diff --git a/internal/acceptance/workflows/scenario/step_funcs_tile_source_code.go b/internal/acceptance/workflows/scenario/step_funcs_tile_source_code.go
index 753831750..4ebf96d8e 100644
--- a/internal/acceptance/workflows/scenario/step_funcs_tile_source_code.go
+++ b/internal/acceptance/workflows/scenario/step_funcs_tile_source_code.go
@@ -50,7 +50,7 @@ func theLockSpecifiesVersionForRelease(ctx context.Context, releaseVersion, rele
 	if err != nil {
 		return err
 	}
-	releaseLock, err := lock.FindReleaseWithName(releaseName)
+	releaseLock, err := lock.FindBOSHReleaseWithName(releaseName)
 	if err != nil {
 		return err
 	}
@@ -70,7 +70,7 @@ func iSetAVersionConstraintForRelease(ctx context.Context, versionConstraint, re
 	if err != nil {
 		return err
 	}
-	specIndex := slices.IndexFunc(spec.Releases, func(release cargo.ComponentSpec) bool {
+	specIndex := slices.IndexFunc(spec.Releases, func(release cargo.BOSHReleaseTarballSpecification) bool {
 		return release.Name == releaseName
 	})
 	if specIndex == indexNotFound {
@@ -225,7 +225,7 @@ func theKilnfileVersionForReleaseIs(ctx context.Context, releaseName, releaseVer
 	if err != nil {
 		return err
 	}
-	releaseLock, err := kf.ComponentSpec(releaseName)
+	releaseLock, err := kf.BOSHReleaseTarballSpecification(releaseName)
 	if err != nil {
 		return err
 	}
diff --git a/internal/commands/cache_compiled_releases.go b/internal/commands/cache_compiled_releases.go
index e7b45dea1..e575d302f 100644
--- a/internal/commands/cache_compiled_releases.go
+++ b/internal/commands/cache_compiled_releases.go
@@ -35,7 +35,7 @@ type (
 
 	ReleaseStorage interface {
 		component.ReleaseSource
-		UploadRelease(spec component.Spec, file io.Reader) (component.Lock, error)
+		UploadRelease(spec cargo.BOSHReleaseTarballSpecification, file io.Reader) (cargo.BOSHReleaseTarballLock, error)
 	}
 )
 
@@ -118,11 +118,11 @@ func (cmd *CacheCompiledReleases) Execute(args []string) error {
 	}
 
 	var (
-		releasesToExport         []cargo.ComponentLock
+		releasesToExport         []cargo.BOSHReleaseTarballLock
 		releasesUpdatedFromCache = false
 	)
 	for _, rel := range lock.Releases {
-		remote, err := releaseStore.GetMatchedRelease(component.Spec{
+		remote, err := releaseStore.GetMatchedRelease(cargo.BOSHReleaseTarballSpecification{
 			Name:            rel.Name,
 			Version:         rel.Version,
 			StemcellOS:      lock.Stemcell.OS,
@@ -132,7 +132,7 @@ func (cmd *CacheCompiledReleases) Execute(args []string) error {
 			if !component.IsErrNotFound(err) {
 				return fmt.Errorf("failed check for matched release: %w", err)
 			}
-			releasesToExport = append(releasesToExport, component.Lock{
+			releasesToExport = append(releasesToExport, cargo.BOSHReleaseTarballLock{
 				Name:            rel.Name,
 				Version:         rel.Version,
 				StemcellOS:      lock.Stemcell.OS,
@@ -301,28 +301,28 @@ func (cmd *CacheCompiledReleases) fetchProductDeploymentData() (_ OpsManagerRele
 	return omAPI, manifest.Name, stagedStemcell.OS, stagedStemcell.Version, nil
 }
 
-func (cmd *CacheCompiledReleases) cacheRelease(bosh boshdir.Director, rc ReleaseStorage, deployment boshdir.Deployment, releaseSlug boshdir.ReleaseSlug, stemcellSlug boshdir.OSVersionSlug) (component.Lock, error) {
+func (cmd *CacheCompiledReleases) cacheRelease(bosh boshdir.Director, rc ReleaseStorage, deployment boshdir.Deployment, releaseSlug boshdir.ReleaseSlug, stemcellSlug boshdir.OSVersionSlug) (cargo.BOSHReleaseTarballLock, error) {
 	cmd.Logger.Printf("\texporting %s\n", releaseSlug)
 	result, err := deployment.ExportRelease(releaseSlug, stemcellSlug, nil)
 	if err != nil {
-		return component.Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	cmd.Logger.Printf("\tdownloading %s\n", releaseSlug)
 	releaseFilePath, _, sha1sum, err := cmd.saveReleaseLocally(bosh, cmd.Options.ReleasesDir, releaseSlug, stemcellSlug, result)
 	if err != nil {
-		return component.Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	cmd.Logger.Printf("\tuploading %s\n", releaseSlug)
-	remoteRelease, err := cmd.uploadLocalRelease(cargo.ComponentSpec{
+	remoteRelease, err := cmd.uploadLocalRelease(cargo.BOSHReleaseTarballSpecification{
 		Name:            releaseSlug.Name(),
 		Version:         releaseSlug.Version(),
 		StemcellOS:      stemcellSlug.OS(),
 		StemcellVersion: stemcellSlug.Version(),
 	}, releaseFilePath, rc)
 	if err != nil {
-		return component.Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	remoteRelease.SHA1 = sha1sum
@@ -330,7 +330,7 @@ func (cmd *CacheCompiledReleases) cacheRelease(bosh boshdir.Director, rc Release
 	return remoteRelease, nil
 }
 
-func updateLock(lock cargo.KilnfileLock, release component.Lock, targetID string) error {
+func updateLock(lock cargo.KilnfileLock, release cargo.BOSHReleaseTarballLock, targetID string) error {
 	for index, releaseLock := range lock.Releases {
 		if release.Name != releaseLock.Name {
 			continue
@@ -341,7 +341,7 @@ func updateLock(lock cargo.KilnfileLock, release component.Lock, targetID string
 			checksum = releaseLock.SHA1
 		}
 
-		lock.Releases[index] = cargo.ComponentLock{
+		lock.Releases[index] = cargo.BOSHReleaseTarballLock{
 			Name:         release.Name,
 			Version:      release.Version,
 			RemoteSource: release.RemoteSource,
@@ -353,10 +353,10 @@ func updateLock(lock cargo.KilnfileLock, release component.Lock, targetID string
 	return fmt.Errorf("existing release not found in Kilnfile.lock")
 }
 
-func (cmd *CacheCompiledReleases) uploadLocalRelease(spec component.Spec, fp string, uploader ReleaseStorage) (component.Lock, error) {
+func (cmd *CacheCompiledReleases) uploadLocalRelease(spec cargo.BOSHReleaseTarballSpecification, fp string, uploader ReleaseStorage) (cargo.BOSHReleaseTarballLock, error) {
 	f, err := cmd.FS.Open(fp)
 	if err != nil {
-		return component.Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 	defer closeAndIgnoreError(f)
 	return uploader.UploadRelease(spec, f)
@@ -393,7 +393,7 @@ func (cmd *CacheCompiledReleases) saveReleaseLocally(director boshdir.Director,
 	return filePath, sha256sumString, sha1sumString, nil
 }
 
-func (cmd *CacheCompiledReleases) downloadAndComputeSHA(cache component.ReleaseSource, remote cargo.ComponentLock) (string, error) {
+func (cmd *CacheCompiledReleases) downloadAndComputeSHA(cache component.ReleaseSource, remote cargo.BOSHReleaseTarballLock) (string, error) {
 	if remote.SHA1 != "" {
 		return remote.SHA1, nil
 	}
@@ -414,7 +414,7 @@ func (cmd *CacheCompiledReleases) downloadAndComputeSHA(cache component.ReleaseS
 		return "", fmt.Errorf("failed to download release: %s", err)
 	}
 
-	return comp.SHA1, nil
+	return comp.Lock.SHA1, nil
 }
 
 func (cmd *CacheCompiledReleases) Usage() jhanda.Usage {
diff --git a/internal/commands/cache_compiled_releases_test.go b/internal/commands/cache_compiled_releases_test.go
index 60b59da26..86479f01b 100644
--- a/internal/commands/cache_compiled_releases_test.go
+++ b/internal/commands/cache_compiled_releases_test.go
@@ -64,25 +64,25 @@ func newCacheCompiledReleasesTestData(t *testing.T, kf cargo.Kilnfile, kl cargo.
 	logger := log.New(&output, "", 0)
 
 	releaseStorage := new(fakes.ReleaseStorage)
-	releaseStorage.GetMatchedReleaseCalls(func(spec component.Spec) (component.Lock, error) {
+	releaseStorage.GetMatchedReleaseCalls(func(spec cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 		switch spec.Lock() {
-		case component.Lock{Name: "orange", Version: "1.0.0", StemcellOS: "alpine", StemcellVersion: "9.0.0"}:
-			return component.Lock{
+		case cargo.BOSHReleaseTarballLock{Name: "orange", Version: "1.0.0", StemcellOS: "alpine", StemcellVersion: "9.0.0"}:
+			return cargo.BOSHReleaseTarballLock{
 				Name: "orange", Version: "1.0.0",
 				SHA1:         "fake-checksum",
 				RemoteSource: "cached-compiled-releases",
 				RemotePath:   "orange-1.0.0-alpine-9.0.0",
 			}, nil
-		case component.Lock{Name: "banana", Version: "2.0.0", StemcellOS: "alpine", StemcellVersion: "9.0.0"}:
-			return component.Lock{
+		case cargo.BOSHReleaseTarballLock{Name: "banana", Version: "2.0.0", StemcellOS: "alpine", StemcellVersion: "9.0.0"}:
+			return cargo.BOSHReleaseTarballLock{
 				Name: "banana", Version: "2.0.0",
 				SHA1:         "fake-checksum",
 				RemoteSource: "cached-compiled-releases",
 				RemotePath:   "banana-2.0.0-alpine-9.0.0",
 			}, nil
-		case component.Lock{Name: "lemon", Version: "3.0.0", StemcellOS: "alpine", StemcellVersion: "9.0.0"},
-			component.Lock{Name: "banana", Version: "2.0.0", StemcellOS: "alpine", StemcellVersion: "8.0.0"}:
-			return component.Lock{}, component.ErrNotFound
+		case cargo.BOSHReleaseTarballLock{Name: "lemon", Version: "3.0.0", StemcellOS: "alpine", StemcellVersion: "9.0.0"},
+			cargo.BOSHReleaseTarballLock{Name: "banana", Version: "2.0.0", StemcellOS: "alpine", StemcellVersion: "8.0.0"}:
+			return cargo.BOSHReleaseTarballLock{}, component.ErrNotFound
 		}
 
 		panic(fmt.Sprintf("unexpected spec %#v", spec))
@@ -131,7 +131,7 @@ func TestCacheCompiledReleases_Execute_all_releases_are_already_compiled(t *test
 			},
 		},
 	}, cargo.KilnfileLock{
-		Releases: []cargo.ComponentLock{
+		Releases: []cargo.BOSHReleaseTarballLock{
 			{
 				Name:         "banana",
 				Version:      "2.0.0",
@@ -170,7 +170,7 @@ func TestCacheCompiledReleases_Execute_all_releases_are_already_cached(t *testin
 			},
 		},
 	}, cargo.KilnfileLock{
-		Releases: []cargo.ComponentLock{
+		Releases: []cargo.BOSHReleaseTarballLock{
 			{
 				Name:    "orange",
 				Version: "1.0.0",
@@ -200,7 +200,7 @@ func TestCacheCompiledReleases_Execute_all_releases_are_already_cached(t *testin
 
 	var updatedKilnfile cargo.KilnfileLock
 	please.Expect(fsReadYAML(test.cmd.FS, "Kilnfile.lock", &updatedKilnfile)).NotTo(HaveOccurred())
-	please.Expect(updatedKilnfile.Releases).To(ContainElement(component.Lock{
+	please.Expect(updatedKilnfile.Releases).To(ContainElement(cargo.BOSHReleaseTarballLock{
 		Name: "orange", Version: "1.0.0",
 		SHA1:         "fake-checksum",
 		RemoteSource: "cached-compiled-releases",
@@ -231,7 +231,7 @@ func TestCacheCompiledReleases_Execute_when_one_release_is_cached_another_is_alr
 			},
 		},
 	}, cargo.KilnfileLock{
-		Releases: []cargo.ComponentLock{
+		Releases: []cargo.BOSHReleaseTarballLock{
 			{
 				Name:    "orange",
 				Version: "1.0.0",
@@ -288,9 +288,9 @@ func TestCacheCompiledReleases_Execute_when_one_release_is_cached_another_is_alr
 	}
 
 	var uploadedRelease bytes.Buffer
-	test.releaseStorage.UploadReleaseCalls(func(_ component.Spec, reader io.Reader) (component.Lock, error) {
+	test.releaseStorage.UploadReleaseCalls(func(_ cargo.BOSHReleaseTarballSpecification, reader io.Reader) (cargo.BOSHReleaseTarballLock, error) {
 		_, _ = io.Copy(&uploadedRelease, reader)
-		return component.Lock{
+		return cargo.BOSHReleaseTarballLock{
 			Name: "lemon", Version: "3.0.0",
 
 			RemoteSource: "cached-compiled-releases",
@@ -327,7 +327,7 @@ func TestCacheCompiledReleases_Execute_when_one_release_is_cached_another_is_alr
 
 	var updatedKilnfile cargo.KilnfileLock
 	please.Expect(fsReadYAML(test.cmd.FS, "Kilnfile.lock", &updatedKilnfile)).NotTo(HaveOccurred())
-	please.Expect(updatedKilnfile.Releases).To(ContainElement(component.Lock{
+	please.Expect(updatedKilnfile.Releases).To(ContainElement(cargo.BOSHReleaseTarballLock{
 		Name:         "lemon",
 		Version:      "3.0.0",
 		SHA1:         "012ed191f1d07c14bbcbbc0423d0de1c56757348",
@@ -360,7 +360,7 @@ func TestCacheCompiledReleases_Execute_when_a_release_is_not_compiled_with_the_c
 			},
 		},
 	}, cargo.KilnfileLock{
-		Releases: []cargo.ComponentLock{
+		Releases: []cargo.BOSHReleaseTarballLock{
 			{
 				Name:    "banana",
 				Version: "2.0.0",
@@ -418,7 +418,7 @@ func TestCacheCompiledReleases_Execute_when_a_release_is_not_compiled_with_the_c
 
 	var updatedKilnfile cargo.KilnfileLock
 	please.Expect(fsReadYAML(test.cmd.FS, "Kilnfile.lock", &updatedKilnfile)).NotTo(HaveOccurred())
-	please.Expect(updatedKilnfile.Releases).To(ContainElement(component.Lock{
+	please.Expect(updatedKilnfile.Releases).To(ContainElement(cargo.BOSHReleaseTarballLock{
 		Name:    "banana",
 		Version: "2.0.0",
 
@@ -448,13 +448,13 @@ func TestCacheCompiledReleases_Execute_when_a_release_has_no_packages(t *testing
 				PathTemplate: "{{.Release}}-{{.Version}}.tgz",
 			},
 		},
-		Releases: []cargo.ComponentSpec{
+		Releases: []cargo.BOSHReleaseTarballSpecification{
 			{
 				Name: "banana",
 			},
 		},
 	}, cargo.KilnfileLock{
-		Releases: []cargo.ComponentLock{
+		Releases: []cargo.BOSHReleaseTarballLock{
 			{
 				Name:    "banana",
 				Version: "2.0.0",
@@ -488,7 +488,7 @@ func TestCacheCompiledReleases_Execute_when_a_release_has_no_packages(t *testing
 			}, nil
 		}
 	}
-	test.releaseStorage.UploadReleaseStub = func(spec cargo.ComponentSpec, reader io.Reader) (cargo.ComponentLock, error) {
+	test.releaseStorage.UploadReleaseStub = func(spec cargo.BOSHReleaseTarballSpecification, reader io.Reader) (cargo.BOSHReleaseTarballLock, error) {
 		l := spec.Lock()
 		l.RemotePath = "BANANA.tgz"
 		l.RemoteSource = "BASKET"
@@ -521,7 +521,7 @@ func TestCacheCompiledReleases_Execute_when_a_release_has_no_packages(t *testing
 
 	var updatedKilnfile cargo.KilnfileLock
 	please.Expect(fsReadYAML(test.cmd.FS, "Kilnfile.lock", &updatedKilnfile)).NotTo(HaveOccurred())
-	please.Expect(updatedKilnfile.Releases).To(ContainElement(component.Lock{
+	please.Expect(updatedKilnfile.Releases).To(ContainElement(cargo.BOSHReleaseTarballLock{
 		Name:    "banana",
 		Version: "2.0.0",
 
@@ -542,7 +542,7 @@ func TestCacheCompiledReleases_Execute_staged_and_lock_stemcells_are_not_the_sam
 	// setup
 
 	initialLock := cargo.KilnfileLock{
-		Releases: []component.Lock{
+		Releases: []cargo.BOSHReleaseTarballLock{
 			{
 				Name:    "orange",
 				Version: "1.0.0",
diff --git a/internal/commands/fakes/release_storage.go b/internal/commands/fakes/release_storage.go
index 3cb731441..b1700966c 100644
--- a/internal/commands/fakes/release_storage.go
+++ b/internal/commands/fakes/release_storage.go
@@ -21,11 +21,11 @@ type ReleaseStorage struct {
 	configurationReturnsOnCall map[int]struct {
 		result1 cargo.ReleaseSourceConfig
 	}
-	DownloadReleaseStub        func(string, cargo.ComponentLock) (component.Local, error)
+	DownloadReleaseStub        func(string, cargo.BOSHReleaseTarballLock) (component.Local, error)
 	downloadReleaseMutex       sync.RWMutex
 	downloadReleaseArgsForCall []struct {
 		arg1 string
-		arg2 cargo.ComponentLock
+		arg2 cargo.BOSHReleaseTarballLock
 	}
 	downloadReleaseReturns struct {
 		result1 component.Local
@@ -35,45 +35,45 @@ type ReleaseStorage struct {
 		result1 component.Local
 		result2 error
 	}
-	FindReleaseVersionStub        func(cargo.ComponentSpec, bool) (cargo.ComponentLock, error)
+	FindReleaseVersionStub        func(cargo.BOSHReleaseTarballSpecification, bool) (cargo.BOSHReleaseTarballLock, error)
 	findReleaseVersionMutex       sync.RWMutex
 	findReleaseVersionArgsForCall []struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 		arg2 bool
 	}
 	findReleaseVersionReturns struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	findReleaseVersionReturnsOnCall map[int]struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
-	GetMatchedReleaseStub        func(cargo.ComponentSpec) (cargo.ComponentLock, error)
+	GetMatchedReleaseStub        func(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)
 	getMatchedReleaseMutex       sync.RWMutex
 	getMatchedReleaseArgsForCall []struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 	}
 	getMatchedReleaseReturns struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	getMatchedReleaseReturnsOnCall map[int]struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
-	UploadReleaseStub        func(cargo.ComponentSpec, io.Reader) (cargo.ComponentLock, error)
+	UploadReleaseStub        func(cargo.BOSHReleaseTarballSpecification, io.Reader) (cargo.BOSHReleaseTarballLock, error)
 	uploadReleaseMutex       sync.RWMutex
 	uploadReleaseArgsForCall []struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 		arg2 io.Reader
 	}
 	uploadReleaseReturns struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	uploadReleaseReturnsOnCall map[int]struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	invocations      map[string][][]interface{}
@@ -133,12 +133,12 @@ func (fake *ReleaseStorage) ConfigurationReturnsOnCall(i int, result1 cargo.Rele
 	}{result1}
 }
 
-func (fake *ReleaseStorage) DownloadRelease(arg1 string, arg2 cargo.ComponentLock) (component.Local, error) {
+func (fake *ReleaseStorage) DownloadRelease(arg1 string, arg2 cargo.BOSHReleaseTarballLock) (component.Local, error) {
 	fake.downloadReleaseMutex.Lock()
 	ret, specificReturn := fake.downloadReleaseReturnsOnCall[len(fake.downloadReleaseArgsForCall)]
 	fake.downloadReleaseArgsForCall = append(fake.downloadReleaseArgsForCall, struct {
 		arg1 string
-		arg2 cargo.ComponentLock
+		arg2 cargo.BOSHReleaseTarballLock
 	}{arg1, arg2})
 	stub := fake.DownloadReleaseStub
 	fakeReturns := fake.downloadReleaseReturns
@@ -159,13 +159,13 @@ func (fake *ReleaseStorage) DownloadReleaseCallCount() int {
 	return len(fake.downloadReleaseArgsForCall)
 }
 
-func (fake *ReleaseStorage) DownloadReleaseCalls(stub func(string, cargo.ComponentLock) (component.Local, error)) {
+func (fake *ReleaseStorage) DownloadReleaseCalls(stub func(string, cargo.BOSHReleaseTarballLock) (component.Local, error)) {
 	fake.downloadReleaseMutex.Lock()
 	defer fake.downloadReleaseMutex.Unlock()
 	fake.DownloadReleaseStub = stub
 }
 
-func (fake *ReleaseStorage) DownloadReleaseArgsForCall(i int) (string, cargo.ComponentLock) {
+func (fake *ReleaseStorage) DownloadReleaseArgsForCall(i int) (string, cargo.BOSHReleaseTarballLock) {
 	fake.downloadReleaseMutex.RLock()
 	defer fake.downloadReleaseMutex.RUnlock()
 	argsForCall := fake.downloadReleaseArgsForCall[i]
@@ -198,11 +198,11 @@ func (fake *ReleaseStorage) DownloadReleaseReturnsOnCall(i int, result1 componen
 	}{result1, result2}
 }
 
-func (fake *ReleaseStorage) FindReleaseVersion(arg1 cargo.ComponentSpec, arg2 bool) (cargo.ComponentLock, error) {
+func (fake *ReleaseStorage) FindReleaseVersion(arg1 cargo.BOSHReleaseTarballSpecification, arg2 bool) (cargo.BOSHReleaseTarballLock, error) {
 	fake.findReleaseVersionMutex.Lock()
 	ret, specificReturn := fake.findReleaseVersionReturnsOnCall[len(fake.findReleaseVersionArgsForCall)]
 	fake.findReleaseVersionArgsForCall = append(fake.findReleaseVersionArgsForCall, struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 		arg2 bool
 	}{arg1, arg2})
 	stub := fake.FindReleaseVersionStub
@@ -224,50 +224,50 @@ func (fake *ReleaseStorage) FindReleaseVersionCallCount() int {
 	return len(fake.findReleaseVersionArgsForCall)
 }
 
-func (fake *ReleaseStorage) FindReleaseVersionCalls(stub func(cargo.ComponentSpec, bool) (cargo.ComponentLock, error)) {
+func (fake *ReleaseStorage) FindReleaseVersionCalls(stub func(cargo.BOSHReleaseTarballSpecification, bool) (cargo.BOSHReleaseTarballLock, error)) {
 	fake.findReleaseVersionMutex.Lock()
 	defer fake.findReleaseVersionMutex.Unlock()
 	fake.FindReleaseVersionStub = stub
 }
 
-func (fake *ReleaseStorage) FindReleaseVersionArgsForCall(i int) (cargo.ComponentSpec, bool) {
+func (fake *ReleaseStorage) FindReleaseVersionArgsForCall(i int) (cargo.BOSHReleaseTarballSpecification, bool) {
 	fake.findReleaseVersionMutex.RLock()
 	defer fake.findReleaseVersionMutex.RUnlock()
 	argsForCall := fake.findReleaseVersionArgsForCall[i]
 	return argsForCall.arg1, argsForCall.arg2
 }
 
-func (fake *ReleaseStorage) FindReleaseVersionReturns(result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseStorage) FindReleaseVersionReturns(result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.findReleaseVersionMutex.Lock()
 	defer fake.findReleaseVersionMutex.Unlock()
 	fake.FindReleaseVersionStub = nil
 	fake.findReleaseVersionReturns = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseStorage) FindReleaseVersionReturnsOnCall(i int, result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseStorage) FindReleaseVersionReturnsOnCall(i int, result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.findReleaseVersionMutex.Lock()
 	defer fake.findReleaseVersionMutex.Unlock()
 	fake.FindReleaseVersionStub = nil
 	if fake.findReleaseVersionReturnsOnCall == nil {
 		fake.findReleaseVersionReturnsOnCall = make(map[int]struct {
-			result1 cargo.ComponentLock
+			result1 cargo.BOSHReleaseTarballLock
 			result2 error
 		})
 	}
 	fake.findReleaseVersionReturnsOnCall[i] = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseStorage) GetMatchedRelease(arg1 cargo.ComponentSpec) (cargo.ComponentLock, error) {
+func (fake *ReleaseStorage) GetMatchedRelease(arg1 cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 	fake.getMatchedReleaseMutex.Lock()
 	ret, specificReturn := fake.getMatchedReleaseReturnsOnCall[len(fake.getMatchedReleaseArgsForCall)]
 	fake.getMatchedReleaseArgsForCall = append(fake.getMatchedReleaseArgsForCall, struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 	}{arg1})
 	stub := fake.GetMatchedReleaseStub
 	fakeReturns := fake.getMatchedReleaseReturns
@@ -288,50 +288,50 @@ func (fake *ReleaseStorage) GetMatchedReleaseCallCount() int {
 	return len(fake.getMatchedReleaseArgsForCall)
 }
 
