -len(magic_file_suffix)])
    if have_maven:
      pi["downloadLocation"] = have_maven["url"]
    else:
      # TODO(aiuto): Do something better for this case.
      print("MISSING ", pkg)
    packages.append(pi)
    relationships.append({
        "spdxElementId": "SPDXRef-Package-main",
        "relatedSpdxElement": spdxid,
        "relationshipType": "CONTAINS",
    })
  ret["packages"] = packages
  ret["relationships"] = relationships
  return ret