-func (fake *ReleaseStorage) GetMatchedReleaseCalls(stub func(cargo.ComponentSpec) (cargo.ComponentLock, error)) {
+func (fake *ReleaseStorage) GetMatchedReleaseCalls(stub func(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = stub
 }
 
-func (fake *ReleaseStorage) GetMatchedReleaseArgsForCall(i int) cargo.ComponentSpec {
+func (fake *ReleaseStorage) GetMatchedReleaseArgsForCall(i int) cargo.BOSHReleaseTarballSpecification {
 	fake.getMatchedReleaseMutex.RLock()
 	defer fake.getMatchedReleaseMutex.RUnlock()
 	argsForCall := fake.getMatchedReleaseArgsForCall[i]
 	return argsForCall.arg1
 }
 
-func (fake *ReleaseStorage) GetMatchedReleaseReturns(result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseStorage) GetMatchedReleaseReturns(result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = nil
 	fake.getMatchedReleaseReturns = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseStorage) GetMatchedReleaseReturnsOnCall(i int, result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseStorage) GetMatchedReleaseReturnsOnCall(i int, result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = nil
 	if fake.getMatchedReleaseReturnsOnCall == nil {
 		fake.getMatchedReleaseReturnsOnCall = make(map[int]struct {
-			result1 cargo.ComponentLock
+			result1 cargo.BOSHReleaseTarballLock
 			result2 error
 		})
 	}
 	fake.getMatchedReleaseReturnsOnCall[i] = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseStorage) UploadRelease(arg1 cargo.ComponentSpec, arg2 io.Reader) (cargo.ComponentLock, error) {
+func (fake *ReleaseStorage) UploadRelease(arg1 cargo.BOSHReleaseTarballSpecification, arg2 io.Reader) (cargo.BOSHReleaseTarballLock, error) {
 	fake.uploadReleaseMutex.Lock()
 	ret, specificReturn := fake.uploadReleaseReturnsOnCall[len(fake.uploadReleaseArgsForCall)]
 	fake.uploadReleaseArgsForCall = append(fake.uploadReleaseArgsForCall, struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 		arg2 io.Reader
 	}{arg1, arg2})
 	stub := fake.UploadReleaseStub
@@ -353,41 +353,41 @@ func (fake *ReleaseStorage) UploadReleaseCallCount() int {
 	return len(fake.uploadReleaseArgsForCall)
 }
 
-func (fake *ReleaseStorage) UploadReleaseCalls(stub func(cargo.ComponentSpec, io.Reader) (cargo.ComponentLock, error)) {
+func (fake *ReleaseStorage) UploadReleaseCalls(stub func(cargo.BOSHReleaseTarballSpecification, io.Reader) (cargo.BOSHReleaseTarballLock, error)) {
 	fake.uploadReleaseMutex.Lock()
 	defer fake.uploadReleaseMutex.Unlock()
 	fake.UploadReleaseStub = stub
 }
 
-func (fake *ReleaseStorage) UploadReleaseArgsForCall(i int) (cargo.ComponentSpec, io.Reader) {
+func (fake *ReleaseStorage) UploadReleaseArgsForCall(i int) (cargo.BOSHReleaseTarballSpecification, io.Reader) {
 	fake.uploadReleaseMutex.RLock()
 	defer fake.uploadReleaseMutex.RUnlock()
 	argsForCall := fake.uploadReleaseArgsForCall[i]
 	return argsForCall.arg1, argsForCall.arg2
 }
 
-func (fake *ReleaseStorage) UploadReleaseReturns(result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseStorage) UploadReleaseReturns(result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.uploadReleaseMutex.Lock()
 	defer fake.uploadReleaseMutex.Unlock()
 	fake.UploadReleaseStub = nil
 	fake.uploadReleaseReturns = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseStorage) UploadReleaseReturnsOnCall(i int, result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseStorage) UploadReleaseReturnsOnCall(i int, result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.uploadReleaseMutex.Lock()
 	defer fake.uploadReleaseMutex.Unlock()
 	fake.UploadReleaseStub = nil
 	if fake.uploadReleaseReturnsOnCall == nil {
 		fake.uploadReleaseReturnsOnCall = make(map[int]struct {
-			result1 cargo.ComponentLock
+			result1 cargo.BOSHReleaseTarballLock
 			result2 error
 		})
 	}
 	fake.uploadReleaseReturnsOnCall[i] = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
diff --git a/internal/commands/fetch.go b/internal/commands/fetch.go
index 47fba6a1d..d8d5d00db 100644
--- a/internal/commands/fetch.go
+++ b/internal/commands/fetch.go
@@ -111,13 +111,13 @@ func (f *Fetch) setup(args []string) (cargo.Kilnfile, cargo.KilnfileLock, []comp
 	return kilnfile, kilnfileLock, availableLocalReleaseSet, nil
 }
 
-func (f Fetch) downloadMissingReleases(kilnfile cargo.Kilnfile, releaseLocks []cargo.ComponentLock) ([]component.Local, error) {
+func (f Fetch) downloadMissingReleases(kilnfile cargo.Kilnfile, releaseLocks []cargo.BOSHReleaseTarballLock) ([]component.Local, error) {
 	releaseSource := f.multiReleaseSourceProvider(kilnfile, f.Options.AllowOnlyPublishableReleases)
 
 	var downloaded []component.Local
 
 	for _, rl := range releaseLocks {
-		remoteRelease := component.Lock{
+		remoteRelease := cargo.BOSHReleaseTarballLock{
 			Name:         rl.Name,
 			Version:      rl.Version,
 			RemotePath:   rl.RemotePath,
@@ -129,13 +129,13 @@ func (f Fetch) downloadMissingReleases(kilnfile cargo.Kilnfile, releaseLocks []c
 			return nil, fmt.Errorf("download failed: %w", err)
 		}
 
-		if local.SHA1 != rl.SHA1 {
+		if local.Lock.SHA1 != rl.SHA1 {
 			err = os.Remove(local.LocalPath)
 			if err != nil {
 				return nil, fmt.Errorf("error deleting bad release file %q: %w", local.LocalPath, err) // untested
 			}
 
-			return nil, fmt.Errorf("downloaded release %q had an incorrect SHA1 - expected %q, got %q", local.LocalPath, rl.SHA1, local.SHA1)
+			return nil, fmt.Errorf("downloaded release %q had an incorrect SHA1 - expected %q, got %q", local.LocalPath, rl.SHA1, local.Lock.SHA1)
 		}
 
 		downloaded = append(downloaded, local)
@@ -152,14 +152,14 @@ func (f Fetch) Usage() jhanda.Usage {
 	}
 }
 
-func partition(releaseLocks []cargo.ComponentLock, localReleases []component.Local) (intersection []component.Local, missing []cargo.ComponentLock, extra []component.Local) {
-	missing = make([]cargo.ComponentLock, len(releaseLocks))
+func partition(releaseLocks []cargo.BOSHReleaseTarballLock, localReleases []component.Local) (intersection []component.Local, missing []cargo.BOSHReleaseTarballLock, extra []component.Local) {
+	missing = make([]cargo.BOSHReleaseTarballLock, len(releaseLocks))
 	copy(missing, releaseLocks)
 
 nextRelease:
 	for _, rel := range localReleases {
 		for j, lock := range missing {
-			if rel.Name == lock.Name && rel.Version == lock.Version && rel.SHA1 == lock.SHA1 {
+			if rel.Lock.Name == lock.Name && rel.Lock.Version == lock.Version && rel.Lock.SHA1 == lock.SHA1 {
 				intersection = append(intersection, rel)
 				missing = append(missing[:j], missing[j+1:]...)
 				continue nextRelease
diff --git a/internal/commands/fetch_test.go b/internal/commands/fetch_test.go
index 23b7e3ef3..4f3134d29 100644
--- a/internal/commands/fetch_test.go
+++ b/internal/commands/fetch_test.go
@@ -102,13 +102,13 @@ stemcell_criteria:
 			fakeReleaseSources.FindByIDStub = func(s string) (component.ReleaseSource, error) {
 				return releaseSourceList.FindByID(s)
 			}
-			fakeReleaseSources.DownloadReleaseStub = func(s string, lock cargo.ComponentLock) (component.Local, error) {
+			fakeReleaseSources.DownloadReleaseStub = func(s string, lock cargo.BOSHReleaseTarballLock) (component.Local, error) {
 				return releaseSourceList.DownloadRelease(s, lock)
 			}
-			fakeReleaseSources.FindReleaseVersionStub = func(requirement component.Spec, withSHA bool) (cargo.ComponentLock, error) {
+			fakeReleaseSources.FindReleaseVersionStub = func(requirement cargo.BOSHReleaseTarballSpecification, withSHA bool) (cargo.BOSHReleaseTarballLock, error) {
 				return releaseSourceList.FindReleaseVersion(requirement, false)
 			}
-			fakeReleaseSources.GetMatchedReleaseStub = func(requirement component.Spec) (cargo.ComponentLock, error) {
+			fakeReleaseSources.GetMatchedReleaseStub = func(requirement cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 				return releaseSourceList.GetMatchedRelease(requirement)
 			}
 			multiReleaseSourceProvider = func(kilnfile cargo.Kilnfile, allowOnlyPublishable bool) component.MultiReleaseSource {
@@ -128,11 +128,11 @@ stemcell_criteria:
 				expectedStemcellVersion = "0.2.0"
 			)
 			var (
-				releaseID     component.Spec
+				releaseID     cargo.BOSHReleaseTarballSpecification
 				releaseOnDisk component.Local
 			)
 			BeforeEach(func() {
-				releaseID = component.Spec{Name: "some-release", Version: "0.1.0"}
+				releaseID = cargo.BOSHReleaseTarballSpecification{Name: "some-release", Version: "0.1.0"}
 				fakeS3CompiledReleaseSource.DownloadReleaseReturns(
 					component.Local{
 						Lock:      releaseID.Lock().WithSHA1("correct-sha"),
@@ -197,9 +197,9 @@ stemcell_criteria:
 
 		Context("starting with no releases but all can be downloaded from their source (happy path)", func() {
 			var (
-				s3CompiledReleaseID = component.Spec{Name: "lts-compiled-release", Version: "1.2.4"}
-				s3BuiltReleaseID    = component.Spec{Name: "lts-built-release", Version: "1.3.9"}
-				boshIOReleaseID     = component.Spec{Name: "boshio-release", Version: "1.4.16"}
+				s3CompiledReleaseID = cargo.BOSHReleaseTarballSpecification{Name: "lts-compiled-release", Version: "1.2.4"}
+				s3BuiltReleaseID    = cargo.BOSHReleaseTarballSpecification{Name: "lts-built-release", Version: "1.3.9"}
+				boshIOReleaseID     = cargo.BOSHReleaseTarballSpecification{Name: "boshio-release", Version: "1.4.16"}
 			)
 			BeforeEach(func() {
 				lockContents = `---
@@ -285,7 +285,7 @@ stemcell_criteria:
   version: "4.5.6"
 `
 
-				someLocalReleaseID := component.Spec{
+				someLocalReleaseID := cargo.BOSHReleaseTarballSpecification{
 					Name:    "some-release-from-local-dir",
 					Version: "1.2.3",
 				}
@@ -305,16 +305,16 @@ stemcell_criteria:
 
 		Context("when some releases are already present in output directory", func() {
 			var (
-				missingReleaseS3CompiledID   component.Spec
+				missingReleaseS3CompiledID   cargo.BOSHReleaseTarballSpecification
 				missingReleaseS3CompiledPath = "s3-key-some-missing-release-on-s3-compiled"
-				missingReleaseBoshIOID       component.Spec
+				missingReleaseBoshIOID       cargo.BOSHReleaseTarballSpecification
 				missingReleaseBoshIOPath     = "some-other-bosh-io-key"
-				missingReleaseS3BuiltID      component.Spec
+				missingReleaseS3BuiltID      cargo.BOSHReleaseTarballSpecification
 				missingReleaseS3BuiltPath    = "s3-key-some-missing-release-on-s3-built"
 
 				missingReleaseS3Compiled,
 				missingReleaseBoshIO,
-				missingReleaseS3Built component.Lock
+				missingReleaseS3Built cargo.BOSHReleaseTarballLock
 			)
 			BeforeEach(func() {
 				lockContents = `---
@@ -348,17 +348,17 @@ stemcell_criteria:
   os: some-os
   version: "4.5.6"`
 
-				missingReleaseS3CompiledID = component.Spec{Name: "some-missing-release-on-s3-compiled", Version: "4.5.6"}
-				missingReleaseBoshIOID = component.Spec{Name: "some-missing-release-on-boshio", Version: "5.6.7"}
-				missingReleaseS3BuiltID = component.Spec{Name: "some-missing-release-on-s3-built", Version: "8.9.0"}
+				missingReleaseS3CompiledID = cargo.BOSHReleaseTarballSpecification{Name: "some-missing-release-on-s3-compiled", Version: "4.5.6"}
+				missingReleaseBoshIOID = cargo.BOSHReleaseTarballSpecification{Name: "some-missing-release-on-boshio", Version: "5.6.7"}
+				missingReleaseS3BuiltID = cargo.BOSHReleaseTarballSpecification{Name: "some-missing-release-on-s3-built", Version: "8.9.0"}
 
 				fakeLocalReleaseDirectory.GetLocalReleasesReturns([]component.Local{
 					{
-						Lock:      component.Lock{Name: "some-release", Version: "1.2.3", SHA1: "correct-sha"},
+						Lock:      cargo.BOSHReleaseTarballLock{Name: "some-release", Version: "1.2.3", SHA1: "correct-sha"},
 						LocalPath: "path/to/some/release",
 					},
 					{
-						Lock:      component.Lock{Name: "some-tiny-release", Version: "1.2.3", SHA1: "correct-sha"},
+						Lock:      cargo.BOSHReleaseTarballLock{Name: "some-tiny-release", Version: "1.2.3", SHA1: "correct-sha"},
 						LocalPath: "path/to/some/tiny/release",
 					},
 				}, nil)
@@ -420,7 +420,7 @@ stemcell_criteria:
 				BeforeEach(func() {
 					badReleasePath = filepath.Join(someReleasesDirectory, "local-path-3")
 
-					fakeS3BuiltReleaseSource.DownloadReleaseCalls(func(string, component.Lock) (component.Local, error) {
+					fakeS3BuiltReleaseSource.DownloadReleaseCalls(func(string, cargo.BOSHReleaseTarballLock) (component.Local, error) {
 						f, err := os.Create(badReleasePath)
 						Expect(err).NotTo(HaveOccurred())
 						defer closeAndIgnoreError(f)
@@ -447,8 +447,8 @@ stemcell_criteria:
 
 		Context("when there are extra releases locally that are not in the Kilnfile.lock", func() {
 			var (
-				boshIOReleaseID = component.Spec{Name: "some-release", Version: "1.2.3"}
-				localReleaseID  = component.Spec{Name: "some-extra-release", Version: "1.2.3"}
+				boshIOReleaseID = cargo.BOSHReleaseTarballSpecification{Name: "some-release", Version: "1.2.3"}
+				localReleaseID  = cargo.BOSHReleaseTarballSpecification{Name: "some-extra-release", Version: "1.2.3"}
 			)
 			BeforeEach(func() {
 				lockContents = `---
@@ -491,7 +491,7 @@ stemcell_criteria:
 					Expect(noConfirm).To(Equal(true))
 					Expect(extras).To(ConsistOf(
 						component.Local{
-							Lock:      component.Lock{Name: "some-extra-release", Version: "1.2.3", SHA1: "correct-sha"},
+							Lock:      cargo.BOSHReleaseTarballLock{Name: "some-extra-release", Version: "1.2.3", SHA1: "correct-sha"},
 							LocalPath: "path/to/some/extra/release",
 						},
 					))
diff --git a/internal/commands/find_release_version.go b/internal/commands/find_release_version.go
index 66818491e..491d29279 100644
--- a/internal/commands/find_release_version.go
+++ b/internal/commands/find_release_version.go
@@ -44,7 +44,7 @@ func (cmd *FindReleaseVersion) Execute(args []string) error {
 	}
 	releaseSource := cmd.mrsProvider(kilnfile, false)
 
-	spec, err := kilnfile.ComponentSpec(cmd.Options.Release)
+	spec, err := kilnfile.BOSHReleaseTarballSpecification(cmd.Options.Release)
 	if err != nil {
 		return err
 	}
diff --git a/internal/commands/find_release_version_test.go b/internal/commands/find_release_version_test.go
index 039b907e0..c15ca7cd3 100644
--- a/internal/commands/find_release_version_test.go
+++ b/internal/commands/find_release_version_test.go
@@ -93,7 +93,7 @@ releases:
 			})
 			When("a latest release exists", func() {
 				BeforeEach(func() {
-					fakeReleasesSource.FindReleaseVersionReturns(component.Lock{
+					fakeReleasesSource.FindReleaseVersionReturns(cargo.BOSHReleaseTarballLock{
 						Name: releaseName, Version: "74.12.5",
 						RemotePath:   "remote_url",
 						RemoteSource: "bosh.io",
@@ -127,7 +127,7 @@ releases:
 			})
 			When("a release exists", func() {
 				BeforeEach(func() {
-					fakeReleasesSource.FindReleaseVersionReturns(component.Lock{
+					fakeReleasesSource.FindReleaseVersionReturns(cargo.BOSHReleaseTarballLock{
 						Name: releaseName, Version: "74.16.5",
 						RemotePath:   "remote_url",
 						RemoteSource: "sourceId",
diff --git a/internal/commands/generate_osm_manifest.go b/internal/commands/generate_osm_manifest.go
index d3d31692d..6438bb041 100644
--- a/internal/commands/generate_osm_manifest.go
+++ b/internal/commands/generate_osm_manifest.go
@@ -236,7 +236,7 @@ func zipWalker(repoPath string, zw *zip.Writer) filepath.WalkFunc {
 	}
 }
 
-func (cmd *OSM) getReleaseLockFromBOSHIO(cs cargo.ComponentSpec) (cargo.ComponentLock, error) {
+func (cmd *OSM) getReleaseLockFromBOSHIO(cs cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 	lock, err := cmd.FindReleaseVersion(cs, true)
 	if err != nil {
 		return cmd.FindReleaseVersion(specWithoutOffline(cs), true)
@@ -244,7 +244,7 @@ func (cmd *OSM) getReleaseLockFromBOSHIO(cs cargo.ComponentSpec) (cargo.Componen
 	return lock, nil
 }
 
-func findVersionForRelease(name string, releases []cargo.ComponentLock) string {
+func findVersionForRelease(name string, releases []cargo.BOSHReleaseTarballLock) string {
 	for _, lr := range releases {
 		if lr.Name == name {
 			return lr.Version
@@ -253,15 +253,15 @@ func findVersionForRelease(name string, releases []cargo.ComponentLock) string {
 	return ""
 }
 
-func specWithoutOffline(cs cargo.ComponentSpec) cargo.ComponentSpec {
+func specWithoutOffline(cs cargo.BOSHReleaseTarballSpecification) cargo.BOSHReleaseTarballSpecification {
 	name := strings.Replace(cs.Name, "offline-", "", 1)
-	return cargo.ComponentSpec{
+	return cargo.BOSHReleaseTarballSpecification{
 		Name:    name,
 		Version: cs.Version,
 	}
 }
 
-func getURLFromLock(l cargo.ComponentLock) string {
+func getURLFromLock(l cargo.BOSHReleaseTarballLock) string {
 	url := strings.Replace(l.RemotePath, "https://bosh.io/d/github.com", "https://github.com", 1)
 	return url[:strings.Index(url, "?")]
 }
diff --git a/internal/commands/generate_osm_manifest_test.go b/internal/commands/generate_osm_manifest_test.go
index 9105d9254..e978da639 100644
--- a/internal/commands/generate_osm_manifest_test.go
+++ b/internal/commands/generate_osm_manifest_test.go
@@ -30,7 +30,7 @@ func TestOSM_Execute(t *testing.T) {
 		tmp := t.TempDir()
 		kfp := filepath.Join(tmp, "Kilnfile")
 		writeYAML(t, kfp, cargo.Kilnfile{
-			Releases: []cargo.ComponentSpec{
+			Releases: []cargo.BOSHReleaseTarballSpecification{
 				{
 					Name:             "banana",
 					GitHubRepository: "https://github.com/cloudfoundry/banana",
@@ -43,7 +43,7 @@ func TestOSM_Execute(t *testing.T) {
 
 		klp := filepath.Join(tmp, "Kilnfile.lock")
 		writeYAML(t, klp, cargo.KilnfileLock{
-			Releases: []cargo.ComponentLock{
+			Releases: []cargo.BOSHReleaseTarballLock{
 				{Name: "banana", Version: "1.2.3"},
 			},
 			Stemcell: cargo.Stemcell{
@@ -53,7 +53,7 @@ func TestOSM_Execute(t *testing.T) {
 		})
 
 		rs := new(fakes.ReleaseStorage)
-		rs.FindReleaseVersionReturns(component.Lock{}, nil)
+		rs.FindReleaseVersionReturns(cargo.BOSHReleaseTarballLock{}, nil)
 
 		outBuffer := gbytes.NewBuffer()
 		defer outBuffer.Close()
@@ -81,7 +81,7 @@ func TestOSM_Execute(t *testing.T) {
 		tmp := t.TempDir()
 		kfp := filepath.Join(tmp, "Kilnfile")
 		writeYAML(t, kfp, cargo.Kilnfile{
-			Releases: []cargo.ComponentSpec{
+			Releases: []cargo.BOSHReleaseTarballSpecification{
 				{
 					Name:             "banana",
 					GitHubRepository: "https://github.com/cloudfoundry/banana",
@@ -98,7 +98,7 @@ func TestOSM_Execute(t *testing.T) {
 
 		klp := filepath.Join(tmp, "Kilnfile.lock")
 		writeYAML(t, klp, cargo.KilnfileLock{
-			Releases: []cargo.ComponentLock{
+			Releases: []cargo.BOSHReleaseTarballLock{
 				{Name: "banana", Version: "1.2.3"},
 				{Name: "apple", Version: "1.2.4"},
 			},
@@ -109,12 +109,12 @@ func TestOSM_Execute(t *testing.T) {
 		})
 
 		rs := new(fakes.ReleaseStorage)
-		rs.FindReleaseVersionCalls(func(spec cargo.ComponentSpec, _ bool) (cargo.ComponentLock, error) {
+		rs.FindReleaseVersionCalls(func(spec cargo.BOSHReleaseTarballSpecification, _ bool) (cargo.BOSHReleaseTarballLock, error) {
 			switch spec.Name {
 			case "banana":
-				return component.Lock{}, nil
+				return cargo.BOSHReleaseTarballLock{}, nil
 			}
-			return component.Lock{}, component.ErrNotFound
+			return cargo.BOSHReleaseTarballLock{}, component.ErrNotFound
 		})
 
 		outBuffer := gbytes.NewBuffer()
@@ -135,7 +135,7 @@ func TestOSM_Execute(t *testing.T) {
 		tmp := t.TempDir()
 		kfp := filepath.Join(tmp, "Kilnfile")
 		writeYAML(t, kfp, cargo.Kilnfile{
-			Releases: []cargo.ComponentSpec{
+			Releases: []cargo.BOSHReleaseTarballSpecification{
 				{
 					Name: "lemon-offline-buildpack",
 				},
@@ -151,7 +151,7 @@ func TestOSM_Execute(t *testing.T) {
 
 		klp := filepath.Join(tmp, "Kilnfile.lock")
 		writeYAML(t, klp, cargo.KilnfileLock{
-			Releases: []cargo.ComponentLock{
+			Releases: []cargo.BOSHReleaseTarballLock{
 				{Name: "lemon-offline-buildpack", Version: "1.2.3"},
 				{Name: "banana", Version: "1.2.3"},
 			},
@@ -162,16 +162,16 @@ func TestOSM_Execute(t *testing.T) {
 		})
 
 		rs := new(fakes.ReleaseStorage)
-		rs.FindReleaseVersionCalls(func(spec cargo.ComponentSpec, _ bool) (cargo.ComponentLock, error) {
+		rs.FindReleaseVersionCalls(func(spec cargo.BOSHReleaseTarballSpecification, _ bool) (cargo.BOSHReleaseTarballLock, error) {
 			switch spec.Name {
 			case "lemon-buildpack":
-				return component.Lock{
+				return cargo.BOSHReleaseTarballLock{
 					RemotePath: "https://bosh.io/d/github.com/cloudfoundry/lemon-buildpack-release?v=1.2.3",
 				}, nil
 			case "banana":
-				return component.Lock{}, nil
+				return cargo.BOSHReleaseTarballLock{}, nil
 			}
-			return component.Lock{}, component.ErrNotFound
+			return cargo.BOSHReleaseTarballLock{}, component.ErrNotFound
 		})
 
 		outBuffer := gbytes.NewBuffer()
diff --git a/internal/commands/glaze.go b/internal/commands/glaze.go
index f269de793..a16d9b131 100644
--- a/internal/commands/glaze.go
+++ b/internal/commands/glaze.go
@@ -47,7 +47,7 @@ func (cmd *Glaze) Usage() jhanda.Usage {
 func pinVersions(kf cargo.Kilnfile, kl cargo.KilnfileLock) (cargo.Kilnfile, error) {
 	kf.Stemcell.Version = kl.Stemcell.Version
 	for releaseIndex, release := range kf.Releases {
-		l, err := kl.FindReleaseWithName(release.Name)
+		l, err := kl.FindBOSHReleaseWithName(release.Name)
 		if err != nil {
 			return cargo.Kilnfile{}, fmt.Errorf("release with name %q not found in Kilnfile.lock: %w", release.Name, err)
 		}
diff --git a/internal/commands/glaze_test.go b/internal/commands/glaze_test.go
index f3d4df631..1f9997dc6 100644
--- a/internal/commands/glaze_test.go
+++ b/internal/commands/glaze_test.go
@@ -17,7 +17,7 @@ func TestGlaze_Execute(t *testing.T) {
 		tmp := t.TempDir()
 		kfp := filepath.Join(tmp, "Kilnfile")
 		writeYAML(t, kfp, cargo.Kilnfile{
-			Releases: []cargo.ComponentSpec{
+			Releases: []cargo.BOSHReleaseTarballSpecification{
 				{Name: "banana"},
 				{Name: "orange", Version: "~ 8.0"},
 			},
@@ -28,7 +28,7 @@ func TestGlaze_Execute(t *testing.T) {
 
 		klp := filepath.Join(tmp, "Kilnfile.lock")
 		writeYAML(t, klp, cargo.KilnfileLock{
-			Releases: []cargo.ComponentLock{
+			Releases: []cargo.BOSHReleaseTarballLock{
 				{Name: "banana", Version: "1.2.3"},
 				{Name: "orange", Version: "8.0.8"},
 			},
@@ -48,7 +48,7 @@ func TestGlaze_Execute(t *testing.T) {
 		readYAML(t, kfp, &updatedKilnfile)
 
 		g.Expect(updatedKilnfile).To(Equal(cargo.Kilnfile{
-			Releases: []cargo.ComponentSpec{
+			Releases: []cargo.BOSHReleaseTarballSpecification{
 				{Name: "banana", Version: "1.2.3"},
 				{Name: "orange", Version: "8.0.8"},
 			},
@@ -114,13 +114,13 @@ func TestGlaze_Execute(t *testing.T) {
 		tmp := t.TempDir()
 		kfp := filepath.Join(tmp, "Kilnfile")
 		writeYAML(t, kfp, cargo.Kilnfile{
-			Releases: []cargo.ComponentSpec{
+			Releases: []cargo.BOSHReleaseTarballSpecification{
 				{Name: "banana"},
 			},
 		})
 		klp := filepath.Join(tmp, "Kilnfile.lock")
 		writeYAML(t, klp, cargo.KilnfileLock{
-			Releases: []cargo.ComponentLock{},
+			Releases: []cargo.BOSHReleaseTarballLock{},
 		})
 		cmd := new(Glaze)
 		err := cmd.Execute([]string{"--kilnfile", kfp})
@@ -134,13 +134,13 @@ func TestGlaze_Execute(t *testing.T) {
 
 		kfp := filepath.Join(tmp, "Kilnfile")
 		writeYAML(t, kfp, cargo.Kilnfile{
-			Releases: []cargo.ComponentSpec{
+			Releases: []cargo.BOSHReleaseTarballSpecification{
 				{Name: "banana"},
 			},
 		})
 		klp := filepath.Join(tmp, "Kilnfile.lock")
 		writeYAML(t, klp, cargo.KilnfileLock{
-			Releases: []cargo.ComponentLock{},
+			Releases: []cargo.BOSHReleaseTarballLock{},
 		})
 		cmd := new(Glaze)
 		err := cmd.Execute([]string{"--kilnfile", kfp})
diff --git a/internal/commands/release_notes_test.go b/internal/commands/release_notes_test.go
index c87149df1..a1e284428 100644
--- a/internal/commands/release_notes_test.go
+++ b/internal/commands/release_notes_test.go
@@ -87,11 +87,11 @@ func TestReleaseNotes_Execute(t *testing.T) {
 						OS: "fruit-tree", Version: "40000.2",
 					},
 					Components: []notes.BOSHReleaseData{
-						{ComponentLock: cargo.ComponentLock{Name: "banana", Version: "1.2.0"}, Releases: []*github.RepositoryRelease{
+						{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "banana", Version: "1.2.0"}, Releases: []*github.RepositoryRelease{
 							{TagName: strPtr("1.2.0"), Body: strPtr("peal\nis\nyellow")},
 							{TagName: strPtr("1.1.1"), Body: strPtr("remove from bunch")},
 						}},
-						{ComponentLock: cargo.ComponentLock{Name: "lemon", Version: "1.1.0"}},
+						{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "lemon", Version: "1.1.0"}},
 					},
 					Bumps: cargo.BumpList{
 						{Name: "banana", FromVersion: "1.1.0", ToVersion: "1.2.0"},
diff --git a/internal/commands/sync_with_local.go b/internal/commands/sync_with_local.go
index c02f4bd85..5b433eb29 100644
--- a/internal/commands/sync_with_local.go
+++ b/internal/commands/sync_with_local.go
@@ -64,38 +64,38 @@ func (command SyncWithLocal) Execute(args []string) error {
 	command.logger.Printf("Found %d releases on disk\n", len(releases))
 
 	for _, rel := range releases {
-		remotePath, err := remotePather.RemotePath(component.Spec{
-			Name:            rel.Name,
-			Version:         rel.Version,
+		remotePath, err := remotePather.RemotePath(cargo.BOSHReleaseTarballSpecification{
+			Name:            rel.Lock.Name,
+			Version:         rel.Lock.Version,
 			StemcellOS:      kilnfileLock.Stemcell.OS,
 			StemcellVersion: kilnfileLock.Stemcell.Version,
 		})
 		if err != nil {
-			return fmt.Errorf("couldn't generate a remote path for release %q: %w", rel.Name, err)
+			return fmt.Errorf("couldn't generate a remote path for release %q: %w", rel.Lock.Name, err)
 		}
 
-		var matchingRelease *cargo.ComponentLock
+		var matchingRelease *cargo.BOSHReleaseTarballLock
 		for i := range kilnfileLock.Releases {
-			if kilnfileLock.Releases[i].Name == rel.Name {
+			if kilnfileLock.Releases[i].Name == rel.Lock.Name {
 				matchingRelease = &kilnfileLock.Releases[i]
 				break
 			}
 		}
 		if matchingRelease == nil {
-			return fmt.Errorf("the local release %q does not exist in the Kilnfile.lock", rel.Name)
+			return fmt.Errorf("the local release %q does not exist in the Kilnfile.lock", rel.Lock.Name)
 		}
 
-		if command.Options.SkipSameVersion && matchingRelease.Version == rel.Version {
-			command.logger.Printf("Skipping %s. Release version hasn't changed\n", rel.Name)
+		if command.Options.SkipSameVersion && matchingRelease.Version == rel.Lock.Version {
+			command.logger.Printf("Skipping %s. Release version hasn't changed\n", rel.Lock.Name)
 			continue
 		}
 
-		matchingRelease.Version = rel.Version
-		matchingRelease.SHA1 = rel.SHA1
+		matchingRelease.Version = rel.Lock.Version
+		matchingRelease.SHA1 = rel.Lock.SHA1
 		matchingRelease.RemoteSource = command.Options.ReleaseSourceID
 		matchingRelease.RemotePath = remotePath
 
-		command.logger.Printf("Updated %s to %s\n", rel.Name, rel.Version)
+		command.logger.Printf("Updated %s to %s\n", rel.Lock.Name, rel.Lock.Version)
 	}
 
 	err = command.Options.SaveKilnfileLock(command.fs, kilnfileLock)
diff --git a/internal/commands/sync_with_local_test.go b/internal/commands/sync_with_local_test.go
index 56b37b425..9038d1b01 100644
--- a/internal/commands/sync_with_local_test.go
+++ b/internal/commands/sync_with_local_test.go
@@ -55,7 +55,7 @@ var _ = Describe("sync-with-local", func() {
 
 		BeforeEach(func() {
 			kilnfileLock = cargo.KilnfileLock{
-				Releases: []cargo.ComponentLock{
+				Releases: []cargo.BOSHReleaseTarballLock{
 					{
 						Name:         release1Name,
 						Version:      release1OldVersion,
@@ -77,11 +77,11 @@ var _ = Describe("sync-with-local", func() {
 			localReleaseDirectory = new(commandsFakes.LocalReleaseDirectory)
 			localReleaseDirectory.GetLocalReleasesReturns([]component.Local{
 				{
-					Lock:      component.Lock{Name: release1Name, Version: release1NewVersion, SHA1: release1NewSha},
+					Lock:      cargo.BOSHReleaseTarballLock{Name: release1Name, Version: release1NewVersion, SHA1: release1NewSha},
 					LocalPath: "local-path",
 				},
 				{
-					Lock:      component.Lock{Name: releaseName, Version: releaseNewVersion, SHA1: releaseNewSha},
+					Lock:      cargo.BOSHReleaseTarballLock{Name: releaseName, Version: releaseNewVersion, SHA1: releaseNewSha},
 					LocalPath: "local-path-2",
 				},
 			}, nil)
@@ -90,7 +90,7 @@ var _ = Describe("sync-with-local", func() {
 			remotePather = new(fetcherFakes.RemotePather)
 
 			remotePatherFinder.Returns(remotePather, nil)
-			remotePather.RemotePathCalls(func(requirement component.Spec) (path string, err error) {
+			remotePather.RemotePathCalls(func(requirement cargo.BOSHReleaseTarballSpecification) (path string, err error) {
 				switch requirement.Name {
 				case release1Name:
 					return release1NewRemotePath, nil
@@ -121,7 +121,7 @@ var _ = Describe("sync-with-local", func() {
 
 			var updatedLockfile cargo.KilnfileLock
 			Expect(fsReadYAML(fs, kilnfileLockPath, &updatedLockfile)).NotTo(HaveOccurred())
-			Expect(updatedLockfile.Releases).To(Equal([]cargo.ComponentLock{
+			Expect(updatedLockfile.Releases).To(Equal([]cargo.BOSHReleaseTarballLock{
 				{
 					Name:         release1Name,
 					Version:      release1NewVersion,
@@ -143,11 +143,11 @@ var _ = Describe("sync-with-local", func() {
 			BeforeEach(func() {
 				localReleaseDirectory.GetLocalReleasesReturns([]component.Local{
 					{
-						Lock:      component.Lock{Name: release1Name, Version: release1OldVersion, SHA1: release1NewSha},
+						Lock:      cargo.BOSHReleaseTarballLock{Name: release1Name, Version: release1OldVersion, SHA1: release1NewSha},
 						LocalPath: "local-path",
 					},
 					{
-						Lock:      component.Lock{Name: releaseName, Version: releaseNewVersion, SHA1: releaseNewSha},
+						Lock:      cargo.BOSHReleaseTarballLock{Name: releaseName, Version: releaseNewVersion, SHA1: releaseNewSha},
 						LocalPath: "local-path-2",
 					},
 				}, nil)
@@ -162,7 +162,7 @@ var _ = Describe("sync-with-local", func() {
 
 				var updatedLockfile cargo.KilnfileLock
 				Expect(fsReadYAML(fs, kilnfileLockPath, &updatedLockfile)).NotTo(HaveOccurred())
-				Expect(updatedLockfile.Releases).To(Equal([]cargo.ComponentLock{
+				Expect(updatedLockfile.Releases).To(Equal([]cargo.BOSHReleaseTarballLock{
 					{
 						Name:         release1Name,
 						Version:      release1OldVersion,
@@ -191,7 +191,7 @@ var _ = Describe("sync-with-local", func() {
 
 					var updatedLockfile cargo.KilnfileLock
 					Expect(fsReadYAML(fs, kilnfileLockPath, &updatedLockfile)).NotTo(HaveOccurred())
-					Expect(updatedLockfile.Releases).To(Equal([]cargo.ComponentLock{
+					Expect(updatedLockfile.Releases).To(Equal([]cargo.BOSHReleaseTarballLock{
 						{
 							Name:         release1Name,
 							Version:      release1OldVersion,
@@ -214,7 +214,7 @@ var _ = Describe("sync-with-local", func() {
 		When("a release on disk doesn't exist in the Kilnfile.lock", func() {
 			BeforeEach(func() {
 				kilnfileLock = cargo.KilnfileLock{
-					Releases: []cargo.ComponentLock{
+					Releases: []cargo.BOSHReleaseTarballLock{
 						{
 							Name:         release1Name,
 							Version:      release1OldVersion,
diff --git a/internal/commands/update_release.go b/internal/commands/update_release.go
index ffefa2666..7bb5a51e9 100644
--- a/internal/commands/update_release.go
+++ b/internal/commands/update_release.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/pivotal-cf/kiln/internal/commands/flags"
 	"github.com/pivotal-cf/kiln/internal/component"
+	"github.com/pivotal-cf/kiln/pkg/cargo"
 )
 
 type UpdateRelease struct {
@@ -45,14 +46,14 @@ func (u UpdateRelease) Execute(args []string) error {
 		return fmt.Errorf("error loading Kilnfiles: %w", err)
 	}
 
-	releaseLock, err := kilnfileLock.FindReleaseWithName(u.Options.Name)
+	releaseLock, err := kilnfileLock.FindBOSHReleaseWithName(u.Options.Name)
 	if err != nil {
 		return fmt.Errorf(
 			"no release named %q exists in your Kilnfile.lock - try removing the -release, -boshrelease, or -bosh-release suffix if present",
 			u.Options.Name,
 		)
 	}
-	releaseSpec, err := kilnfile.ComponentSpec(u.Options.Name)
+	releaseSpec, err := kilnfile.BOSHReleaseTarballSpecification(u.Options.Name)
 	if err != nil {
 		return err
 	}
@@ -67,10 +68,10 @@ func (u UpdateRelease) Execute(args []string) error {
 	u.logger.Println("Searching for the release...")
 
 	var localRelease component.Local
-	var remoteRelease component.Lock
+	var remoteRelease cargo.BOSHReleaseTarballLock
 	var newVersion, newSHA1, newSourceID, newRemotePath string
 	if u.Options.WithoutDownload {
-		remoteRelease, err = releaseSource.FindReleaseVersion(component.Spec{
+		remoteRelease, err = releaseSource.FindReleaseVersion(cargo.BOSHReleaseTarballSpecification{
 			Name:             u.Options.Name,
 			Version:          releaseVersionConstraint,
 			StemcellVersion:  kilnfileLock.Stemcell.Version,
@@ -91,7 +92,7 @@ func (u UpdateRelease) Execute(args []string) error {
 		newRemotePath = remoteRelease.RemotePath
 
 	} else {
-		remoteRelease, err = releaseSource.GetMatchedRelease(component.Spec{
+		remoteRelease, err = releaseSource.GetMatchedRelease(cargo.BOSHReleaseTarballSpecification{
 			Name:             u.Options.Name,
 			Version:          u.Options.Version,
 			StemcellOS:       kilnfileLock.Stemcell.OS,
@@ -110,8 +111,8 @@ func (u UpdateRelease) Execute(args []string) error {
 		if err != nil {
 			return fmt.Errorf("error downloading the release: %w", err)
 		}
-		newVersion = localRelease.Version
-		newSHA1 = localRelease.SHA1
+		newVersion = localRelease.Lock.Version
+		newSHA1 = localRelease.Lock.SHA1
 		newSourceID = remoteRelease.RemoteSource
 		newRemotePath = remoteRelease.RemotePath
 	}
@@ -126,7 +127,7 @@ func (u UpdateRelease) Execute(args []string) error {
 	releaseLock.RemoteSource = newSourceID
 	releaseLock.RemotePath = newRemotePath
 
-	_ = kilnfileLock.UpdateReleaseLockWithName(u.Options.Name, releaseLock)
+	_ = kilnfileLock.UpdateBOSHReleaseTarballLockWithName(u.Options.Name, releaseLock)
 
 	err = u.Options.Standard.SaveKilnfileLock(u.filesystem, kilnfileLock)
 	if err != nil {
diff --git a/internal/commands/update_release_test.go b/internal/commands/update_release_test.go
index 549d2c657..21962935c 100644
--- a/internal/commands/update_release_test.go
+++ b/internal/commands/update_release_test.go
@@ -52,7 +52,7 @@ var _ = Describe("UpdateRelease", func() {
 		logger                     *log.Logger
 		downloadedReleasePath      string
 		expectedDownloadedRelease  component.Local
-		expectedRemoteRelease      component.Lock
+		expectedRemoteRelease      cargo.BOSHReleaseTarballLock
 		kilnfileLock               cargo.KilnfileLock
 	)
 
@@ -65,7 +65,7 @@ var _ = Describe("UpdateRelease", func() {
 			filesystem = osfs.New("/tmp/")
 
 			kilnfile := cargo.Kilnfile{
-				Releases: []cargo.ComponentSpec{
+				Releases: []cargo.BOSHReleaseTarballSpecification{
 					{Name: "minecraft"},
 					{
 						Name:             releaseName,
@@ -75,7 +75,7 @@ var _ = Describe("UpdateRelease", func() {
 			}
 
 			kilnfileLock = cargo.KilnfileLock{
-				Releases: []cargo.ComponentLock{
+				Releases: []cargo.BOSHReleaseTarballLock{
 					{
 						Name:    "minecraft",
 						Version: "2.0.1",
@@ -109,11 +109,11 @@ var _ = Describe("UpdateRelease", func() {
 
 			downloadedReleasePath = filepath.Join(releasesDir, fmt.Sprintf("%s-%s.tgz", releaseName, newReleaseVersion))
 			expectedDownloadedRelease = component.Local{
-				Lock:      component.Lock{Name: releaseName, Version: newReleaseVersion, SHA1: newReleaseSha1},
+				Lock:      cargo.BOSHReleaseTarballLock{Name: releaseName, Version: newReleaseVersion, SHA1: newReleaseSha1},
 				LocalPath: downloadedReleasePath,
 			}
 			expectedRemoteRelease = expectedDownloadedRelease.Lock.WithRemote(newReleaseSourceName, newRemotePath)
-			exepectedNotDownloadedRelease := component.Lock{
+			exepectedNotDownloadedRelease := cargo.BOSHReleaseTarballLock{
 				Name:         releaseName,
 				Version:      notDownloadedReleaseVersion,
 				RemotePath:   notDownloadedRemotePath,
@@ -143,7 +143,7 @@ var _ = Describe("UpdateRelease", func() {
 				Expect(releaseSource.GetMatchedReleaseCallCount()).To(Equal(1))
 
 				receivedReleaseRequirement := releaseSource.GetMatchedReleaseArgsForCall(0)
-				releaseRequirement := component.Spec{
+				releaseRequirement := cargo.BOSHReleaseTarballSpecification{
 					Name:             releaseName,
 					Version:          newReleaseVersion,
 					StemcellOS:       "some-os",
@@ -173,7 +173,7 @@ var _ = Describe("UpdateRelease", func() {
 				Expect(err).NotTo(HaveOccurred())
 				Expect(updatedLockfile.Releases).To(HaveLen(2))
 				Expect(updatedLockfile.Releases).To(ContainElement(
-					cargo.ComponentLock{
+					cargo.BOSHReleaseTarballLock{
 						Name:    releaseName,
 						Version: newReleaseVersion,
 
@@ -228,10 +228,10 @@ var _ = Describe("UpdateRelease", func() {
 
 			BeforeEach(func() {
 				expectedDownloadedRelease = component.Local{
-					Lock:      component.Lock{Name: releaseName, Version: oldReleaseVersion, SHA1: oldReleaseSha1},
+					Lock:      cargo.BOSHReleaseTarballLock{Name: releaseName, Version: oldReleaseVersion, SHA1: oldReleaseSha1},
 					LocalPath: "not-used",
 				}
-				expectedRemoteRelease = component.Lock{
+				expectedRemoteRelease = cargo.BOSHReleaseTarballLock{
 					Name: releaseName, Version: oldReleaseVersion,
 					RemotePath:   oldRemotePath,
 					RemoteSource: oldReleaseSourceName,
@@ -315,7 +315,7 @@ var _ = Describe("UpdateRelease", func() {
 
 		When("the release can't be found", func() {
 			BeforeEach(func() {
-				releaseSource.GetMatchedReleaseReturns(component.Lock{}, component.ErrNotFound)
+				releaseSource.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
 			})
 
 			It("errors", func() {
@@ -392,7 +392,7 @@ var _ = Describe("UpdateRelease", func() {
 				Expect(err).NotTo(HaveOccurred())
 
 				receivedReleaseRequirement, _ := releaseSource.FindReleaseVersionArgsForCall(0)
-				releaseRequirement := component.Spec{
+				releaseRequirement := cargo.BOSHReleaseTarballSpecification{
 					Name:             releaseName,
 					Version:          newReleaseVersion,
 					StemcellOS:       "some-os",
@@ -408,7 +408,7 @@ var _ = Describe("UpdateRelease", func() {
 				Expect(err).NotTo(HaveOccurred())
 				Expect(updatedLockfile.Releases).To(HaveLen(2))
 				Expect(updatedLockfile.Releases).To(ContainElement(
-					cargo.ComponentLock{
+					cargo.BOSHReleaseTarballLock{
 						Name:         releaseName,
 						Version:      notDownloadedReleaseVersion,
 						SHA1:         notDownloadedReleaseSha1,
diff --git a/internal/commands/update_stemcell.go b/internal/commands/update_stemcell.go
index 25851fb03..bf753a97c 100644
--- a/internal/commands/update_stemcell.go
+++ b/internal/commands/update_stemcell.go
@@ -70,7 +70,7 @@ func (update UpdateStemcell) Execute(args []string) error {
 	for i, rel := range kilnfileLock.Releases {
 		update.Logger.Printf("Updating release %q with stemcell %s %s...", rel.Name, kilnfileLock.Stemcell.OS, trimmedInputVersion)
 
-		spec, err := kilnfile.ComponentSpec(rel.Name)
+		spec, err := kilnfile.BOSHReleaseTarballSpecification(rel.Name)
 		if err != nil {
 			return err
 		}
@@ -97,7 +97,7 @@ func (update UpdateStemcell) Execute(args []string) error {
 		}
 
 		lock := &kilnfileLock.Releases[i]
-		lock.SHA1 = local.SHA1
+		lock.SHA1 = local.Lock.SHA1
 		lock.RemotePath = remote.RemotePath
 		lock.RemoteSource = remote.RemoteSource
 	}
diff --git a/internal/commands/update_stemcell_test.go b/internal/commands/update_stemcell_test.go
index 3f5138148..612b6859e 100644
--- a/internal/commands/update_stemcell_test.go
+++ b/internal/commands/update_stemcell_test.go
@@ -65,13 +65,13 @@ var _ = Describe("UpdateStemcell", func() {
 					OS:      "old-os",
 					Version: "^1",
 				},
-				Releases: []cargo.ComponentSpec{
+				Releases: []cargo.BOSHReleaseTarballSpecification{
 					{Name: release1Name, GitHubRepository: "https://example.com/lemon"},
 					{Name: release2Name, GitHubRepository: "https://example.com/orange"},
 				},
 			}
 			kilnfileLock = cargo.KilnfileLock{
-				Releases: []cargo.ComponentLock{
+				Releases: []cargo.BOSHReleaseTarballLock{
 					{
 						Name:         release1Name,
 						Version:      release1Version,
@@ -94,17 +94,17 @@ var _ = Describe("UpdateStemcell", func() {
 			}
 
 			releaseSource = new(fetcherFakes.MultiReleaseSource)
-			releaseSource.GetMatchedReleaseCalls(func(requirement component.Spec) (component.Lock, error) {
+			releaseSource.GetMatchedReleaseCalls(func(requirement cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 				switch requirement.Name {
 				case release1Name:
-					remote := component.Lock{
+					remote := cargo.BOSHReleaseTarballLock{
 						Name: release1Name, Version: release1Version,
 						RemotePath:   newRelease1RemotePath,
 						RemoteSource: publishableReleaseSourceID,
 					}
 					return remote, nil
 				case release2Name:
-					remote := component.Lock{
+					remote := cargo.BOSHReleaseTarballLock{
 						Name: release2Name, Version: release2Version,
 						RemotePath:   newRelease2RemotePath,
 						RemoteSource: unpublishableReleaseSourceID,
@@ -115,17 +115,17 @@ var _ = Describe("UpdateStemcell", func() {
 				}
 			})
 
-			releaseSource.DownloadReleaseCalls(func(_ string, remote component.Lock) (component.Local, error) {
+			releaseSource.DownloadReleaseCalls(func(_ string, remote cargo.BOSHReleaseTarballLock) (component.Local, error) {
 				switch remote.Name {
 				case release1Name:
 					local := component.Local{
-						Lock:      component.Lock{Name: release1Name, Version: release1Version, SHA1: newRelease1SHA},
+						Lock:      cargo.BOSHReleaseTarballLock{Name: release1Name, Version: release1Version, SHA1: newRelease1SHA},
 						LocalPath: "not-used",
 					}
 					return local, nil
 				case release2Name:
 					local := component.Local{
-						Lock:      component.Lock{Name: release2Name, Version: release2Version, SHA1: newRelease2SHA},
+						Lock:      cargo.BOSHReleaseTarballLock{Name: release2Name, Version: release2Version, SHA1: newRelease2SHA},
 						LocalPath: "not-used",
 					}
 					return local, nil
@@ -173,7 +173,7 @@ var _ = Describe("UpdateStemcell", func() {
 			}))
 			Expect(updatedLockfile.Releases).To(HaveLen(2))
 			Expect(updatedLockfile.Releases).To(ContainElement(
-				cargo.ComponentLock{
+				cargo.BOSHReleaseTarballLock{
 					Name:         release1Name,
 					Version:      release1Version,
 					SHA1:         newRelease1SHA,
@@ -182,7 +182,7 @@ var _ = Describe("UpdateStemcell", func() {
 				},
 			))
 			Expect(updatedLockfile.Releases).To(ContainElement(
-				cargo.ComponentLock{
+				cargo.BOSHReleaseTarballLock{
 					Name:         release2Name,
 					Version:      release2Version,
 					SHA1:         newRelease2SHA,
@@ -201,14 +201,14 @@ var _ = Describe("UpdateStemcell", func() {
 			Expect(releaseSource.GetMatchedReleaseCallCount()).To(Equal(2))
 
 			req1 := releaseSource.GetMatchedReleaseArgsForCall(0)
-			Expect(req1).To(Equal(component.Spec{
+			Expect(req1).To(Equal(cargo.BOSHReleaseTarballSpecification{
 				Name: release1Name, Version: release1Version,
 				StemcellOS: newStemcellOS, StemcellVersion: newStemcellVersion,
 				GitHubRepository: "https://example.com/lemon",
 			}))
 
 			req2 := releaseSource.GetMatchedReleaseArgsForCall(1)
-			Expect(req2).To(Equal(component.Spec{
+			Expect(req2).To(Equal(cargo.BOSHReleaseTarballSpecification{
 				Name: release2Name, Version: release2Version,
 				StemcellOS: newStemcellOS, StemcellVersion: newStemcellVersion,
 				GitHubRepository: "https://example.com/orange",
@@ -226,7 +226,7 @@ var _ = Describe("UpdateStemcell", func() {
 			actualDir, remote1 := releaseSource.DownloadReleaseArgsForCall(0)
 			Expect(actualDir).To(Equal(releasesDirPath))
 			Expect(remote1).To(Equal(
-				component.Lock{
+				cargo.BOSHReleaseTarballLock{
 					Name: release1Name, Version: release1Version,
 					RemotePath:   newRelease1RemotePath,
 					RemoteSource: publishableReleaseSourceID,
@@ -236,7 +236,7 @@ var _ = Describe("UpdateStemcell", func() {
 			actualDir, remote2 := releaseSource.DownloadReleaseArgsForCall(1)
 			Expect(actualDir).To(Equal(releasesDirPath))
 			Expect(remote2).To(Equal(
-				component.Lock{
+				cargo.BOSHReleaseTarballLock{
 					Name: release2Name, Version: release2Version,
 					RemotePath:   newRelease2RemotePath,
 					RemoteSource: unpublishableReleaseSourceID,
@@ -346,7 +346,7 @@ var _ = Describe("UpdateStemcell", func() {
 
 				Expect(updatedLockfile.Releases).To(HaveLen(2))
 				Expect(updatedLockfile.Releases).To(ContainElement(
-					cargo.ComponentLock{
+					cargo.BOSHReleaseTarballLock{
 						Name:         release1Name,
 						Version:      release1Version,
 						SHA1:         newRelease1SHA,
@@ -355,7 +355,7 @@ var _ = Describe("UpdateStemcell", func() {
 					},
 				))
 				Expect(updatedLockfile.Releases).To(ContainElement(
-					cargo.ComponentLock{
+					cargo.BOSHReleaseTarballLock{
 						Name:         release2Name,
 						Version:      release2Version,
 						SHA1:         newRelease2SHA,
@@ -387,7 +387,7 @@ var _ = Describe("UpdateStemcell", func() {
 
 		When("the release can't be found", func() {
 			BeforeEach(func() {
-				releaseSource.GetMatchedReleaseReturns(component.Lock{}, component.ErrNotFound)
+				releaseSource.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
 			})
 
 			It("errors", func() {
@@ -402,7 +402,7 @@ var _ = Describe("UpdateStemcell", func() {
 
 		When("finding the release errors", func() {
 			BeforeEach(func() {
-				releaseSource.GetMatchedReleaseReturns(component.Lock{}, errors.New("big badda boom"))
+				releaseSource.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, errors.New("big badda boom"))
 			})
 
 			It("errors", func() {
diff --git a/internal/commands/upload_release.go b/internal/commands/upload_release.go
index 4005f810d..27912143e 100644
--- a/internal/commands/upload_release.go
+++ b/internal/commands/upload_release.go
@@ -71,7 +71,7 @@ func (command UploadRelease) Execute(args []string) error {
 		return fmt.Errorf("cannot upload development release %q - only finalized releases are allowed", manifest.Version)
 	}
 
-	requirement := component.Spec{Name: manifest.Name, Version: manifest.Version}
+	requirement := cargo.BOSHReleaseTarballSpecification{Name: manifest.Name, Version: manifest.Version}
 	_, err = releaseUploader.GetMatchedRelease(requirement)
 
 	if err != nil {
@@ -83,7 +83,7 @@ func (command UploadRelease) Execute(args []string) error {
 			manifest.Name, manifest.Version, command.Options.UploadTargetID)
 	}
 
-	_, err = releaseUploader.UploadRelease(component.Spec{
+	_, err = releaseUploader.UploadRelease(cargo.BOSHReleaseTarballSpecification{
 		Name:    manifest.Name,
 		Version: manifest.Version,
 	}, file)
diff --git a/internal/commands/upload_release_test.go b/internal/commands/upload_release_test.go
index 9b960efa0..be16a1bd7 100644
--- a/internal/commands/upload_release_test.go
+++ b/internal/commands/upload_release_test.go
@@ -37,7 +37,7 @@ var _ = Describe("UploadRelease", func() {
 			fs = memfs.New()
 
 			releaseUploader = new(fakes.ReleaseUploader)
-			releaseUploader.GetMatchedReleaseReturns(component.Lock{}, component.ErrNotFound)
+			releaseUploader.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
 			releaseUploaderFinder = new(commandsFakes.ReleaseUploaderFinder)
 			releaseUploaderFinder.Returns(releaseUploader, nil)
 
@@ -80,7 +80,7 @@ var _ = Describe("UploadRelease", func() {
 
 			When("the release already exists on the release source", func() {
 				BeforeEach(func() {
-					releaseUploader.GetMatchedReleaseReturns(component.Lock{
+					releaseUploader.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{
 						Name: "banana", Version: "1.2.3",
 						RemotePath:   "banana/banana-1.2.3.tgz",
 						RemoteSource: "orange-bucket",
@@ -97,7 +97,7 @@ var _ = Describe("UploadRelease", func() {
 					Expect(releaseUploader.GetMatchedReleaseCallCount()).To(Equal(1))
 
 					requirement := releaseUploader.GetMatchedReleaseArgsForCall(0)
-					Expect(requirement).To(Equal(component.Spec{Name: "banana", Version: "1.2.3"}))
+					Expect(requirement).To(Equal(cargo.BOSHReleaseTarballSpecification{Name: "banana", Version: "1.2.3"}))
 
 					Expect(releaseUploader.UploadReleaseCallCount()).To(Equal(0))
 				})
@@ -210,7 +210,7 @@ compiled_packages:
 
 		When("querying the release source fails", func() {
 			BeforeEach(func() {
-				releaseUploader.GetMatchedReleaseReturns(component.Lock{}, errors.New("boom"))
+				releaseUploader.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, errors.New("boom"))
 			})
 
 			It("returns an error", func() {
@@ -233,7 +233,7 @@ compiled_packages:
 
 		When("the upload fails", func() {
 			BeforeEach(func() {
-				releaseUploader.UploadReleaseReturns(component.Lock{}, errors.New("boom"))
+				releaseUploader.UploadReleaseReturns(cargo.BOSHReleaseTarballLock{}, errors.New("boom"))
 			})
 
 			It("returns an error", func() {
diff --git a/internal/component/artifactory.go b/internal/component/artifactory.go
index 180f9b5d6..cd5d487d3 100644
--- a/internal/component/artifactory.go
+++ b/internal/component/artifactory.go
@@ -67,7 +67,7 @@ func NewArtifactoryReleaseSource(c cargo.ReleaseSourceConfig) *ArtifactoryReleas
 	}
 }
 
-func (ars *ArtifactoryReleaseSource) DownloadRelease(releaseDir string, remoteRelease Lock) (Local, error) {
+func (ars *ArtifactoryReleaseSource) DownloadRelease(releaseDir string, remoteRelease cargo.BOSHReleaseTarballLock) (Local, error) {
 	downloadURL := ars.ArtifactoryHost + "/artifactory/" + ars.Repo + "/" + remoteRelease.RemotePath
 	ars.logger.Printf(logLineDownload, remoteRelease.Name, ReleaseSourceTypeArtifactory, ars.ID)
 	resp, err := ars.Client.Get(downloadURL)
@@ -109,7 +109,7 @@ func (ars *ArtifactoryReleaseSource) DownloadRelease(releaseDir string, remoteRe
 	return Local{Lock: remoteRelease, LocalPath: filePath}, nil
 }
 
-func (ars *ArtifactoryReleaseSource) getFileSHA1(release Lock) (string, error) {
+func (ars *ArtifactoryReleaseSource) getFileSHA1(release cargo.BOSHReleaseTarballLock) (string, error) {
 	fullURL := ars.ArtifactoryHost + "/api/storage/" + ars.Repo + "/" + release.RemotePath
 	ars.logger.Printf("Getting %s file info from artifactory", release.Name)
 	resp, err := ars.Client.Get(fullURL)
@@ -140,21 +140,21 @@ func (ars *ArtifactoryReleaseSource) Configuration() cargo.ReleaseSourceConfig {
 
 // GetMatchedRelease uses the Name and Version and if supported StemcellOS and StemcellVersion
 // fields on Requirement to download a specific release.
-func (ars *ArtifactoryReleaseSource) GetMatchedRelease(spec Spec) (Lock, error) {
+func (ars *ArtifactoryReleaseSource) GetMatchedRelease(spec cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 	remotePath, err := ars.RemotePath(spec)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	fullUrl := fmt.Sprintf("%s/%s/%s/%s", ars.ArtifactoryHost, "api/storage", ars.Repo, remotePath)
 	request, err := http.NewRequest(http.MethodGet, fullUrl, nil)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	response, err := ars.Client.Do(request)
 	if err != nil {
-		return Lock{}, wrapVPNError(err)
+		return cargo.BOSHReleaseTarballLock{}, wrapVPNError(err)
 	}
 	defer func() {
 		_ = response.Body.Close()
@@ -163,12 +163,12 @@ func (ars *ArtifactoryReleaseSource) GetMatchedRelease(spec Spec) (Lock, error)
 	switch response.StatusCode {
 	case http.StatusOK:
 	case http.StatusNotFound:
-		return Lock{}, ErrNotFound
+		return cargo.BOSHReleaseTarballLock{}, ErrNotFound
 	default:
-		return Lock{}, fmt.Errorf("unexpected http status: %s", http.StatusText(response.StatusCode))
+		return cargo.BOSHReleaseTarballLock{}, fmt.Errorf("unexpected http status: %s", http.StatusText(response.StatusCode))
 	}
 
-	return Lock{
+	return cargo.BOSHReleaseTarballLock{
 		Name:         spec.Name,
 		Version:      spec.Version,
 		RemotePath:   remotePath,
@@ -178,22 +178,22 @@ func (ars *ArtifactoryReleaseSource) GetMatchedRelease(spec Spec) (Lock, error)
 
 // FindReleaseVersion may use any of the fields on Requirement to return the best matching
 // release.
-func (ars *ArtifactoryReleaseSource) FindReleaseVersion(spec Spec, _ bool) (Lock, error) {
+func (ars *ArtifactoryReleaseSource) FindReleaseVersion(spec cargo.BOSHReleaseTarballSpecification, _ bool) (cargo.BOSHReleaseTarballLock, error) {
 	remotePath, err := ars.RemotePath(spec)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	fullUrl := fmt.Sprintf("%s/%s/%s/%s", ars.ArtifactoryHost, "api/storage", ars.Repo, path.Dir(remotePath))
 
 	request, err := http.NewRequest(http.MethodGet, fullUrl, nil)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	response, err := ars.Client.Do(request)
 	if err != nil {
-		return Lock{}, wrapVPNError(err)
+		return cargo.BOSHReleaseTarballLock{}, wrapVPNError(err)
 	}
 	defer func() {
 		_ = response.Body.Close()
@@ -202,9 +202,9 @@ func (ars *ArtifactoryReleaseSource) FindReleaseVersion(spec Spec, _ bool) (Lock
 	switch response.StatusCode {
 	case http.StatusOK:
 	case http.StatusNotFound:
-		return Lock{}, ErrNotFound
+		return cargo.BOSHReleaseTarballLock{}, ErrNotFound
 	default:
-		return Lock{}, fmt.Errorf("unexpected http status: %s", http.StatusText(response.StatusCode))
+		return cargo.BOSHReleaseTarballLock{}, fmt.Errorf("unexpected http status: %s", http.StatusText(response.StatusCode))
 	}
 
 	var artifactoryFolderInfo ArtifactoryFolderInfo
@@ -212,22 +212,22 @@ func (ars *ArtifactoryReleaseSource) FindReleaseVersion(spec Spec, _ bool) (Lock
 
 	responseBody, err := io.ReadAll(response.Body)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	if err := json.Unmarshal(responseBody, &artifactoryFolderInfo); err != nil {
-		return Lock{}, fmt.Errorf("json from %s is malformed: %s", request.URL.Host, err)
+		return cargo.BOSHReleaseTarballLock{}, fmt.Errorf("json from %s is malformed: %s", request.URL.Host, err)
 	}
 
 	semverPattern, err := regexp.Compile(`([-v])\d+(.\d+)*`)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
-	foundRelease := Lock{}
+	foundRelease := cargo.BOSHReleaseTarballLock{}
 	constraint, err := spec.VersionConstraints()
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	for _, releases := range artifactoryFolderInfo.Children {
@@ -251,8 +251,8 @@ func (ars *ArtifactoryReleaseSource) FindReleaseVersion(spec Spec, _ bool) (Lock
 
 			remotePathToUpdate := path.Dir(remotePath) + releases.URI
 
-			if (foundRelease == Lock{}) {
-				foundRelease = Lock{
+			if (foundRelease == cargo.BOSHReleaseTarballLock{}) {
+				foundRelease = cargo.BOSHReleaseTarballLock{
 					Name:         spec.Name,
 					Version:      version,
 					RemotePath:   remotePathToUpdate,
@@ -261,7 +261,7 @@ func (ars *ArtifactoryReleaseSource) FindReleaseVersion(spec Spec, _ bool) (Lock
 			} else {
 				foundVersion, _ := semver.NewVersion(foundRelease.Version)
 				if newVersion.GreaterThan(foundVersion) {
-					foundRelease = Lock{
+					foundRelease = cargo.BOSHReleaseTarballLock{
 						Name:         spec.Name,
 						Version:      version,
 						RemotePath:   remotePathToUpdate,
@@ -272,20 +272,20 @@ func (ars *ArtifactoryReleaseSource) FindReleaseVersion(spec Spec, _ bool) (Lock
 		}
 	}
 
-	if (foundRelease == Lock{}) {
-		return Lock{}, ErrNotFound
+	if (foundRelease == cargo.BOSHReleaseTarballLock{}) {
+		return cargo.BOSHReleaseTarballLock{}, ErrNotFound
 	}
 	foundRelease.SHA1, err = ars.getFileSHA1(foundRelease)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 	return foundRelease, nil
 }
 
-func (ars *ArtifactoryReleaseSource) UploadRelease(spec Spec, file io.Reader) (Lock, error) {
+func (ars *ArtifactoryReleaseSource) UploadRelease(spec cargo.BOSHReleaseTarballSpecification, file io.Reader) (cargo.BOSHReleaseTarballLock, error) {
 	remotePath, err := ars.RemotePath(spec)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	ars.logger.Printf("uploading release %q to %s at %q...\n", spec.Name, ars.ID, remotePath)
@@ -295,7 +295,7 @@ func (ars *ArtifactoryReleaseSource) UploadRelease(spec Spec, file io.Reader) (L
 	request, err := http.NewRequest(http.MethodPut, fullUrl, file)
 	if err != nil {
 		fmt.Println(err)
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 	request.SetBasicAuth(ars.Username, ars.Password)
 	// TODO: check Sha1/2
@@ -303,16 +303,16 @@ func (ars *ArtifactoryReleaseSource) UploadRelease(spec Spec, file io.Reader) (L
 
 	response, err := ars.Client.Do(request)
 	if err != nil {
-		return Lock{}, wrapVPNError(err)
+		return cargo.BOSHReleaseTarballLock{}, wrapVPNError(err)
 	}
 
 	switch response.StatusCode {
 	case http.StatusCreated:
 	default:
-		return Lock{}, fmt.Errorf(response.Status)
+		return cargo.BOSHReleaseTarballLock{}, fmt.Errorf(response.Status)
 	}
 
-	return Lock{
+	return cargo.BOSHReleaseTarballLock{
 		Name:         spec.Name,
 		Version:      spec.Version,
 		RemotePath:   remotePath,
@@ -320,7 +320,7 @@ func (ars *ArtifactoryReleaseSource) UploadRelease(spec Spec, file io.Reader) (L
 	}, nil
 }
 
-func (ars *ArtifactoryReleaseSource) RemotePath(spec Spec) (string, error) {
+func (ars *ArtifactoryReleaseSource) RemotePath(spec cargo.BOSHReleaseTarballSpecification) (string, error) {
 	pathBuf := new(bytes.Buffer)
 
 	err := ars.pathTemplate().Execute(pathBuf, spec)
diff --git a/internal/component/artifactory_test.go b/internal/component/artifactory_test.go
index 80ccfef20..01eb81430 100644
--- a/internal/component/artifactory_test.go
+++ b/internal/component/artifactory_test.go
@@ -87,7 +87,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 		})
 		When("the server has the a file at the expected path", func() {
 			It("resolves the lock from the spec", func() { // testing GetMatchedRelease
-				resultLock, resultErr := source.GetMatchedRelease(component.Spec{
+				resultLock, resultErr := source.GetMatchedRelease(cargo.BOSHReleaseTarballSpecification{
 					Name:            "mango",
 					Version:         "2.3.4",
 					StemcellOS:      "smoothie",
@@ -95,7 +95,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 				})
 
 				Expect(resultErr).NotTo(HaveOccurred())
-				Expect(resultLock).To(Equal(component.Lock{
+				Expect(resultLock).To(Equal(cargo.BOSHReleaseTarballLock{
 					Name:    "mango",
 					Version: "2.3.4",
 					// StemcellOS:      "smoothie",
@@ -106,7 +106,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 			})
 
 			It("finds the bosh release", func() { // testing FindReleaseVersion
-				resultLock, resultErr := source.FindReleaseVersion(component.Spec{
+				resultLock, resultErr := source.FindReleaseVersion(cargo.BOSHReleaseTarballSpecification{
 					Name:            "mango",
 					Version:         "2.3.4",
 					StemcellOS:      "smoothie",
@@ -114,7 +114,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 				}, false)
 
 				Expect(resultErr).NotTo(HaveOccurred())
-				Expect(resultLock).To(Equal(component.Lock{
+				Expect(resultLock).To(Equal(cargo.BOSHReleaseTarballLock{
 					Name:    "mango",
 					Version: "2.3.4",
 					// StemcellOS:      "smoothie",
@@ -127,7 +127,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 
 			It("downloads the release", func() { // teesting DownloadRelease
 				By("calling FindReleaseVersion")
-				local, resultErr := source.DownloadRelease(releasesDirectory, component.Lock{
+				local, resultErr := source.DownloadRelease(releasesDirectory, cargo.BOSHReleaseTarballLock{
 					Name:         "mango",
 					Version:      "2.3.4",
 					RemotePath:   "bosh-releases/smoothie/9.9/mango/mango-2.3.4-smoothie-9.9.tgz",
@@ -168,7 +168,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 			Expect(err).NotTo(HaveOccurred())
 			defer closeAndIgnoreError(f)
 
-			resultLock, resultErr := source.UploadRelease(component.Spec{
+			resultLock, resultErr := source.UploadRelease(cargo.BOSHReleaseTarballSpecification{
 				Name:            "mango",
 				Version:         "2.3.4",
 				StemcellOS:      "smoothie",
@@ -176,7 +176,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 			}, f)
 
 			Expect(resultErr).NotTo(HaveOccurred())
-			Expect(resultLock).To(Equal(component.Lock{
+			Expect(resultLock).To(Equal(cargo.BOSHReleaseTarballLock{
 				Name:    "mango",
 				Version: "2.3.4",
 				// StemcellOS:      "smoothie",
@@ -195,7 +195,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 		})
 		Describe("GetMatchedRelease", func() {
 			It("returns a helpful message", func() {
-				_, resultErr := source.GetMatchedRelease(component.Spec{
+				_, resultErr := source.GetMatchedRelease(cargo.BOSHReleaseTarballSpecification{
 					Name:            "mango",
 					Version:         "2.3.4",
 					StemcellOS:      "smoothie",
@@ -207,7 +207,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 		})
 		Describe("FindReleaseVersion", func() {
 			It("returns a helpful message", func() {
-				_, resultErr := source.FindReleaseVersion(component.Spec{
+				_, resultErr := source.FindReleaseVersion(cargo.BOSHReleaseTarballSpecification{
 					Name:            "mango",
 					Version:         "2.3.4",
 					StemcellOS:      "smoothie",
@@ -219,7 +219,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 		})
 		Describe("DownloadRelease", func() {
 			It("returns a helpful message", func() {
-				_, resultErr := source.DownloadRelease(releasesDirectory, component.Lock{
+				_, resultErr := source.DownloadRelease(releasesDirectory, cargo.BOSHReleaseTarballLock{
 					Name:         "mango",
 					Version:      "2.3.4",
 					RemotePath:   "bosh-releases/smoothie/9.9/mango/mango-2.3.4-smoothie-9.9.tgz",
@@ -231,7 +231,7 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 		})
 		Describe("UploadRelease", func() {
 			It("returns a helpful message", func() {
-				_, resultErr := source.UploadRelease(component.Spec{
+				_, resultErr := source.UploadRelease(cargo.BOSHReleaseTarballSpecification{
 					Name:            "mango",
 					Version:         "2.3.4",
 					StemcellOS:      "smoothie",
diff --git a/internal/component/bosh_io_release_source.go b/internal/component/bosh_io_release_source.go
index 79e91d240..fdebda265 100644
--- a/internal/component/bosh_io_release_source.go
+++ b/internal/component/bosh_io_release_source.go
@@ -77,13 +77,13 @@ func (src BOSHIOReleaseSource) Configuration() cargo.ReleaseSourceConfig {
 	return src.ReleaseSourceConfig
 }
 
-func unsetStemcell(spec cargo.ComponentSpec) cargo.ComponentSpec {
+func unsetStemcell(spec cargo.BOSHReleaseTarballSpecification) cargo.BOSHReleaseTarballSpecification {
 	spec.StemcellOS = ""
 	spec.StemcellVersion = ""
 	return spec
 }
 
-func (src BOSHIOReleaseSource) GetMatchedRelease(requirement Spec) (Lock, error) {
+func (src BOSHIOReleaseSource) GetMatchedRelease(requirement cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 	requirement = unsetStemcell(requirement)
 
 	for _, repo := range repos {
@@ -91,7 +91,7 @@ func (src BOSHIOReleaseSource) GetMatchedRelease(requirement Spec) (Lock, error)
 			fullName := repo + "/" + requirement.Name + suf
 			exists, err := src.releaseExistOnBoshio(fullName, requirement.Version)
 			if err != nil {
-				return Lock{}, err
+				return cargo.BOSHReleaseTarballLock{}, err
 			}
 
 			if exists {
@@ -100,15 +100,15 @@ func (src BOSHIOReleaseSource) GetMatchedRelease(requirement Spec) (Lock, error)
 			}
 		}
 	}
-	return Lock{}, ErrNotFound
+	return cargo.BOSHReleaseTarballLock{}, ErrNotFound
 }
 
-func (src BOSHIOReleaseSource) FindReleaseVersion(spec Spec, _ bool) (Lock, error) {
+func (src BOSHIOReleaseSource) FindReleaseVersion(spec cargo.BOSHReleaseTarballSpecification, _ bool) (cargo.BOSHReleaseTarballLock, error) {
 	spec = unsetStemcell(spec)
 
 	constraint, err := spec.VersionConstraints()
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	var validReleases []releaseResponse
@@ -118,7 +118,7 @@ func (src BOSHIOReleaseSource) FindReleaseVersion(spec Spec, _ bool) (Lock, erro
 			fullName := repo + "/" + spec.Name + suf
 			releaseResponses, err := src.getReleases(fullName)
 			if err != nil {
-				return Lock{}, err
+				return cargo.BOSHReleaseTarballLock{}, err
 			}
 
 			for _, release := range releaseResponses {
@@ -136,10 +136,10 @@ func (src BOSHIOReleaseSource) FindReleaseVersion(spec Spec, _ bool) (Lock, erro
 			return lock, nil
 		}
 	}
-	return Lock{}, ErrNotFound
+	return cargo.BOSHReleaseTarballLock{}, ErrNotFound
 }
 
-func (src BOSHIOReleaseSource) DownloadRelease(releaseDir string, remoteRelease Lock) (Local, error) {
+func (src BOSHIOReleaseSource) DownloadRelease(releaseDir string, remoteRelease cargo.BOSHReleaseTarballLock) (Local, error) {
 	src.logger.Printf(logLineDownload, remoteRelease.Name, ReleaseSourceTypeBOSHIO, src.ID())
 
 	downloadURL := remoteRelease.RemotePath
@@ -185,7 +185,7 @@ func (err ResponseStatusCodeError) Error() string {
 	return fmt.Sprintf("response to %s %s got status %d when a success was expected", err.Request.Method, err.Request.URL, err.StatusCode)
 }
 
-func (src BOSHIOReleaseSource) createReleaseRemote(spec Spec, fullName string) Lock {
+func (src BOSHIOReleaseSource) createReleaseRemote(spec cargo.BOSHReleaseTarballSpecification, fullName string) cargo.BOSHReleaseTarballLock {
 	downloadURL := fmt.Sprintf("%s/d/github.com/%s?v=%s", src.serverURI, fullName, spec.Version)
 	releaseRemote := spec.Lock()
 	releaseRemote.RemoteSource = src.ID()
diff --git a/internal/component/bosh_io_release_source_test.go b/internal/component/bosh_io_release_source_test.go
index 44d14c52d..a9c7bcc2d 100644
--- a/internal/component/bosh_io_release_source_test.go
+++ b/internal/component/bosh_io_release_source_test.go
@@ -62,14 +62,14 @@ var _ = Describe("BOSHIOReleaseSource", func() {
 			It("finds built releases which exist on bosh.io", func() {
 				os := "ubuntu-xenial"
 				version := "190.0.0"
-				uaaRequirement := component.Spec{Name: "uaa", Version: "73.3.0", StemcellOS: os, StemcellVersion: version}
-				rabbitmqRequirement := component.Spec{Name: "cf-rabbitmq", Version: "268.0.0", StemcellOS: os, StemcellVersion: version}
+				uaaRequirement := cargo.BOSHReleaseTarballSpecification{Name: "uaa", Version: "73.3.0", StemcellOS: os, StemcellVersion: version}
+				rabbitmqRequirement := cargo.BOSHReleaseTarballSpecification{Name: "cf-rabbitmq", Version: "268.0.0", StemcellOS: os, StemcellVersion: version}
 
 				foundRelease, err := releaseSource.GetMatchedRelease(uaaRequirement)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(component.IsErrNotFound(err)).To(BeFalse())
 				uaaURL := fmt.Sprintf("%s/d/github.com/cloudfoundry/uaa-release?v=73.3.0", testServer.URL())
-				Expect(foundRelease).To(Equal(component.Lock{
+				Expect(foundRelease).To(Equal(cargo.BOSHReleaseTarballLock{
 					Name:         "uaa",
 					Version:      "73.3.0",
 					RemotePath:   uaaURL,
@@ -80,7 +80,7 @@ var _ = Describe("BOSHIOReleaseSource", func() {
 				Expect(err).NotTo(HaveOccurred())
 				Expect(component.IsErrNotFound(err)).To(BeFalse())
 				cfRabbitURL := fmt.Sprintf("%s/d/github.com/pivotal-cf/cf-rabbitmq-release?v=268.0.0", testServer.URL())
-				Expect(foundRelease).To(Equal(component.Lock{
+				Expect(foundRelease).To(Equal(cargo.BOSHReleaseTarballLock{
 					Name:         "cf-rabbitmq",
 					Version:      "268.0.0",
 					RemotePath:   cfRabbitURL,
@@ -110,7 +110,7 @@ var _ = Describe("BOSHIOReleaseSource", func() {
 			})
 
 			It("doesn't find releases which don't exist on bosh.io", func() {
-				zzzRequirement := component.Spec{Name: "zzz", Version: "999", StemcellOS: "ubuntu-xenial", StemcellVersion: "190.0.0"}
+				zzzRequirement := cargo.BOSHReleaseTarballSpecification{Name: "zzz", Version: "999", StemcellOS: "ubuntu-xenial", StemcellVersion: "190.0.0"}
 				_, err := releaseSource.GetMatchedRelease(zzzRequirement)
 				Expect(err).To(HaveOccurred())
 				Expect(component.IsErrNotFound(err)).To(BeTrue())
@@ -139,7 +139,7 @@ var _ = Describe("BOSHIOReleaseSource", func() {
 			})
 
 			It("does not match that release", func() {
-				_, err := releaseSource.GetMatchedRelease(component.Spec{
+				_, err := releaseSource.GetMatchedRelease(cargo.BOSHReleaseTarballSpecification{
 					Name:            releaseName,
 					Version:         releaseVersion,
 					StemcellOS:      "ignored",
@@ -177,8 +177,8 @@ var _ = Describe("BOSHIOReleaseSource", func() {
 					pathRegex, _ := regexp.Compile(`/api/v1/releases/github.com/\S+/.*`)
 					testServer.RouteToHandler("GET", pathRegex, ghttp.RespondWith(http.StatusOK, `null`))
 
-					releaseID := component.Spec{Name: releaseName, Version: releaseVersion}
-					releaseRequirement := component.Spec{
+					releaseID := cargo.BOSHReleaseTarballSpecification{Name: releaseName, Version: releaseVersion}
+					releaseRequirement := cargo.BOSHReleaseTarballSpecification{
 						Name:            releaseName,
 						Version:         releaseVersion,
 						StemcellOS:      "generic-os",
@@ -226,8 +226,8 @@ var _ = Describe("BOSHIOReleaseSource", func() {
 			releaseSource *component.BOSHIOReleaseSource
 			testServer    *ghttp.Server
 
-			release1ID component.Spec
-			release1   component.Lock
+			release1ID cargo.BOSHReleaseTarballSpecification
+			release1   cargo.BOSHReleaseTarballLock
 
 			release1Sha1 string
 		)
@@ -241,7 +241,7 @@ var _ = Describe("BOSHIOReleaseSource", func() {
 
 			releaseSource = component.NewBOSHIOReleaseSource(cargo.ReleaseSourceConfig{ID: ID, Publishable: false}, testServer.URL(), log.New(GinkgoWriter, "", 0))
 
-			release1ID = component.Spec{Name: "some", Version: "1.2.3"}
+			release1ID = cargo.BOSHReleaseTarballSpecification{Name: "some", Version: "1.2.3"}
 			release1 = release1ID.Lock().WithRemote(component.ReleaseSourceTypeBOSHIO, testServer.URL()+release1ServerPath)
 
 			hash := sha1.New()
@@ -309,12 +309,12 @@ var _ = Describe("BOSHIOReleaseSource", func() {
 			})
 			When("there is no version requirement", func() {
 				It("gets the latest version from bosh.io", func() {
-					rabbitmqRequirement := component.Spec{Name: "cf-rabbitmq"}
+					rabbitmqRequirement := cargo.BOSHReleaseTarballSpecification{Name: "cf-rabbitmq"}
 
 					foundRelease, err := releaseSource.FindReleaseVersion(rabbitmqRequirement, false)
 					Expect(err).NotTo(HaveOccurred())
 					cfRabbitURL := fmt.Sprintf("%s/d/github.com/cloudfoundry/cf-rabbitmq-release?v=309.0.5", testServer.URL())
-					Expect(foundRelease).To(Equal(component.Lock{
+					Expect(foundRelease).To(Equal(cargo.BOSHReleaseTarballLock{
 						Name:         "cf-rabbitmq",
 						Version:      "309.0.5",
 						SHA1:         "5df538657c2cc830bda679420a9b162682018ded",
@@ -325,12 +325,12 @@ var _ = Describe("BOSHIOReleaseSource", func() {
 			})
 			When("there is a version requirement", func() {
 				It("gets the latest version from bosh.io", func() {
-					rabbitmqRequirement := component.Spec{Name: "cf-rabbitmq", Version: "~309"}
+					rabbitmqRequirement := cargo.BOSHReleaseTarballSpecification{Name: "cf-rabbitmq", Version: "~309"}
 
 					foundRelease, err := releaseSource.FindReleaseVersion(rabbitmqRequirement, false)
 					Expect(err).NotTo(HaveOccurred())
 					cfRabbitURL := fmt.Sprintf("%s/d/github.com/cloudfoundry/cf-rabbitmq-release?v=309.0.5", testServer.URL())
-					Expect(foundRelease).To(Equal(component.Lock{
+					Expect(foundRelease).To(Equal(cargo.BOSHReleaseTarballLock{
 						Name:         "cf-rabbitmq",
 						Version:      "309.0.5",
 						SHA1:         "5df538657c2cc830bda679420a9b162682018ded",
@@ -356,12 +356,12 @@ var _ = Describe("BOSHIOReleaseSource", func() {
 			})
 
 			It("returns not found", func() {
-				rabbitmqRequirement := component.Spec{Name: "cf-rabbitmq"}
+				rabbitmqRequirement := cargo.BOSHReleaseTarballSpecification{Name: "cf-rabbitmq"}
 
 				foundRelease, err := releaseSource.FindReleaseVersion(rabbitmqRequirement, false)
 				Expect(err).To(HaveOccurred())
 				Expect(component.IsErrNotFound(err)).To(BeTrue())
-				Expect(foundRelease).To(Equal(component.Lock{}))
+				Expect(foundRelease).To(Equal(cargo.BOSHReleaseTarballLock{}))
 			})
 		})
 	})
diff --git a/internal/component/component.go b/internal/component/component.go
index c01444fce..088b19a26 100644
--- a/internal/component/component.go
+++ b/internal/component/component.go
@@ -6,19 +6,15 @@ import (
 	"github.com/pivotal-cf/kiln/pkg/cargo"
 )
 
-type Spec = cargo.ComponentSpec
-
 type Exported struct {
-	Lock
+	Lock        cargo.BOSHReleaseTarballLock
 	TarballPath string
 	BlobstoreID string
 }
 
 type Local struct {
-	Lock
+	Lock      cargo.BOSHReleaseTarballLock
 	LocalPath string
 }
 
-type Lock = cargo.ComponentLock
-
 func closeAndIgnoreError(c io.Closer) { _ = c.Close() }
diff --git a/internal/component/fakes/multi_release_source.go b/internal/component/fakes/multi_release_source.go
index 8a4d912d7..03270614f 100644
--- a/internal/component/fakes/multi_release_source.go
+++ b/internal/component/fakes/multi_release_source.go
@@ -9,11 +9,11 @@ import (
 )
 
 type MultiReleaseSource struct {
-	DownloadReleaseStub        func(string, cargo.ComponentLock) (component.Local, error)
+	DownloadReleaseStub        func(string, cargo.BOSHReleaseTarballLock) (component.Local, error)
 	downloadReleaseMutex       sync.RWMutex
 	downloadReleaseArgsForCall []struct {
 		arg1 string
-		arg2 cargo.ComponentLock
+		arg2 cargo.BOSHReleaseTarballLock
 	}
 	downloadReleaseReturns struct {
 		result1 component.Local
@@ -36,31 +36,31 @@ type MultiReleaseSource struct {
 		result1 component.ReleaseSource
 		result2 error
 	}
-	FindReleaseVersionStub        func(cargo.ComponentSpec, bool) (cargo.ComponentLock, error)
+	FindReleaseVersionStub        func(cargo.BOSHReleaseTarballSpecification, bool) (cargo.BOSHReleaseTarballLock, error)
 	findReleaseVersionMutex       sync.RWMutex
 	findReleaseVersionArgsForCall []struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 		arg2 bool
 	}
 	findReleaseVersionReturns struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	findReleaseVersionReturnsOnCall map[int]struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
-	GetMatchedReleaseStub        func(cargo.ComponentSpec) (cargo.ComponentLock, error)
+	GetMatchedReleaseStub        func(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)
 	getMatchedReleaseMutex       sync.RWMutex
 	getMatchedReleaseArgsForCall []struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 	}
 	getMatchedReleaseReturns struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	getMatchedReleaseReturnsOnCall map[int]struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	SetDownloadThreadsStub        func(int)
@@ -72,12 +72,12 @@ type MultiReleaseSource struct {
 	invocationsMutex sync.RWMutex
 }
 
-func (fake *MultiReleaseSource) DownloadRelease(arg1 string, arg2 cargo.ComponentLock) (component.Local, error) {
+func (fake *MultiReleaseSource) DownloadRelease(arg1 string, arg2 cargo.BOSHReleaseTarballLock) (component.Local, error) {
 	fake.downloadReleaseMutex.Lock()
 	ret, specificReturn := fake.downloadReleaseReturnsOnCall[len(fake.downloadReleaseArgsForCall)]
 	fake.downloadReleaseArgsForCall = append(fake.downloadReleaseArgsForCall, struct {
 		arg1 string
-		arg2 cargo.ComponentLock
+		arg2 cargo.BOSHReleaseTarballLock
 	}{arg1, arg2})
 	stub := fake.DownloadReleaseStub
 	fakeReturns := fake.downloadReleaseReturns
@@ -98,13 +98,13 @@ func (fake *MultiReleaseSource) DownloadReleaseCallCount() int {
 	return len(fake.downloadReleaseArgsForCall)
 }
 
-func (fake *MultiReleaseSource) DownloadReleaseCalls(stub func(string, cargo.ComponentLock) (component.Local, error)) {
+func (fake *MultiReleaseSource) DownloadReleaseCalls(stub func(string, cargo.BOSHReleaseTarballLock) (component.Local, error)) {
 	fake.downloadReleaseMutex.Lock()
 	defer fake.downloadReleaseMutex.Unlock()
 	fake.DownloadReleaseStub = stub
 }
 
-func (fake *MultiReleaseSource) DownloadReleaseArgsForCall(i int) (string, cargo.ComponentLock) {
+func (fake *MultiReleaseSource) DownloadReleaseArgsForCall(i int) (string, cargo.BOSHReleaseTarballLock) {
 	fake.downloadReleaseMutex.RLock()
 	defer fake.downloadReleaseMutex.RUnlock()
 	argsForCall := fake.downloadReleaseArgsForCall[i]
@@ -201,11 +201,11 @@ func (fake *MultiReleaseSource) FindByIDReturnsOnCall(i int, result1 component.R
 	}{result1, result2}
 }
 
-func (fake *MultiReleaseSource) FindReleaseVersion(arg1 cargo.ComponentSpec, arg2 bool) (cargo.ComponentLock, error) {
+func (fake *MultiReleaseSource) FindReleaseVersion(arg1 cargo.BOSHReleaseTarballSpecification, arg2 bool) (cargo.BOSHReleaseTarballLock, error) {
 	fake.findReleaseVersionMutex.Lock()
 	ret, specificReturn := fake.findReleaseVersionReturnsOnCall[len(fake.findReleaseVersionArgsForCall)]
 	fake.findReleaseVersionArgsForCall = append(fake.findReleaseVersionArgsForCall, struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 		arg2 bool
 	}{arg1, arg2})
 	stub := fake.FindReleaseVersionStub
@@ -227,50 +227,50 @@ func (fake *MultiReleaseSource) FindReleaseVersionCallCount() int {
 	return len(fake.findReleaseVersionArgsForCall)
 }
 
-func (fake *MultiReleaseSource) FindReleaseVersionCalls(stub func(cargo.ComponentSpec, bool) (cargo.ComponentLock, error)) {
+func (fake *MultiReleaseSource) FindReleaseVersionCalls(stub func(cargo.BOSHReleaseTarballSpecification, bool) (cargo.BOSHReleaseTarballLock, error)) {
 	fake.findReleaseVersionMutex.Lock()
 	defer fake.findReleaseVersionMutex.Unlock()
 	fake.FindReleaseVersionStub = stub
 }
 
-func (fake *MultiReleaseSource) FindReleaseVersionArgsForCall(i int) (cargo.ComponentSpec, bool) {
+func (fake *MultiReleaseSource) FindReleaseVersionArgsForCall(i int) (cargo.BOSHReleaseTarballSpecification, bool) {
 	fake.findReleaseVersionMutex.RLock()
 	defer fake.findReleaseVersionMutex.RUnlock()
 	argsForCall := fake.findReleaseVersionArgsForCall[i]
 	return argsForCall.arg1, argsForCall.arg2
 }
 
-func (fake *MultiReleaseSource) FindReleaseVersionReturns(result1 cargo.ComponentLock, result2 error) {
+func (fake *MultiReleaseSource) FindReleaseVersionReturns(result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.findReleaseVersionMutex.Lock()
 	defer fake.findReleaseVersionMutex.Unlock()
 	fake.FindReleaseVersionStub = nil
 	fake.findReleaseVersionReturns = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *MultiReleaseSource) FindReleaseVersionReturnsOnCall(i int, result1 cargo.ComponentLock, result2 error) {
+func (fake *MultiReleaseSource) FindReleaseVersionReturnsOnCall(i int, result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.findReleaseVersionMutex.Lock()
 	defer fake.findReleaseVersionMutex.Unlock()
 	fake.FindReleaseVersionStub = nil
 	if fake.findReleaseVersionReturnsOnCall == nil {
 		fake.findReleaseVersionReturnsOnCall = make(map[int]struct {
-			result1 cargo.ComponentLock
+			result1 cargo.BOSHReleaseTarballLock
 			result2 error
 		})
 	}
 	fake.findReleaseVersionReturnsOnCall[i] = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *MultiReleaseSource) GetMatchedRelease(arg1 cargo.ComponentSpec) (cargo.ComponentLock, error) {
+func (fake *MultiReleaseSource) GetMatchedRelease(arg1 cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 	fake.getMatchedReleaseMutex.Lock()
 	ret, specificReturn := fake.getMatchedReleaseReturnsOnCall[len(fake.getMatchedReleaseArgsForCall)]
 	fake.getMatchedReleaseArgsForCall = append(fake.getMatchedReleaseArgsForCall, struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 	}{arg1})
 	stub := fake.GetMatchedReleaseStub
 	fakeReturns := fake.getMatchedReleaseReturns
@@ -291,41 +291,41 @@ func (fake *MultiReleaseSource) GetMatchedReleaseCallCount() int {
 	return len(fake.getMatchedReleaseArgsForCall)
 }
 
-func (fake *MultiReleaseSource) GetMatchedReleaseCalls(stub func(cargo.ComponentSpec) (cargo.ComponentLock, error)) {
+func (fake *MultiReleaseSource) GetMatchedReleaseCalls(stub func(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = stub
 }
 
-func (fake *MultiReleaseSource) GetMatchedReleaseArgsForCall(i int) cargo.ComponentSpec {
+func (fake *MultiReleaseSource) GetMatchedReleaseArgsForCall(i int) cargo.BOSHReleaseTarballSpecification {
 	fake.getMatchedReleaseMutex.RLock()
 	defer fake.getMatchedReleaseMutex.RUnlock()
 	argsForCall := fake.getMatchedReleaseArgsForCall[i]
 	return argsForCall.arg1
 }
 
-func (fake *MultiReleaseSource) GetMatchedReleaseReturns(result1 cargo.ComponentLock, result2 error) {
+func (fake *MultiReleaseSource) GetMatchedReleaseReturns(result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = nil
 	fake.getMatchedReleaseReturns = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *MultiReleaseSource) GetMatchedReleaseReturnsOnCall(i int, result1 cargo.ComponentLock, result2 error) {
+func (fake *MultiReleaseSource) GetMatchedReleaseReturnsOnCall(i int, result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = nil
 	if fake.getMatchedReleaseReturnsOnCall == nil {
 		fake.getMatchedReleaseReturnsOnCall = make(map[int]struct {
-			result1 cargo.ComponentLock
+			result1 cargo.BOSHReleaseTarballLock
 			result2 error
 		})
 	}
 	fake.getMatchedReleaseReturnsOnCall[i] = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
diff --git a/internal/component/fakes/release_source.go b/internal/component/fakes/release_source.go
index 54f969572..b5d5508b2 100644
--- a/internal/component/fakes/release_source.go
+++ b/internal/component/fakes/release_source.go
@@ -19,11 +19,11 @@ type ReleaseSource struct {
 	configurationReturnsOnCall map[int]struct {
 		result1 cargo.ReleaseSourceConfig
 	}
-	DownloadReleaseStub        func(string, cargo.ComponentLock) (component.Local, error)
+	DownloadReleaseStub        func(string, cargo.BOSHReleaseTarballLock) (component.Local, error)
 	downloadReleaseMutex       sync.RWMutex
 	downloadReleaseArgsForCall []struct {
 		arg1 string
-		arg2 cargo.ComponentLock
+		arg2 cargo.BOSHReleaseTarballLock
 	}
 	downloadReleaseReturns struct {
 		result1 component.Local
@@ -33,31 +33,31 @@ type ReleaseSource struct {
 		result1 component.Local
 		result2 error
 	}
-	FindReleaseVersionStub        func(cargo.ComponentSpec, bool) (cargo.ComponentLock, error)
+	FindReleaseVersionStub        func(cargo.BOSHReleaseTarballSpecification, bool) (cargo.BOSHReleaseTarballLock, error)
 	findReleaseVersionMutex       sync.RWMutex
 	findReleaseVersionArgsForCall []struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 		arg2 bool
 	}
 	findReleaseVersionReturns struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	findReleaseVersionReturnsOnCall map[int]struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
-	GetMatchedReleaseStub        func(cargo.ComponentSpec) (cargo.ComponentLock, error)
+	GetMatchedReleaseStub        func(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)
 	getMatchedReleaseMutex       sync.RWMutex
 	getMatchedReleaseArgsForCall []struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 	}
 	getMatchedReleaseReturns struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	getMatchedReleaseReturnsOnCall map[int]struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	invocations      map[string][][]interface{}
@@ -117,12 +117,12 @@ func (fake *ReleaseSource) ConfigurationReturnsOnCall(i int, result1 cargo.Relea
 	}{result1}
 }
 
-func (fake *ReleaseSource) DownloadRelease(arg1 string, arg2 cargo.ComponentLock) (component.Local, error) {
+func (fake *ReleaseSource) DownloadRelease(arg1 string, arg2 cargo.BOSHReleaseTarballLock) (component.Local, error) {
 	fake.downloadReleaseMutex.Lock()
 	ret, specificReturn := fake.downloadReleaseReturnsOnCall[len(fake.downloadReleaseArgsForCall)]
 	fake.downloadReleaseArgsForCall = append(fake.downloadReleaseArgsForCall, struct {
 		arg1 string
-		arg2 cargo.ComponentLock
+		arg2 cargo.BOSHReleaseTarballLock
 	}{arg1, arg2})
 	stub := fake.DownloadReleaseStub
 	fakeReturns := fake.downloadReleaseReturns
@@ -143,13 +143,13 @@ func (fake *ReleaseSource) DownloadReleaseCallCount() int {
 	return len(fake.downloadReleaseArgsForCall)
 }
 
-func (fake *ReleaseSource) DownloadReleaseCalls(stub func(string, cargo.ComponentLock) (component.Local, error)) {
+func (fake *ReleaseSource) DownloadReleaseCalls(stub func(string, cargo.BOSHReleaseTarballLock) (component.Local, error)) {
 	fake.downloadReleaseMutex.Lock()
 	defer fake.downloadReleaseMutex.Unlock()
 	fake.DownloadReleaseStub = stub
 }
 
-func (fake *ReleaseSource) DownloadReleaseArgsForCall(i int) (string, cargo.ComponentLock) {
+func (fake *ReleaseSource) DownloadReleaseArgsForCall(i int) (string, cargo.BOSHReleaseTarballLock) {
 	fake.downloadReleaseMutex.RLock()
 	defer fake.downloadReleaseMutex.RUnlock()
 	argsForCall := fake.downloadReleaseArgsForCall[i]
@@ -182,11 +182,11 @@ func (fake *ReleaseSource) DownloadReleaseReturnsOnCall(i int, result1 component
 	}{result1, result2}
 }
 
-func (fake *ReleaseSource) FindReleaseVersion(arg1 cargo.ComponentSpec, arg2 bool) (cargo.ComponentLock, error) {
+func (fake *ReleaseSource) FindReleaseVersion(arg1 cargo.BOSHReleaseTarballSpecification, arg2 bool) (cargo.BOSHReleaseTarballLock, error) {
 	fake.findReleaseVersionMutex.Lock()
 	ret, specificReturn := fake.findReleaseVersionReturnsOnCall[len(fake.findReleaseVersionArgsForCall)]
 	fake.findReleaseVersionArgsForCall = append(fake.findReleaseVersionArgsForCall, struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 		arg2 bool
 	}{arg1, arg2})
 	stub := fake.FindReleaseVersionStub
@@ -208,50 +208,50 @@ func (fake *ReleaseSource) FindReleaseVersionCallCount() int {
 	return len(fake.findReleaseVersionArgsForCall)
 }
 
-func (fake *ReleaseSource) FindReleaseVersionCalls(stub func(cargo.ComponentSpec, bool) (cargo.ComponentLock, error)) {
+func (fake *ReleaseSource) FindReleaseVersionCalls(stub func(cargo.BOSHReleaseTarballSpecification, bool) (cargo.BOSHReleaseTarballLock, error)) {
 	fake.findReleaseVersionMutex.Lock()
 	defer fake.findReleaseVersionMutex.Unlock()
 	fake.FindReleaseVersionStub = stub
 }
 
-func (fake *ReleaseSource) FindReleaseVersionArgsForCall(i int) (cargo.ComponentSpec, bool) {
+func (fake *ReleaseSource) FindReleaseVersionArgsForCall(i int) (cargo.BOSHReleaseTarballSpecification, bool) {
 	fake.findReleaseVersionMutex.RLock()
 	defer fake.findReleaseVersionMutex.RUnlock()
 	argsForCall := fake.findReleaseVersionArgsForCall[i]
 	return argsForCall.arg1, argsForCall.arg2
 }
 
-func (fake *ReleaseSource) FindReleaseVersionReturns(result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseSource) FindReleaseVersionReturns(result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.findReleaseVersionMutex.Lock()
 	defer fake.findReleaseVersionMutex.Unlock()
 	fake.FindReleaseVersionStub = nil
 	fake.findReleaseVersionReturns = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseSource) FindReleaseVersionReturnsOnCall(i int, result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseSource) FindReleaseVersionReturnsOnCall(i int, result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.findReleaseVersionMutex.Lock()
 	defer fake.findReleaseVersionMutex.Unlock()
 	fake.FindReleaseVersionStub = nil
 	if fake.findReleaseVersionReturnsOnCall == nil {
 		fake.findReleaseVersionReturnsOnCall = make(map[int]struct {
-			result1 cargo.ComponentLock
+			result1 cargo.BOSHReleaseTarballLock
 			result2 error
 		})
 	}
 	fake.findReleaseVersionReturnsOnCall[i] = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseSource) GetMatchedRelease(arg1 cargo.ComponentSpec) (cargo.ComponentLock, error) {
+func (fake *ReleaseSource) GetMatchedRelease(arg1 cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 	fake.getMatchedReleaseMutex.Lock()
 	ret, specificReturn := fake.getMatchedReleaseReturnsOnCall[len(fake.getMatchedReleaseArgsForCall)]
 	fake.getMatchedReleaseArgsForCall = append(fake.getMatchedReleaseArgsForCall, struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 	}{arg1})
 	stub := fake.GetMatchedReleaseStub
 	fakeReturns := fake.getMatchedReleaseReturns
@@ -272,41 +272,41 @@ func (fake *ReleaseSource) GetMatchedReleaseCallCount() int {
 	return len(fake.getMatchedReleaseArgsForCall)
 }
 
-func (fake *ReleaseSource) GetMatchedReleaseCalls(stub func(cargo.ComponentSpec) (cargo.ComponentLock, error)) {
+func (fake *ReleaseSource) GetMatchedReleaseCalls(stub func(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = stub
 }
 
-func (fake *ReleaseSource) GetMatchedReleaseArgsForCall(i int) cargo.ComponentSpec {
+func (fake *ReleaseSource) GetMatchedReleaseArgsForCall(i int) cargo.BOSHReleaseTarballSpecification {
 	fake.getMatchedReleaseMutex.RLock()
 	defer fake.getMatchedReleaseMutex.RUnlock()
 	argsForCall := fake.getMatchedReleaseArgsForCall[i]
 	return argsForCall.arg1
 }
 
-func (fake *ReleaseSource) GetMatchedReleaseReturns(result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseSource) GetMatchedReleaseReturns(result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = nil
 	fake.getMatchedReleaseReturns = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseSource) GetMatchedReleaseReturnsOnCall(i int, result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseSource) GetMatchedReleaseReturnsOnCall(i int, result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = nil
 	if fake.getMatchedReleaseReturnsOnCall == nil {
 		fake.getMatchedReleaseReturnsOnCall = make(map[int]struct {
-			result1 cargo.ComponentLock
+			result1 cargo.BOSHReleaseTarballLock
 			result2 error
 		})
 	}
 	fake.getMatchedReleaseReturnsOnCall[i] = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
diff --git a/internal/component/fakes/release_uploader.go b/internal/component/fakes/release_uploader.go
index 3a22bb4da..82ef6dcea 100644
--- a/internal/component/fakes/release_uploader.go
+++ b/internal/component/fakes/release_uploader.go
@@ -10,42 +10,42 @@ import (
 )
 
 type ReleaseUploader struct {
-	GetMatchedReleaseStub        func(cargo.ComponentSpec) (cargo.ComponentLock, error)
+	GetMatchedReleaseStub        func(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)
 	getMatchedReleaseMutex       sync.RWMutex
 	getMatchedReleaseArgsForCall []struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 	}
 	getMatchedReleaseReturns struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	getMatchedReleaseReturnsOnCall map[int]struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
-	UploadReleaseStub        func(cargo.ComponentSpec, io.Reader) (cargo.ComponentLock, error)
+	UploadReleaseStub        func(cargo.BOSHReleaseTarballSpecification, io.Reader) (cargo.BOSHReleaseTarballLock, error)
 	uploadReleaseMutex       sync.RWMutex
 	uploadReleaseArgsForCall []struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 		arg2 io.Reader
 	}
 	uploadReleaseReturns struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	uploadReleaseReturnsOnCall map[int]struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}
 	invocations      map[string][][]interface{}
 	invocationsMutex sync.RWMutex
 }
 
-func (fake *ReleaseUploader) GetMatchedRelease(arg1 cargo.ComponentSpec) (cargo.ComponentLock, error) {
+func (fake *ReleaseUploader) GetMatchedRelease(arg1 cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 	fake.getMatchedReleaseMutex.Lock()
 	ret, specificReturn := fake.getMatchedReleaseReturnsOnCall[len(fake.getMatchedReleaseArgsForCall)]
 	fake.getMatchedReleaseArgsForCall = append(fake.getMatchedReleaseArgsForCall, struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 	}{arg1})
 	stub := fake.GetMatchedReleaseStub
 	fakeReturns := fake.getMatchedReleaseReturns
@@ -66,50 +66,50 @@ func (fake *ReleaseUploader) GetMatchedReleaseCallCount() int {
 	return len(fake.getMatchedReleaseArgsForCall)
 }
 
-func (fake *ReleaseUploader) GetMatchedReleaseCalls(stub func(cargo.ComponentSpec) (cargo.ComponentLock, error)) {
+func (fake *ReleaseUploader) GetMatchedReleaseCalls(stub func(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = stub
 }
 
-func (fake *ReleaseUploader) GetMatchedReleaseArgsForCall(i int) cargo.ComponentSpec {
+func (fake *ReleaseUploader) GetMatchedReleaseArgsForCall(i int) cargo.BOSHReleaseTarballSpecification {
 	fake.getMatchedReleaseMutex.RLock()
 	defer fake.getMatchedReleaseMutex.RUnlock()
 	argsForCall := fake.getMatchedReleaseArgsForCall[i]
 	return argsForCall.arg1
 }
 
-func (fake *ReleaseUploader) GetMatchedReleaseReturns(result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseUploader) GetMatchedReleaseReturns(result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = nil
 	fake.getMatchedReleaseReturns = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseUploader) GetMatchedReleaseReturnsOnCall(i int, result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseUploader) GetMatchedReleaseReturnsOnCall(i int, result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.getMatchedReleaseMutex.Lock()
 	defer fake.getMatchedReleaseMutex.Unlock()
 	fake.GetMatchedReleaseStub = nil
 	if fake.getMatchedReleaseReturnsOnCall == nil {
 		fake.getMatchedReleaseReturnsOnCall = make(map[int]struct {
-			result1 cargo.ComponentLock
+			result1 cargo.BOSHReleaseTarballLock
 			result2 error
 		})
 	}
 	fake.getMatchedReleaseReturnsOnCall[i] = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseUploader) UploadRelease(arg1 cargo.ComponentSpec, arg2 io.Reader) (cargo.ComponentLock, error) {
+func (fake *ReleaseUploader) UploadRelease(arg1 cargo.BOSHReleaseTarballSpecification, arg2 io.Reader) (cargo.BOSHReleaseTarballLock, error) {
 	fake.uploadReleaseMutex.Lock()
 	ret, specificReturn := fake.uploadReleaseReturnsOnCall[len(fake.uploadReleaseArgsForCall)]
 	fake.uploadReleaseArgsForCall = append(fake.uploadReleaseArgsForCall, struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 		arg2 io.Reader
 	}{arg1, arg2})
 	stub := fake.UploadReleaseStub
@@ -131,41 +131,41 @@ func (fake *ReleaseUploader) UploadReleaseCallCount() int {
 	return len(fake.uploadReleaseArgsForCall)
 }
 
-func (fake *ReleaseUploader) UploadReleaseCalls(stub func(cargo.ComponentSpec, io.Reader) (cargo.ComponentLock, error)) {
+func (fake *ReleaseUploader) UploadReleaseCalls(stub func(cargo.BOSHReleaseTarballSpecification, io.Reader) (cargo.BOSHReleaseTarballLock, error)) {
 	fake.uploadReleaseMutex.Lock()
 	defer fake.uploadReleaseMutex.Unlock()
 	fake.UploadReleaseStub = stub
 }
 
-func (fake *ReleaseUploader) UploadReleaseArgsForCall(i int) (cargo.ComponentSpec, io.Reader) {
+func (fake *ReleaseUploader) UploadReleaseArgsForCall(i int) (cargo.BOSHReleaseTarballSpecification, io.Reader) {
 	fake.uploadReleaseMutex.RLock()
 	defer fake.uploadReleaseMutex.RUnlock()
 	argsForCall := fake.uploadReleaseArgsForCall[i]
 	return argsForCall.arg1, argsForCall.arg2
 }
 
-func (fake *ReleaseUploader) UploadReleaseReturns(result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseUploader) UploadReleaseReturns(result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.uploadReleaseMutex.Lock()
 	defer fake.uploadReleaseMutex.Unlock()
 	fake.UploadReleaseStub = nil
 	fake.uploadReleaseReturns = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
 
-func (fake *ReleaseUploader) UploadReleaseReturnsOnCall(i int, result1 cargo.ComponentLock, result2 error) {
+func (fake *ReleaseUploader) UploadReleaseReturnsOnCall(i int, result1 cargo.BOSHReleaseTarballLock, result2 error) {
 	fake.uploadReleaseMutex.Lock()
 	defer fake.uploadReleaseMutex.Unlock()
 	fake.UploadReleaseStub = nil
 	if fake.uploadReleaseReturnsOnCall == nil {
 		fake.uploadReleaseReturnsOnCall = make(map[int]struct {
-			result1 cargo.ComponentLock
+			result1 cargo.BOSHReleaseTarballLock
 			result2 error
 		})
 	}
 	fake.uploadReleaseReturnsOnCall[i] = struct {
-		result1 cargo.ComponentLock
+		result1 cargo.BOSHReleaseTarballLock
 		result2 error
 	}{result1, result2}
 }
diff --git a/internal/component/fakes/remote_pather.go b/internal/component/fakes/remote_pather.go
index cd7f27e8e..1b6e6f6d8 100644
--- a/internal/component/fakes/remote_pather.go
+++ b/internal/component/fakes/remote_pather.go
@@ -9,10 +9,10 @@ import (
 )
 
 type RemotePather struct {
-	RemotePathStub        func(cargo.ComponentSpec) (string, error)
+	RemotePathStub        func(cargo.BOSHReleaseTarballSpecification) (string, error)
 	remotePathMutex       sync.RWMutex
 	remotePathArgsForCall []struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 	}
 	remotePathReturns struct {
 		result1 string
@@ -26,11 +26,11 @@ type RemotePather struct {
 	invocationsMutex sync.RWMutex
 }
 
-func (fake *RemotePather) RemotePath(arg1 cargo.ComponentSpec) (string, error) {
+func (fake *RemotePather) RemotePath(arg1 cargo.BOSHReleaseTarballSpecification) (string, error) {
 	fake.remotePathMutex.Lock()
 	ret, specificReturn := fake.remotePathReturnsOnCall[len(fake.remotePathArgsForCall)]
 	fake.remotePathArgsForCall = append(fake.remotePathArgsForCall, struct {
-		arg1 cargo.ComponentSpec
+		arg1 cargo.BOSHReleaseTarballSpecification
 	}{arg1})
 	stub := fake.RemotePathStub
 	fakeReturns := fake.remotePathReturns
@@ -51,13 +51,13 @@ func (fake *RemotePather) RemotePathCallCount() int {
 	return len(fake.remotePathArgsForCall)
 }
 
-func (fake *RemotePather) RemotePathCalls(stub func(cargo.ComponentSpec) (string, error)) {
+func (fake *RemotePather) RemotePathCalls(stub func(cargo.BOSHReleaseTarballSpecification) (string, error)) {
 	fake.remotePathMutex.Lock()
 	defer fake.remotePathMutex.Unlock()
 	fake.RemotePathStub = stub
 }
 
-func (fake *RemotePather) RemotePathArgsForCall(i int) cargo.ComponentSpec {
+func (fake *RemotePather) RemotePathArgsForCall(i int) cargo.BOSHReleaseTarballSpecification {
 	fake.remotePathMutex.RLock()
 	defer fake.remotePathMutex.RUnlock()
 	argsForCall := fake.remotePathArgsForCall[i]
diff --git a/internal/component/github_release_source.go b/internal/component/github_release_source.go
index d76fa1faf..7d351a81e 100644
--- a/internal/component/github_release_source.go
+++ b/internal/component/github_release_source.go
@@ -69,16 +69,16 @@ func (grs *GithubReleaseSource) Configuration() cargo.ReleaseSourceConfig {
 
 // GetMatchedRelease uses the Name and Version and if supported StemcellOS and StemcellVersion
 // fields on Requirement to download a specific release.
-func (grs *GithubReleaseSource) GetMatchedRelease(s Spec) (Lock, error) {
+func (grs *GithubReleaseSource) GetMatchedRelease(s cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 	_, err := semver.NewVersion(s.Version)
 	if err != nil {
-		return Lock{}, fmt.Errorf("expected version to be an exact version")
+		return cargo.BOSHReleaseTarballLock{}, fmt.Errorf("expected version to be an exact version")
 	}
 
 	ctx := context.TODO()
 	release, err := grs.GetGithubReleaseWithTag(ctx, s)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	return grs.getLockFromRelease(ctx, release, s, false)
@@ -90,7 +90,7 @@ type ReleaseByTagGetter interface {
 	GetReleaseByTag(ctx context.Context, owner, repo, tag string) (*github.RepositoryRelease, *github.Response, error)
 }
 
-func (grs *GithubReleaseSource) GetGithubReleaseWithTag(ctx context.Context, s Spec) (*github.RepositoryRelease, error) {
+func (grs *GithubReleaseSource) GetGithubReleaseWithTag(ctx context.Context, s cargo.BOSHReleaseTarballSpecification) (*github.RepositoryRelease, error) {
 	repoOwner, repoName, err := gh.OwnerAndRepoFromURI(s.GitHubRepository)
 	if err != nil {
 		return nil, ErrNotFound
@@ -112,7 +112,7 @@ func (grs *GithubReleaseSource) GetGithubReleaseWithTag(ctx context.Context, s S
 	return release, nil
 }
 
-func (grs *GithubReleaseSource) GetLatestMatchingRelease(ctx context.Context, s Spec) (*github.RepositoryRelease, error) {
+func (grs *GithubReleaseSource) GetLatestMatchingRelease(ctx context.Context, s cargo.BOSHReleaseTarballSpecification) (*github.RepositoryRelease, error) {
 	c, err := s.VersionConstraints()
 	if err != nil {
 		return nil, fmt.Errorf("expected version to be a constraint")
@@ -178,17 +178,17 @@ func (grs *GithubReleaseSource) GetLatestMatchingRelease(ctx context.Context, s
 
 // FindReleaseVersion may use any of the fields on Requirement to return the best matching
 // release.
-func (grs *GithubReleaseSource) FindReleaseVersion(s Spec, noDownload bool) (Lock, error) {
+func (grs *GithubReleaseSource) FindReleaseVersion(s cargo.BOSHReleaseTarballSpecification, noDownload bool) (cargo.BOSHReleaseTarballLock, error) {
 	ctx := context.TODO()
 	release, err := grs.GetLatestMatchingRelease(ctx, s)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	return grs.getLockFromRelease(ctx, release, s, noDownload)
 }
 
-func (grs *GithubReleaseSource) getLockFromRelease(ctx context.Context, r *github.RepositoryRelease, s Spec, noDownload bool) (Lock, error) {
+func (grs *GithubReleaseSource) getLockFromRelease(ctx context.Context, r *github.RepositoryRelease, s cargo.BOSHReleaseTarballSpecification, noDownload bool) (cargo.BOSHReleaseTarballLock, error) {
 	lockVersion := strings.TrimPrefix(r.GetTagName(), "v")
 	expectedAssetName := fmt.Sprintf("%s-%s.tgz", s.Name, lockVersion)
 	malformedAssetName := fmt.Sprintf("%s-v%s.tgz", s.Name, lockVersion)
@@ -205,11 +205,11 @@ func (grs *GithubReleaseSource) getLockFromRelease(ctx context.Context, r *githu
 			var err error
 			sum, err = grs.getReleaseSHA1(ctx, s, *asset.ID)
 			if err != nil {
-				return Lock{}, err
+				return cargo.BOSHReleaseTarballLock{}, err
 			}
 		}
 
-		return Lock{
+		return cargo.BOSHReleaseTarballLock{
 			Name:         s.Name,
 			Version:      lockVersion,
 			RemoteSource: grs.Org,
@@ -218,10 +218,10 @@ func (grs *GithubReleaseSource) getLockFromRelease(ctx context.Context, r *githu
 		}, nil
 	}
 
-	return Lock{}, fmt.Errorf("no matching GitHub release asset file name equal to %q", expectedAssetName)
+	return cargo.BOSHReleaseTarballLock{}, fmt.Errorf("no matching GitHub release asset file name equal to %q", expectedAssetName)
 }
 
-func (grs *GithubReleaseSource) getReleaseSHA1(ctx context.Context, s Spec, id int64) (string, error) {
+func (grs *GithubReleaseSource) getReleaseSHA1(ctx context.Context, s cargo.BOSHReleaseTarballSpecification, id int64) (string, error) {
 	repoOwner, repoName, err := gh.OwnerAndRepoFromURI(s.GitHubRepository)
 	if err != nil {
 		return "", fmt.Errorf("could not parse repository name: %v", err)
@@ -243,7 +243,7 @@ type ReleasesLister interface {
 // DownloadRelease downloads the release and writes the resulting file to the releasesDir.
 // It should also calculate and set the SHA1 field on the Local result; it does not need
 // to ensure the sums match, the caller must verify this.
-func (grs *GithubReleaseSource) DownloadRelease(releaseDir string, remoteRelease Lock) (Local, error) {
+func (grs *GithubReleaseSource) DownloadRelease(releaseDir string, remoteRelease cargo.BOSHReleaseTarballLock) (Local, error) {
 	grs.Logger.Printf(logLineDownload, remoteRelease.Name, ReleaseSourceTypeGithub, grs.ID)
 	return downloadRelease(context.TODO(), releaseDir, remoteRelease, grs, grs.Logger)
 }
@@ -255,7 +255,7 @@ type ReleaseByTagGetterAssetDownloader interface {
 	ReleaseAssetDownloader
 }
 
-func downloadRelease(ctx context.Context, releaseDir string, remoteRelease Lock, client ReleaseByTagGetterAssetDownloader, logger *log.Logger) (Local, error) {
+func downloadRelease(ctx context.Context, releaseDir string, remoteRelease cargo.BOSHReleaseTarballLock, client ReleaseByTagGetterAssetDownloader, logger *log.Logger) (Local, error) {
 	filePath := filepath.Join(releaseDir, fmt.Sprintf("%s-%s.tgz", remoteRelease.Name, remoteRelease.Version))
 
 	remoteUrl, err := url.Parse(remoteRelease.RemotePath)
@@ -311,7 +311,7 @@ type ReleaseAssetDownloader interface {
 	DownloadReleaseAsset(ctx context.Context, owner, repo string, id int64, followRedirectsClient *http.Client) (rc io.ReadCloser, redirectURL string, err error)
 }
 
-func findAssetFile(list []*github.ReleaseAsset, lock Lock) (*github.ReleaseAsset, bool) {
+func findAssetFile(list []*github.ReleaseAsset, lock cargo.BOSHReleaseTarballLock) (*github.ReleaseAsset, bool) {
 	lockVersion := strings.TrimPrefix(lock.Version, "v")
 	expectedAssetName := fmt.Sprintf("%s-%s.tgz", lock.Name, lockVersion)
 	malformedAssetName := fmt.Sprintf("%s-v%s.tgz", lock.Name, lockVersion)
diff --git a/internal/component/github_release_source_internal_test.go b/internal/component/github_release_source_internal_test.go
index 3c6dd2735..1c3193710 100644
--- a/internal/component/github_release_source_internal_test.go
+++ b/internal/component/github_release_source_internal_test.go
@@ -14,6 +14,7 @@ import (
 	. "github.com/onsi/gomega"
 
 	"github.com/pivotal-cf/kiln/internal/component/fakes_internal"
+	"github.com/pivotal-cf/kiln/pkg/cargo"
 )
 
 func TestGithubReleaseSource_interface_compliance(t *testing.T) {
@@ -32,7 +33,7 @@ func TestGithubReleaseSource_interface_compliance(t *testing.T) {
 }
 
 func TestGithubReleaseSource_downloadRelease(t *testing.T) {
-	lock := Lock{
+	lock := cargo.BOSHReleaseTarballLock{
 		Name:       "routing",
 		Version:    "0.239.0",
 		RemotePath: "https://github.com/cloudfoundry/routing-release/releases/download/v0.239.0/routing-0.239.0.tgz",
@@ -75,7 +76,7 @@ func TestGithubReleaseSource_downloadRelease(t *testing.T) {
 	}
 
 	please.Expect(local.LocalPath).To(BeAnExistingFile(), "it finds the created asset file")
-	please.Expect(local.SHA1).To(Equal("3a2be7b07a1a19072bf54c95a8c4a3fe0cdb35d4"))
+	please.Expect(local.Lock.SHA1).To(Equal("3a2be7b07a1a19072bf54c95a8c4a3fe0cdb35d4"))
 }
 
 func ptr[T any](v T) *T { return &v }
diff --git a/internal/component/github_release_source_test.go b/internal/component/github_release_source_test.go
index 0ba6fe175..87b28d980 100644
--- a/internal/component/github_release_source_test.go
+++ b/internal/component/github_release_source_test.go
@@ -98,7 +98,7 @@ func TestGithubReleaseSource_ComponentLockFromGithubRelease(t *testing.T) {
 			},
 		}
 
-		lock, err := grsMock.GetMatchedRelease(component.Spec{
+		lock, err := grsMock.GetMatchedRelease(cargo.BOSHReleaseTarballSpecification{
 			Name:             "routing",
 			Version:          "0.226.0",
 			GitHubRepository: "https://github.com/cloudfoundry/routing-release",
@@ -188,7 +188,7 @@ func TestGithubReleaseSource_ComponentLockFromGithubRelease(t *testing.T) {
 		}
 
 		// When...
-		lock, err := grsMock.GetMatchedRelease(component.Spec{
+		lock, err := grsMock.GetMatchedRelease(cargo.BOSHReleaseTarballSpecification{
 			Name:             "routing",
 			Version:          "0.226.0",
 			GitHubRepository: "https://github.com/cloudfoundry/routing-release",
@@ -226,7 +226,7 @@ func TestGithubReleaseSource_ComponentLockFromGithubRelease(t *testing.T) {
 
 func TestGithubReleaseSource_FindReleaseVersion(t *testing.T) {
 	t.Run("when spec contains a version string other than semver", func(t *testing.T) {
-		s := component.Spec{
+		s := cargo.BOSHReleaseTarballSpecification{
 			Version: "garbage",
 		}
 		grs := component.NewGithubReleaseSource(cargo.ReleaseSourceConfig{Type: component.ReleaseSourceTypeGithub, GithubToken: "fake_token", Org: "cloudfoundry"})
@@ -268,7 +268,7 @@ func TestGithubReleaseSource_FindReleaseVersion(t *testing.T) {
 			return listResponse, httpResponse, nil
 		}
 
-		s := component.Spec{
+		s := cargo.BOSHReleaseTarballSpecification{
 			Name:             releaseName,
 			GitHubRepository: "https://github.com/cloudfoundry/bpm-release",
 		}
@@ -296,7 +296,7 @@ func TestGithubReleaseSource_FindReleaseVersion(t *testing.T) {
 
 func TestGithubReleaseSource_GetMatchedRelease(t *testing.T) {
 	t.Run("when spec contains a version string other than semver", func(t *testing.T) {
-		s := component.Spec{
+		s := cargo.BOSHReleaseTarballSpecification{
 			Version: ">1.0.0",
 		}
 		grs := component.NewGithubReleaseSource(cargo.ReleaseSourceConfig{Type: component.ReleaseSourceTypeGithub, GithubToken: "fake_token", Org: "cloudfoundry"})
@@ -334,7 +334,7 @@ func TestGetGithubReleaseWithTag(t *testing.T) {
 				GithubToken: "fake-token",
 			},
 		}
-		s := component.Spec{
+		s := cargo.BOSHReleaseTarballSpecification{
 			Name:             "routing",
 			Version:          "0.226.0",
 			GitHubRepository: "https://github.com/cloudfoundry/routing-release",
@@ -375,7 +375,7 @@ func TestGetGithubReleaseWithTag(t *testing.T) {
 				GithubToken: "fake-token",
 			},
 		}
-		s := component.Spec{
+		s := cargo.BOSHReleaseTarballSpecification{
 			Name:             "routing",
 			Version:          "0.226.0",
 			GitHubRepository: "https://github.com/cloudfoundry/routing-release",
@@ -439,7 +439,7 @@ func TestGetLatestMatchingRelease(t *testing.T) {
 			},
 		}
 
-		s := component.Spec{
+		s := cargo.BOSHReleaseTarballSpecification{
 			Name:             "test",
 			Version:          "~2.0",
 			GitHubRepository: "git@github.com:test-org/test.git",
@@ -489,7 +489,7 @@ func TestGetLatestMatchingRelease(t *testing.T) {
 			},
 		}
 
-		s := component.Spec{
+		s := cargo.BOSHReleaseTarballSpecification{
 			Name:             "test",
 			Version:          "~2.0",
 			GitHubRepository: "git@github.com:test-org/test.git",
@@ -508,7 +508,7 @@ func TestGetLatestMatchingRelease(t *testing.T) {
 			otherGitHubOrg = "orange"
 
 			ctx  = context.Background()
-			spec = cargo.ComponentSpec{
+			spec = cargo.BOSHReleaseTarballSpecification{
 				GitHubRepository: "https://github.com/" + otherGitHubOrg + "/muffin",
 			}
 		)
@@ -538,7 +538,7 @@ func TestDownloadReleaseAsset(t *testing.T) {
 		GithubToken: os.Getenv("GITHUB_TOKEN"),
 		Org:         "cloudfoundry",
 	})
-	testLock, err := grs.GetMatchedRelease(component.Spec{Name: "routing", Version: "0.226.0", GitHubRepository: "https://github.com/cloudfoundry/routing-release"})
+	testLock, err := grs.GetMatchedRelease(cargo.BOSHReleaseTarballSpecification{Name: "routing", Version: "0.226.0", GitHubRepository: "https://github.com/cloudfoundry/routing-release"})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/component/local_release_directory.go b/internal/component/local_release_directory.go
index d1b2a63c6..3f8e33863 100644
--- a/internal/component/local_release_directory.go
+++ b/internal/component/local_release_directory.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/pivotal-cf/kiln/internal/baking"
 	"github.com/pivotal-cf/kiln/internal/builder"
+	"github.com/pivotal-cf/kiln/pkg/cargo"
 )
 
 type LocalReleaseDirectory struct {
@@ -38,7 +39,7 @@ func (l LocalReleaseDirectory) GetLocalReleases(releasesDir string) ([]Local, er
 
 	for _, rel := range rawReleases {
 		rm := rel.Metadata.(builder.ReleaseManifest)
-		lock := Lock{Name: rm.Name, Version: rm.Version, StemcellOS: rm.StemcellOS, StemcellVersion: rm.StemcellVersion}
+		lock := cargo.BOSHReleaseTarballLock{Name: rm.Name, Version: rm.Version, StemcellOS: rm.StemcellOS, StemcellVersion: rm.StemcellVersion}
 
 		lock.SHA1, err = CalculateSum(rel.File, osfs.New(""))
 		if err != nil {
@@ -88,11 +89,11 @@ func (l LocalReleaseDirectory) deleteReleases(releasesToDelete []Local) error {
 	for _, release := range releasesToDelete {
 		err := os.Remove(release.LocalPath)
 		if err != nil {
-			l.logger.Printf("error removing release %s: %v\n", release.Name, err)
-			return fmt.Errorf("failed to delete release %s", release.Name)
+			l.logger.Printf("error removing release %s: %v\n", release.Lock.Name, err)
+			return fmt.Errorf("failed to delete release %s", release.Lock.Name)
 		}
 
-		l.logger.Printf("removed release %s\n", release.Name)
+		l.logger.Printf("removed release %s\n", release.Lock.Name)
 	}
 
 	return nil
diff --git a/internal/component/local_release_directory_test.go b/internal/component/local_release_directory_test.go
index 4479a2398..4ed796bf3 100644
--- a/internal/component/local_release_directory_test.go
+++ b/internal/component/local_release_directory_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/pivotal-cf/kiln/internal/baking"
 	"github.com/pivotal-cf/kiln/internal/builder"
 	"github.com/pivotal-cf/kiln/internal/component"
+	"github.com/pivotal-cf/kiln/pkg/cargo"
 )
 
 var _ = Describe("LocalReleaseDirectory", func() {
@@ -63,7 +64,7 @@ var _ = Describe("LocalReleaseDirectory", func() {
 				Expect(releases).To(HaveLen(1))
 				Expect(releases).To(ConsistOf(
 					component.Local{
-						Lock: component.Lock{
+						Lock: cargo.BOSHReleaseTarballLock{
 							Name:            "some-release",
 							Version:         "1.2.3",
 							SHA1:            "6d96f7c98610fa6d8e7f45271111221b5b8497a2",
@@ -106,7 +107,7 @@ var _ = Describe("LocalReleaseDirectory", func() {
 		})
 
 		It("deletes specified files", func() {
-			extraReleaseID := component.Spec{Name: "extra-release", Version: "0.0"}
+			extraReleaseID := cargo.BOSHReleaseTarballSpecification{Name: "extra-release", Version: "0.0"}
 			extraRelease := component.Local{Lock: extraReleaseID.Lock(), LocalPath: extraFilePath}
 
 			err := localReleaseDirectory.DeleteExtraReleases([]component.Local{extraRelease}, noConfirm)
@@ -117,10 +118,10 @@ var _ = Describe("LocalReleaseDirectory", func() {
 		})
 
 		It("sorts the list of releases to be deleted", func() {
-			extraReleaseID := component.Spec{Name: "extra-release", Version: "0.0"}
+			extraReleaseID := cargo.BOSHReleaseTarballSpecification{Name: "extra-release", Version: "0.0"}
 			extraRelease := component.Local{Lock: extraReleaseID.Lock(), LocalPath: extraFilePath}
 
-			zReleaseID := component.Spec{Name: "z-release", Version: "0.0"}
+			zReleaseID := cargo.BOSHReleaseTarballSpecification{Name: "z-release", Version: "0.0"}
 			zRelease := component.Local{Lock: zReleaseID.Lock(), LocalPath: zFilePath}
 
 			result := fmt.Sprintf("- %s\n- %s", extraFilePath, zFilePath)
@@ -132,7 +133,7 @@ var _ = Describe("LocalReleaseDirectory", func() {
 
 		Context("when a file cannot be removed", func() {
 			It("returns an error", func() {
-				extraReleaseID := component.Spec{Name: "extra-release-that-cannot-be-deleted", Version: "0.0"}
+				extraReleaseID := cargo.BOSHReleaseTarballSpecification{Name: "extra-release-that-cannot-be-deleted", Version: "0.0"}
 				extraRelease := component.Local{Lock: extraReleaseID.Lock(), LocalPath: "file-does-not-exist"}
 
 				err := localReleaseDirectory.DeleteExtraReleases([]component.Local{extraRelease}, noConfirm)
diff --git a/internal/component/release_source.go b/internal/component/release_source.go
index 9e605bfa1..f0214fa83 100644
--- a/internal/component/release_source.go
+++ b/internal/component/release_source.go
@@ -11,9 +11,9 @@ import (
 // MultiReleaseSource wraps a set of release sources. It is mostly used to generate fakes
 // for testing commands. See ReleaseSourceList for the concrete implementation.
 type MultiReleaseSource interface {
-	GetMatchedRelease(Spec) (Lock, error)
-	FindReleaseVersion(spec Spec, noDownload bool) (Lock, error)
-	DownloadRelease(releasesDir string, remoteRelease Lock) (Local, error)
+	GetMatchedRelease(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)
+	FindReleaseVersion(spec cargo.BOSHReleaseTarballSpecification, noDownload bool) (cargo.BOSHReleaseTarballLock, error)
+	DownloadRelease(releasesDir string, remoteRelease cargo.BOSHReleaseTarballLock) (Local, error)
 
 	FindByID(string) (ReleaseSource, error)
 
@@ -27,8 +27,8 @@ type MultiReleaseSource interface {
 // should implement this interface. Credentials for this should come from an interpolated
 // cargo.ReleaseSourceConfig.
 type ReleaseUploader interface {
-	GetMatchedRelease(Spec) (Lock, error)
-	UploadRelease(spec Spec, file io.Reader) (Lock, error)
+	GetMatchedRelease(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)
+	UploadRelease(spec cargo.BOSHReleaseTarballSpecification, file io.Reader) (cargo.BOSHReleaseTarballLock, error)
 }
 
 //counterfeiter:generate -o ./fakes/release_uploader.go --fake-name ReleaseUploader . ReleaseUploader
@@ -38,7 +38,7 @@ type ReleaseUploader interface {
 //
 // This interface may be ripe for removal.
 type RemotePather interface {
-	RemotePath(Spec) (string, error)
+	RemotePath(cargo.BOSHReleaseTarballSpecification) (string, error)
 }
 
 //counterfeiter:generate -o ./fakes/remote_pather.go --fake-name RemotePather . RemotePather
@@ -52,16 +52,16 @@ type ReleaseSource interface {
 
 	// GetMatchedRelease uses the Name and Version and if supported StemcellOS and StemcellVersion
 	// fields on Requirement to download a specific release.
-	GetMatchedRelease(Spec) (Lock, error)
+	GetMatchedRelease(cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error)
 
 	// FindReleaseVersion may use any of the fields on Requirement to return the best matching
 	// release.
-	FindReleaseVersion(spec Spec, noDownload bool) (Lock, error)
+	FindReleaseVersion(spec cargo.BOSHReleaseTarballSpecification, noDownload bool) (cargo.BOSHReleaseTarballLock, error)
 
 	// DownloadRelease downloads the release and writes the resulting file to the releasesDir.
 	// It should also calculate and set the SHA1 field on the Local result; it does not need
 	// to ensure the sums match, the caller must verify this.
-	DownloadRelease(releasesDir string, remoteRelease Lock) (Local, error)
+	DownloadRelease(releasesDir string, remoteRelease cargo.BOSHReleaseTarballLock) (Local, error)
 }
 
 //counterfeiter:generate -o ./fakes/release_source.go --fake-name ReleaseSource . ReleaseSource
@@ -73,16 +73,16 @@ const (
 
 // TODO: use the constants from "cargo" everywhere
 const (
-	ReleaseSourceTypeBOSHIO      = cargo.ReleaseSourceTypeBOSHIO
-	ReleaseSourceTypeS3          = cargo.ReleaseSourceTypeS3
-	ReleaseSourceTypeGithub      = cargo.ReleaseSourceTypeGithub
-	ReleaseSourceTypeArtifactory = cargo.ReleaseSourceTypeArtifactory
+	ReleaseSourceTypeBOSHIO      = cargo.BOSHReleaseTarballSourceTypeBOSHIO
+	ReleaseSourceTypeS3          = cargo.BOSHReleaseTarballSourceTypeS3
+	ReleaseSourceTypeGithub      = cargo.BOSHReleaseTarballSourceTypeGithub
+	ReleaseSourceTypeArtifactory = cargo.BOSHReleaseTarballSourceTypeArtifactory
 )
 
 // ReleaseSourceFactory returns a configured ReleaseSource based on the Type field on the
 // cargo.ReleaseSourceConfig structure.
 func ReleaseSourceFactory(releaseConfig cargo.ReleaseSourceConfig, outLogger *log.Logger) ReleaseSource {
-	releaseConfig.ID = cargo.ReleaseSourceID(releaseConfig)
+	releaseConfig.ID = cargo.BOSHReleaseTarballSourceID(releaseConfig)
 	switch releaseConfig.Type {
 	case ReleaseSourceTypeBOSHIO:
 		return NewBOSHIOReleaseSource(releaseConfig, "", outLogger)
diff --git a/internal/component/release_source_list.go b/internal/component/release_source_list.go
index 9188272b1..658c04c9a 100644
--- a/internal/component/release_source_list.go
+++ b/internal/component/release_source_list.go
@@ -115,18 +115,18 @@ func NewMultiReleaseSource(sources ...ReleaseSource) ReleaseSourceList {
 	return sources
 }
 
-func (list ReleaseSourceList) GetMatchedRelease(requirement Spec) (Lock, error) {
+func (list ReleaseSourceList) GetMatchedRelease(requirement cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 	for _, src := range list {
 		rel, err := src.GetMatchedRelease(requirement)
 		if err != nil {
 			if IsErrNotFound(err) {
 				continue
 			}
-			return Lock{}, scopedError(src.Configuration().ID, err)
+			return cargo.BOSHReleaseTarballLock{}, scopedError(src.Configuration().ID, err)
 		}
 		return rel, nil
 	}
-	return Lock{}, ErrNotFound
+	return cargo.BOSHReleaseTarballLock{}, ErrNotFound
 }
 
 func (list ReleaseSourceList) SetDownloadThreads(n int) {
@@ -139,7 +139,7 @@ func (list ReleaseSourceList) SetDownloadThreads(n int) {
 	}
 }
 
-func (list ReleaseSourceList) DownloadRelease(releaseDir string, remoteRelease Lock) (Local, error) {
+func (list ReleaseSourceList) DownloadRelease(releaseDir string, remoteRelease cargo.BOSHReleaseTarballLock) (Local, error) {
 	src, err := list.FindByID(remoteRelease.RemoteSource)
 	if err != nil {
 		return Local{}, err
@@ -153,30 +153,30 @@ func (list ReleaseSourceList) DownloadRelease(releaseDir string, remoteRelease L
 	return localRelease, nil
 }
 
-func (list ReleaseSourceList) FindReleaseVersion(requirement Spec, noDownload bool) (Lock, error) {
-	var foundReleaseLock []Lock
+func (list ReleaseSourceList) FindReleaseVersion(requirement cargo.BOSHReleaseTarballSpecification, noDownload bool) (cargo.BOSHReleaseTarballLock, error) {
+	var foundReleaseLock []cargo.BOSHReleaseTarballLock
 	for _, src := range list {
 		rel, err := src.FindReleaseVersion(requirement, noDownload)
 		if err != nil {
 			if !IsErrNotFound(err) {
-				return Lock{}, scopedError(src.Configuration().ID, err)
+				return cargo.BOSHReleaseTarballLock{}, scopedError(src.Configuration().ID, err)
 			}
 			continue
 		}
 		foundReleaseLock = append(foundReleaseLock, rel)
 	}
 	if len(foundReleaseLock) == 0 {
-		return Lock{}, ErrNotFound
+		return cargo.BOSHReleaseTarballLock{}, ErrNotFound
 	}
 	highestLock := foundReleaseLock[0]
 	highestVersion, err := highestLock.ParseVersion()
 	if err != nil {
-		return Lock{}, fmt.Errorf("failed to parse version from release source: %w", err)
+		return cargo.BOSHReleaseTarballLock{}, fmt.Errorf("failed to parse version from release source: %w", err)
 	}
 	for _, rel := range foundReleaseLock[1:] {
 		newVersion, err := semver.NewVersion(rel.Version)
 		if err != nil {
-			return Lock{}, fmt.Errorf("failed to parse version from release source: %w", err)
+			return cargo.BOSHReleaseTarballLock{}, fmt.Errorf("failed to parse version from release source: %w", err)
 		}
 		if highestVersion.LessThan(newVersion) {
 			highestVersion = newVersion
diff --git a/internal/component/release_source_list_test.go b/internal/component/release_source_list_test.go
index cec1660a9..f462a1807 100644
--- a/internal/component/release_source_list_test.go
+++ b/internal/component/release_source_list_test.go
@@ -15,7 +15,7 @@ var _ = Describe("multiReleaseSource", func() {
 	var (
 		multiSrc         component.MultiReleaseSource
 		src1, src2, src3 *fakes.ReleaseSource
-		requirement      component.Spec
+		requirement      cargo.BOSHReleaseTarballSpecification
 	)
 
 	const (
@@ -33,7 +33,7 @@ var _ = Describe("multiReleaseSource", func() {
 		src3.ConfigurationReturns(cargo.ReleaseSourceConfig{ID: "src-3"})
 		multiSrc = component.NewMultiReleaseSource(src1, src2, src3)
 
-		requirement = component.Spec{
+		requirement = cargo.BOSHReleaseTarballSpecification{
 			Name:            releaseName,
 			Version:         releaseVersion,
 			StemcellOS:      "not-used",
@@ -43,17 +43,17 @@ var _ = Describe("multiReleaseSource", func() {
 
 	Describe("GetMatchedRelease", func() {
 		When("one of the release sources has a match", func() {
-			var matchedRelease component.Lock
+			var matchedRelease cargo.BOSHReleaseTarballLock
 
 			BeforeEach(func() {
-				matchedRelease = component.Lock{
+				matchedRelease = cargo.BOSHReleaseTarballLock{
 					Name:         releaseName,
 					Version:      releaseVersion,
 					RemotePath:   "/some/path",
 					RemoteSource: src2.Configuration().ID,
 				}
-				src1.GetMatchedReleaseReturns(component.Lock{}, component.ErrNotFound)
-				src3.GetMatchedReleaseReturns(component.Lock{}, component.ErrNotFound)
+				src1.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
+				src3.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
 				src2.GetMatchedReleaseReturns(matchedRelease, nil)
 			})
 
@@ -66,9 +66,9 @@ var _ = Describe("multiReleaseSource", func() {
 
 		When("none of the release sources has a match", func() {
 			BeforeEach(func() {
-				src1.GetMatchedReleaseReturns(component.Lock{}, component.ErrNotFound)
-				src3.GetMatchedReleaseReturns(component.Lock{}, component.ErrNotFound)
-				src2.GetMatchedReleaseReturns(component.Lock{}, component.ErrNotFound)
+				src1.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
+				src3.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
+				src2.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
 			})
 			It("returns no match", func() {
 				_, err := multiSrc.GetMatchedRelease(requirement)
@@ -82,7 +82,7 @@ var _ = Describe("multiReleaseSource", func() {
 
 			BeforeEach(func() {
 				expectedErr = errors.New("bad stuff happened")
-				src1.GetMatchedReleaseReturns(component.Lock{}, expectedErr)
+				src1.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, expectedErr)
 			})
 
 			It("returns that error", func() {
@@ -95,12 +95,12 @@ var _ = Describe("multiReleaseSource", func() {
 
 	Describe("DownloadRelease", func() {
 		var (
-			releaseID component.Spec
-			remote    component.Lock
+			releaseID cargo.BOSHReleaseTarballSpecification
+			remote    cargo.BOSHReleaseTarballLock
 		)
 
 		BeforeEach(func() {
-			releaseID = component.Spec{Name: releaseName, Version: releaseVersion}
+			releaseID = cargo.BOSHReleaseTarballSpecification{Name: releaseName, Version: releaseVersion}
 			remote = releaseID.Lock().WithRemote(src2.Configuration().ID, "/some/remote/path")
 		})
 
@@ -188,18 +188,18 @@ var _ = Describe("multiReleaseSource", func() {
 
 	Describe("FindReleaseVersion", func() {
 		When("one of the release sources has a match", func() {
-			var matchedRelease component.Lock
+			var matchedRelease cargo.BOSHReleaseTarballLock
 
 			BeforeEach(func() {
-				matchedRelease = component.Lock{
+				matchedRelease = cargo.BOSHReleaseTarballLock{
 					Name:         releaseName,
 					Version:      releaseVersion,
 					RemotePath:   "/some/path",
 					RemoteSource: src2.Configuration().ID,
 				}
-				src1.FindReleaseVersionReturns(component.Lock{}, component.ErrNotFound)
+				src1.FindReleaseVersionReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
 				src2.FindReleaseVersionReturns(matchedRelease, nil)
-				src3.FindReleaseVersionReturns(component.Lock{}, component.ErrNotFound)
+				src3.FindReleaseVersionReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
 			})
 
 			It("returns that match", func() {
@@ -209,16 +209,16 @@ var _ = Describe("multiReleaseSource", func() {
 			})
 		})
 		When("two of the release sources have a match", func() {
-			var matchedRelease component.Lock
+			var matchedRelease cargo.BOSHReleaseTarballLock
 
 			BeforeEach(func() {
-				unmatchedRelease := component.Lock{
+				unmatchedRelease := cargo.BOSHReleaseTarballLock{
 					Name:         releaseName,
 					Version:      releaseVersion,
 					RemotePath:   "/some/path",
 					RemoteSource: src1.Configuration().ID,
 				}
-				matchedRelease = component.Lock{
+				matchedRelease = cargo.BOSHReleaseTarballLock{
 					Name:         releaseName,
 					Version:      releaseVersionNewer,
 					RemotePath:   "/some/path",
@@ -226,7 +226,7 @@ var _ = Describe("multiReleaseSource", func() {
 				}
 				src1.FindReleaseVersionReturns(unmatchedRelease, nil)
 				src2.FindReleaseVersionReturns(matchedRelease, nil)
-				src3.FindReleaseVersionReturns(component.Lock{}, component.ErrNotFound)
+				src3.FindReleaseVersionReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
 			})
 
 			It("returns that match", func() {
@@ -236,16 +236,16 @@ var _ = Describe("multiReleaseSource", func() {
 			})
 		})
 		When("two of the release sources match the same version", func() {
-			var matchedRelease component.Lock
+			var matchedRelease cargo.BOSHReleaseTarballLock
 
 			BeforeEach(func() {
-				matchedRelease = component.Lock{
+				matchedRelease = cargo.BOSHReleaseTarballLock{
 					Name:         releaseName,
 					Version:      releaseVersion,
 					RemotePath:   "/some/path",
 					RemoteSource: src1.Configuration().ID,
 				}
-				unmatchedRelease := component.Lock{
+				unmatchedRelease := cargo.BOSHReleaseTarballLock{
 					Name:         releaseName,
 					Version:      releaseVersion,
 					RemotePath:   "/some/path",
@@ -253,7 +253,7 @@ var _ = Describe("multiReleaseSource", func() {
 				}
 				src1.FindReleaseVersionReturns(matchedRelease, nil)
 				src2.FindReleaseVersionReturns(unmatchedRelease, nil)
-				src3.FindReleaseVersionReturns(component.Lock{}, component.ErrNotFound)
+				src3.FindReleaseVersionReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
 			})
 
 			It("returns the match from the first source", func() {
diff --git a/internal/component/s3_release_source.go b/internal/component/s3_release_source.go
index 474ccf38b..b21f569d4 100644
--- a/internal/component/s3_release_source.go
+++ b/internal/component/s3_release_source.go
@@ -103,10 +103,10 @@ func (src S3ReleaseSource) Publishable() bool                        { return sr
 func (src S3ReleaseSource) Configuration() cargo.ReleaseSourceConfig { return src.ReleaseSourceConfig }
 
 //counterfeiter:generate -o ./fakes/s3_request_failure.go --fake-name S3RequestFailure github.com/aws/aws-sdk-go/service/s3.RequestFailure
-func (src S3ReleaseSource) GetMatchedRelease(spec Spec) (Lock, error) {
+func (src S3ReleaseSource) GetMatchedRelease(spec cargo.BOSHReleaseTarballSpecification) (cargo.BOSHReleaseTarballLock, error) {
 	remotePath, err := src.RemotePath(spec)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	headRequest := new(s3.HeadObjectInput)
@@ -117,12 +117,12 @@ func (src S3ReleaseSource) GetMatchedRelease(spec Spec) (Lock, error) {
 	if err != nil {
 		requestFailure, ok := err.(s3.RequestFailure)
 		if ok && requestFailure.StatusCode() == 404 {
-			return Lock{}, ErrNotFound
+			return cargo.BOSHReleaseTarballLock{}, ErrNotFound
 		}
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
-	return Lock{
+	return cargo.BOSHReleaseTarballLock{
 		Name:         spec.Name,
 		Version:      spec.Version,
 		RemotePath:   remotePath,
@@ -130,7 +130,7 @@ func (src S3ReleaseSource) GetMatchedRelease(spec Spec) (Lock, error) {
 	}, nil
 }
 
-func (src S3ReleaseSource) FindReleaseVersion(spec Spec, noDownload bool) (Lock, error) {
+func (src S3ReleaseSource) FindReleaseVersion(spec cargo.BOSHReleaseTarballSpecification, noDownload bool) (cargo.BOSHReleaseTarballLock, error) {
 	pathTemplatePattern, _ := regexp.Compile(`^\d+\.\d+`)
 	tasVersion := pathTemplatePattern.FindString(src.ReleaseSourceConfig.PathTemplate)
 	var prefix string
@@ -144,18 +144,18 @@ func (src S3ReleaseSource) FindReleaseVersion(spec Spec, noDownload bool) (Lock,
 		Prefix: &prefix,
 	})
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	semverPattern, err := regexp.Compile(`([-v])\d+(.\d+)*`)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
-	foundRelease := Lock{}
+	foundRelease := cargo.BOSHReleaseTarballLock{}
 	constraint, err := spec.VersionConstraints()
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	for _, result := range releaseResults.Contents {
@@ -174,8 +174,8 @@ func (src S3ReleaseSource) FindReleaseVersion(spec Spec, noDownload bool) (Lock,
 				continue
 			}
 
-			if (foundRelease == Lock{}) {
-				foundRelease = Lock{
+			if (foundRelease == cargo.BOSHReleaseTarballLock{}) {
+				foundRelease = cargo.BOSHReleaseTarballLock{
 					Name:         spec.Name,
 					Version:      version,
 					RemotePath:   *result.Key,
@@ -184,7 +184,7 @@ func (src S3ReleaseSource) FindReleaseVersion(spec Spec, noDownload bool) (Lock,
 			} else {
 				foundVersion, _ := semver.NewVersion(foundRelease.Version)
 				if newVersion.GreaterThan(foundVersion) {
-					foundRelease = Lock{
+					foundRelease = cargo.BOSHReleaseTarballLock{
 						Name:         spec.Name,
 						Version:      version,
 						RemotePath:   *result.Key,
@@ -194,8 +194,8 @@ func (src S3ReleaseSource) FindReleaseVersion(spec Spec, noDownload bool) (Lock,
 			}
 		}
 	}
-	if (foundRelease == Lock{}) {
-		return Lock{}, ErrNotFound
+	if (foundRelease == cargo.BOSHReleaseTarballLock{}) {
+		return cargo.BOSHReleaseTarballLock{}, ErrNotFound
 	}
 
 	if noDownload {
@@ -204,14 +204,14 @@ func (src S3ReleaseSource) FindReleaseVersion(spec Spec, noDownload bool) (Lock,
 		var releaseLocal Local
 		releaseLocal, err = src.DownloadRelease("/tmp", foundRelease)
 		if err != nil {
-			return Lock{}, err
+			return cargo.BOSHReleaseTarballLock{}, err
 		}
-		foundRelease.SHA1 = releaseLocal.SHA1
+		foundRelease.SHA1 = releaseLocal.Lock.SHA1
 	}
 	return foundRelease, nil
 }
 
-func (src S3ReleaseSource) DownloadRelease(releaseDir string, lock Lock) (Local, error) {
+func (src S3ReleaseSource) DownloadRelease(releaseDir string, lock cargo.BOSHReleaseTarballLock) (Local, error) {
 	setConcurrency := func(dl *s3manager.Downloader) {
 		if src.DownloadThreads > 0 {
 			dl.Concurrency = src.DownloadThreads
@@ -254,10 +254,10 @@ func (src S3ReleaseSource) DownloadRelease(releaseDir string, lock Lock) (Local,
 	return Local{Lock: lock, LocalPath: outputFile}, nil
 }
 
-func (src S3ReleaseSource) UploadRelease(spec Spec, file io.Reader) (Lock, error) {
+func (src S3ReleaseSource) UploadRelease(spec cargo.BOSHReleaseTarballSpecification, file io.Reader) (cargo.BOSHReleaseTarballLock, error) {
 	remotePath, err := src.RemotePath(spec)
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
 	src.logger.Printf("uploading release %q to %s at %q...\n", spec.Name, src.ReleaseSourceConfig.Bucket, remotePath)
@@ -268,10 +268,10 @@ func (src S3ReleaseSource) UploadRelease(spec Spec, file io.Reader) (Lock, error
 		Body:   file,
 	})
 	if err != nil {
-		return Lock{}, err
+		return cargo.BOSHReleaseTarballLock{}, err
 	}
 
-	return Lock{
+	return cargo.BOSHReleaseTarballLock{
 		Name:         spec.Name,
 		Version:      spec.Version,
 		RemotePath:   remotePath,
@@ -279,7 +279,7 @@ func (src S3ReleaseSource) UploadRelease(spec Spec, file io.Reader) (Lock, error
 	}, nil
 }
 
-func (src S3ReleaseSource) RemotePath(spec Spec) (string, error) {
+func (src S3ReleaseSource) RemotePath(spec cargo.BOSHReleaseTarballSpecification) (string, error) {
 	pathBuf := new(bytes.Buffer)
 
 	err := src.pathTemplate().Execute(pathBuf, spec)
diff --git a/internal/component/s3_release_source_test.go b/internal/component/s3_release_source_test.go
index 204041700..e2c259939 100644
--- a/internal/component/s3_release_source_test.go
+++ b/internal/component/s3_release_source_test.go
@@ -91,9 +91,9 @@ var _ = Describe("S3ReleaseSource", func() {
 			releaseSource         component.S3ReleaseSource
 			logger                *log.Logger
 			releaseDir            string
-			remoteRelease         component.Lock
+			remoteRelease         cargo.BOSHReleaseTarballLock
 			expectedLocalFilename string
-			releaseID             component.Spec
+			releaseID             cargo.BOSHReleaseTarballSpecification
 			fakeS3Downloader      *fetcherFakes.S3Downloader
 		)
 
@@ -103,7 +103,7 @@ var _ = Describe("S3ReleaseSource", func() {
 			releaseDir, err = os.MkdirTemp("", "kiln-releaseSource-test")
 			Expect(err).NotTo(HaveOccurred())
 
-			releaseID = component.Spec{Name: "uaa", Version: "1.2.3"}
+			releaseID = cargo.BOSHReleaseTarballSpecification{Name: "uaa", Version: "1.2.3"}
 			remoteRelease = releaseID.Lock().WithRemote(bucket, "2.10/uaa/uaa-1.2.3-ubuntu-xenial-621.55.tgz")
 			expectedLocalFilename = filepath.Base(remoteRelease.RemotePath)
 
@@ -192,15 +192,15 @@ var _ = Describe("S3ReleaseSource", func() {
 		var (
 			releaseSource  component.S3ReleaseSource
 			fakeS3Client   *fetcherFakes.S3Client
-			desiredRelease component.Spec
-			bpmReleaseID   component.Spec
+			desiredRelease cargo.BOSHReleaseTarballSpecification
+			bpmReleaseID   cargo.BOSHReleaseTarballSpecification
 			bpmKey         string
 			logger         *log.Logger
 		)
 
 		BeforeEach(func() {
-			bpmReleaseID = component.Spec{Name: "bpm-release", Version: "1.2.3"}
-			desiredRelease = component.Spec{
+			bpmReleaseID = cargo.BOSHReleaseTarballSpecification{Name: "bpm-release", Version: "1.2.3"}
+			desiredRelease = cargo.BOSHReleaseTarballSpecification{
 				Name:            "bpm-release",
 				Version:         "1.2.3",
 				StemcellOS:      "ubuntu-xenial",
@@ -235,7 +235,7 @@ var _ = Describe("S3ReleaseSource", func() {
 			Expect(input.Bucket).To(PointTo(BeEquivalentTo(bucket)))
 			Expect(input.Key).To(PointTo(BeEquivalentTo(bpmKey)))
 
-			Expect(remoteRelease).To(Equal(component.Lock{
+			Expect(remoteRelease).To(Equal(cargo.BOSHReleaseTarballLock{
 				Name:         bpmReleaseID.Name,
 				Version:      bpmReleaseID.Version,
 				RemotePath:   bpmKey,
@@ -288,15 +288,15 @@ var _ = Describe("S3ReleaseSource", func() {
 			releaseSource    component.S3ReleaseSource
 			fakeS3Client     *fetcherFakes.S3Client
 			fakeS3Downloader *fetcherFakes.S3Downloader
-			desiredRelease   component.Spec
-			releaseID        component.Spec
+			desiredRelease   cargo.BOSHReleaseTarballSpecification
+			releaseID        cargo.BOSHReleaseTarballSpecification
 			uaaKey           string
 			logger           *log.Logger
 		)
 		When("version is semantic and release has version constraint", func() {
 			BeforeEach(func() {
-				releaseID = component.Spec{Name: "uaa", Version: "1.1.1"}
-				desiredRelease = component.Spec{
+				releaseID = cargo.BOSHReleaseTarballSpecification{Name: "uaa", Version: "1.1.1"}
+				desiredRelease = cargo.BOSHReleaseTarballSpecification{
 					Name:            "uaa",
 					Version:         "~1.1",
 					StemcellVersion: "621.71",
@@ -357,8 +357,8 @@ var _ = Describe("S3ReleaseSource", func() {
 
 		When("version is a single number", func() {
 			BeforeEach(func() {
-				releaseID = component.Spec{Name: "uaa", Version: "123"}
-				desiredRelease = component.Spec{
+				releaseID = cargo.BOSHReleaseTarballSpecification{Name: "uaa", Version: "123"}
+				desiredRelease = cargo.BOSHReleaseTarballSpecification{
 					Name:            "uaa",
 					StemcellVersion: "621.71",
 				}
@@ -408,7 +408,7 @@ var _ = Describe("S3ReleaseSource", func() {
 				input := fakeS3Client.ListObjectsV2ArgsForCall(0)
 				Expect(*input.Prefix).To(Equal("uaa/"))
 
-				Expect(remoteRelease).To(Equal(component.Lock{
+				Expect(remoteRelease).To(Equal(cargo.BOSHReleaseTarballLock{
 					Name:         releaseID.Name,
 					Version:      releaseID.Version,
 					RemotePath:   uaaKey,
@@ -420,8 +420,8 @@ var _ = Describe("S3ReleaseSource", func() {
 
 		When("noDownload is specified", func() {
 			BeforeEach(func() {
-				releaseID = component.Spec{Name: "uaa", Version: "123"}
-				desiredRelease = component.Spec{
+				releaseID = cargo.BOSHReleaseTarballSpecification{Name: "uaa", Version: "123"}
+				desiredRelease = cargo.BOSHReleaseTarballSpecification{
 					Name:            "uaa",
 					StemcellVersion: "621.71",
 				}
@@ -470,7 +470,7 @@ var _ = Describe("S3ReleaseSource", func() {
 				input := fakeS3Client.ListObjectsV2ArgsForCall(0)
 				Expect(*input.Prefix).To(Equal("uaa/"))
 
-				Expect(remoteRelease).To(Equal(component.Lock{
+				Expect(remoteRelease).To(Equal(cargo.BOSHReleaseTarballLock{
 					Name:         releaseID.Name,
 					Version:      releaseID.Version,
 					RemotePath:   uaaKey,
@@ -487,15 +487,15 @@ var _ = Describe("S3ReleaseSource", func() {
 		var (
 			releaseSource  component.S3ReleaseSource
 			fakeS3Client   *fetcherFakes.S3Client
-			desiredRelease component.Spec
-			releaseID      component.Spec
+			desiredRelease cargo.BOSHReleaseTarballSpecification
+			releaseID      cargo.BOSHReleaseTarballSpecification
 			uaaKey         string
 			logger         *log.Logger
 		)
 		When("version is semantic and has 2 latest versions with different stemcell versions", func() {
 			BeforeEach(func() {
-				releaseID = component.Spec{Name: "uaa", Version: "1.2.3"}
-				desiredRelease = component.Spec{
+				releaseID = cargo.BOSHReleaseTarballSpecification{Name: "uaa", Version: "1.2.3"}
+				desiredRelease = cargo.BOSHReleaseTarballSpecification{
 					Name:            "uaa",
 					StemcellVersion: "621.71",
 				}
@@ -576,7 +576,7 @@ var _ = Describe("S3ReleaseSource", func() {
 
 		Context("happy path", func() {
 			It("uploads the file to the correct location", func() {
-				_, err := releaseSource.UploadRelease(component.Spec{
+				_, err := releaseSource.UploadRelease(cargo.BOSHReleaseTarballSpecification{
 					Name:    "banana",
 					Version: "1.2.3",
 				}, file)
@@ -594,13 +594,13 @@ var _ = Describe("S3ReleaseSource", func() {
 			})
 
 			It("returns the remote release", func() {
-				remoteRelease, err := releaseSource.UploadRelease(component.Spec{
+				remoteRelease, err := releaseSource.UploadRelease(cargo.BOSHReleaseTarballSpecification{
 					Name:    "banana",
 					Version: "1.2.3",
 				}, file)
 				Expect(err).NotTo(HaveOccurred())
 
-				Expect(remoteRelease).To(Equal(component.Lock{
+				Expect(remoteRelease).To(Equal(cargo.BOSHReleaseTarballLock{
 					Name:         "banana",
 					Version:      "1.2.3",
 					RemotePath:   "banana/banana-1.2.3.tgz",
@@ -626,7 +626,7 @@ var _ = Describe("S3ReleaseSource", func() {
 			})
 
 			It("returns a descriptive error", func() {
-				_, err := releaseSource.UploadRelease(component.Spec{
+				_, err := releaseSource.UploadRelease(cargo.BOSHReleaseTarballSpecification{
 					Name:    "banana",
 					Version: "1.2.3",
 				}, file)
@@ -639,7 +639,7 @@ var _ = Describe("S3ReleaseSource", func() {
 	Describe("RemotePath", func() {
 		var (
 			releaseSource component.S3ReleaseSource
-			requirement   component.Spec
+			requirement   cargo.BOSHReleaseTarballSpecification
 		)
 
 		BeforeEach(func() {
@@ -655,7 +655,7 @@ var _ = Describe("S3ReleaseSource", func() {
 				nil,
 				log.New(GinkgoWriter, "", 0),
 			)
-			requirement = component.Spec{
+			requirement = cargo.BOSHReleaseTarballSpecification{
 				Name:            "bob",
 				Version:         "2.0",
 				StemcellOS:      "plan9",
diff --git a/pkg/cargo/bump.go b/pkg/cargo/bump.go
index 07025fa02..d81c3f950 100644
--- a/pkg/cargo/bump.go
+++ b/pkg/cargo/bump.go
@@ -53,10 +53,10 @@ func deduplicateReleasesWithTheSameTagName(bump Bump) Bump {
 	return updated
 }
 
-func CalculateBumps(current, previous []ComponentLock) []Bump {
+func CalculateBumps(current, previous []BOSHReleaseTarballLock) []Bump {
 	var (
 		bumps         []Bump
-		previousSpecs = make(map[string]ComponentLock, len(previous))
+		previousSpecs = make(map[string]BOSHReleaseTarballLock, len(previous))
 	)
 	for _, p := range previous {
 		previousSpecs[p.Name] = p
@@ -90,7 +90,7 @@ func (bump Bump) toFrom() (to, from *semver.Version, _ error) {
 
 type BumpList []Bump
 
-func (list BumpList) ForLock(lock ComponentLock) Bump {
+func (list BumpList) ForLock(lock BOSHReleaseTarballLock) Bump {
 	for _, b := range list {
 		if b.Name == lock.Name {
 			return b
@@ -193,7 +193,7 @@ func fetchReleasesFromRepo(ctx context.Context, repoService RepositoryReleaseLis
 }
 
 func fetchReleasesForBump(ctx context.Context, repoService RepositoryReleaseLister, kf Kilnfile, bump Bump) Bump {
-	spec, err := kf.ComponentSpec(bump.Name)
+	spec, err := kf.BOSHReleaseTarballSpecification(bump.Name)
 	if err != nil {
 		return bump
 	}
diff --git a/pkg/cargo/bump_test.go b/pkg/cargo/bump_test.go
index a14b203a9..ebc13c73f 100644
--- a/pkg/cargo/bump_test.go
+++ b/pkg/cargo/bump_test.go
@@ -18,18 +18,18 @@ func TestCalculateBumps(t *testing.T) {
 	please := NewWithT(t)
 
 	t.Run("when the components stay the same", func(t *testing.T) {
-		please.Expect(CalculateBumps([]ComponentLock{
+		please.Expect(CalculateBumps([]BOSHReleaseTarballLock{
 			{Name: "a", Version: "1"},
-		}, []ComponentLock{
+		}, []BOSHReleaseTarballLock{
 			{Name: "a", Version: "1"},
 		})).To(HaveLen(0))
 	})
 
 	t.Run("when a component is bumped", func(t *testing.T) {
-		please.Expect(CalculateBumps([]ComponentLock{
+		please.Expect(CalculateBumps([]BOSHReleaseTarballLock{
 			{Name: "a", Version: "1"},
 			{Name: "b", Version: "2"},
-		}, []ComponentLock{
+		}, []BOSHReleaseTarballLock{
 			{Name: "a", Version: "1"},
 			{Name: "b", Version: "1"},
 		})).To(Equal([]Bump{
@@ -40,11 +40,11 @@ func TestCalculateBumps(t *testing.T) {
 	})
 
 	t.Run("when many but not all components are bumped", func(t *testing.T) {
-		please.Expect(CalculateBumps([]ComponentLock{
+		please.Expect(CalculateBumps([]BOSHReleaseTarballLock{
 			{Name: "a", Version: "2"},
 			{Name: "b", Version: "1"},
 			{Name: "c", Version: "2"},
-		}, []ComponentLock{
+		}, []BOSHReleaseTarballLock{
 			{Name: "a", Version: "1"},
 			{Name: "b", Version: "1"},
 			{Name: "c", Version: "1"},
@@ -57,9 +57,9 @@ func TestCalculateBumps(t *testing.T) {
 	})
 
 	t.Run("when a component is removed", func(t *testing.T) {
-		please.Expect(CalculateBumps([]ComponentLock{
+		please.Expect(CalculateBumps([]BOSHReleaseTarballLock{
 			{Name: "a", Version: "1"},
-		}, []ComponentLock{
+		}, []BOSHReleaseTarballLock{
 			{Name: "a", Version: "1"},
 			{Name: "b", Version: "1"},
 		})).To(HaveLen(0),
@@ -71,10 +71,10 @@ func TestCalculateBumps(t *testing.T) {
 		// I'm not sure what we actually want to do here?
 		// Is this actually a bump? Not really...
 
-		please.Expect(CalculateBumps([]ComponentLock{
+		please.Expect(CalculateBumps([]BOSHReleaseTarballLock{
 			{Name: "a", Version: "1"},
 			{Name: "b", Version: "1"},
-		}, []ComponentLock{
+		}, []BOSHReleaseTarballLock{
 			{Name: "a", Version: "1"},
 		})).To(Equal([]Bump{
 			{Name: "b", FromVersion: "", ToVersion: "1"},
@@ -126,7 +126,7 @@ func TestInternal_addReleaseNotes(t *testing.T) {
 		context.Background(),
 		releaseLister,
 		Kilnfile{
-			Releases: []ComponentSpec{
+			Releases: []BOSHReleaseTarballSpecification{
 				{
 					Name: "mango",
 				},
diff --git a/pkg/cargo/kilnfile.go b/pkg/cargo/kilnfile.go
index 8e915d9cf..e7fa8da46 100644
--- a/pkg/cargo/kilnfile.go
+++ b/pkg/cargo/kilnfile.go
@@ -10,38 +10,38 @@ import (
 )
 
 type Kilnfile struct {
-	ReleaseSources  []ReleaseSourceConfig `yaml:"release_sources,omitempty"`
-	Slug            string                `yaml:"slug,omitempty"`
-	PreGaUserGroups []string              `yaml:"pre_ga_user_groups,omitempty"`
-	Releases        []ComponentSpec       `yaml:"releases,omitempty"`
-	TileNames       []string              `yaml:"tile_names,omitempty"`
-	Stemcell        Stemcell              `yaml:"stemcell_criteria,omitempty"`
+	ReleaseSources  []ReleaseSourceConfig             `yaml:"release_sources,omitempty"`
+	Slug            string                            `yaml:"slug,omitempty"`
+	PreGaUserGroups []string                          `yaml:"pre_ga_user_groups,omitempty"`
+	Releases        []BOSHReleaseTarballSpecification `yaml:"releases,omitempty"`
+	TileNames       []string                          `yaml:"tile_names,omitempty"`
+	Stemcell        Stemcell                          `yaml:"stemcell_criteria,omitempty"`
 }
 
-func (kf Kilnfile) ComponentSpec(name string) (ComponentSpec, error) {
+func (kf Kilnfile) BOSHReleaseTarballSpecification(name string) (BOSHReleaseTarballSpecification, error) {
 	for _, s := range kf.Releases {
 		if s.Name == name {
 			return s, nil
 		}
 	}
-	return ComponentSpec{}, fmt.Errorf("failed to find component specification with name %q in Kilnfile", name)
+	return BOSHReleaseTarballSpecification{}, fmt.Errorf("failed to find component specification with name %q in Kilnfile", name)
 }
 
 type KilnfileLock struct {
-	Releases []ComponentLock `yaml:"releases"`
-	Stemcell Stemcell        `yaml:"stemcell_criteria"`
+	Releases []BOSHReleaseTarballLock `yaml:"releases"`
+	Stemcell Stemcell                 `yaml:"stemcell_criteria"`
 }
 
-func (k KilnfileLock) FindReleaseWithName(name string) (ComponentLock, error) {
+func (k KilnfileLock) FindBOSHReleaseWithName(name string) (BOSHReleaseTarballLock, error) {
 	for _, r := range k.Releases {
 		if r.Name == name {
 			return r, nil
 		}
 	}
-	return ComponentLock{}, errors.New("not found")
+	return BOSHReleaseTarballLock{}, errors.New("not found")
 }
 
-func (k KilnfileLock) UpdateReleaseLockWithName(name string, lock ComponentLock) error {
+func (k KilnfileLock) UpdateBOSHReleaseTarballLockWithName(name string, lock BOSHReleaseTarballLock) error {
 	for i, r := range k.Releases {
 		if r.Name == name {
 			k.Releases[i] = lock
@@ -51,7 +51,7 @@ func (k KilnfileLock) UpdateReleaseLockWithName(name string, lock ComponentLock)
 	return errors.New("not found")
 }
 
-type ComponentSpec struct {
+type BOSHReleaseTarballSpecification struct {
 	// Name is a required field and must be set with the bosh release name
 	Name string `yaml:"name"`
 
@@ -73,7 +73,7 @@ type ComponentSpec struct {
 	GitHubRepository string `yaml:"github_repository,omitempty"`
 }
 
-func (spec ComponentSpec) VersionConstraints() (*semver.Constraints, error) {
+func (spec BOSHReleaseTarballSpecification) VersionConstraints() (*semver.Constraints, error) {
 	if spec.Version == "" {
 		spec.Version = ">=0"
 	}
@@ -84,8 +84,8 @@ func (spec ComponentSpec) VersionConstraints() (*semver.Constraints, error) {
 	return c, nil
 }
 
-func (spec ComponentSpec) Lock() ComponentLock {
-	return ComponentLock{
+func (spec BOSHReleaseTarballSpecification) Lock() BOSHReleaseTarballLock {
+	return BOSHReleaseTarballLock{
 		Name:            spec.Name,
 		Version:         spec.Version,
 		StemcellOS:      spec.StemcellOS,
@@ -93,11 +93,11 @@ func (spec ComponentSpec) Lock() ComponentLock {
 	}
 }
 
-func (spec ComponentSpec) OSVersionSlug() boshdir.OSVersionSlug {
+func (spec BOSHReleaseTarballSpecification) OSVersionSlug() boshdir.OSVersionSlug {
 	return boshdir.NewOSVersionSlug(spec.StemcellOS, spec.StemcellVersion)
 }
 
-func (spec ComponentSpec) ReleaseSlug() boshdir.ReleaseSlug {
+func (spec BOSHReleaseTarballSpecification) ReleaseSlug() boshdir.ReleaseSlug {
 	return boshdir.NewReleaseSlug(spec.Name, spec.Version)
 }
 
@@ -119,13 +119,13 @@ type ReleaseSourceConfig struct {
 	Password        string `yaml:"password,omitempty"`
 }
 
-// ComponentLock represents an exact build of a bosh release
+// BOSHReleaseTarballLock represents an exact build of a bosh release
 // It may identify the where the release is cached;
 // it may identify the stemcell used to compile the release.
 //
 // All fields must be comparable because this struct may be
 // used as a key type in a map. Don't add array or map fields.
-type ComponentLock struct {
+type BOSHReleaseTarballLock struct {
 	Name    string `yaml:"name"`
 	SHA1    string `yaml:"sha1"`
 	Version string `yaml:"version,omitempty"`
@@ -137,15 +137,15 @@ type ComponentLock struct {
 	RemotePath   string `yaml:"remote_path"`
 }
 
-func (lock ComponentLock) ReleaseSlug() boshdir.ReleaseSlug {
+func (lock BOSHReleaseTarballLock) ReleaseSlug() boshdir.ReleaseSlug {
 	return boshdir.NewReleaseSlug(lock.Name, lock.Version)
 }
 
-func (lock ComponentLock) StemcellSlug() boshdir.OSVersionSlug {
+func (lock BOSHReleaseTarballLock) StemcellSlug() boshdir.OSVersionSlug {
 	return boshdir.NewOSVersionSlug(lock.StemcellOS, lock.StemcellVersion)
 }
 
-func (lock ComponentLock) String() string {
+func (lock BOSHReleaseTarballLock) String() string {
 	var b strings.Builder
 	b.WriteString(lock.Name)
 	b.WriteByte(' ')
@@ -178,18 +178,18 @@ func (lock ComponentLock) String() string {
 	return b.String()
 }
 
-func (lock ComponentLock) WithSHA1(sum string) ComponentLock {
+func (lock BOSHReleaseTarballLock) WithSHA1(sum string) BOSHReleaseTarballLock {
 	lock.SHA1 = sum
 	return lock
 }
 
-func (lock ComponentLock) WithRemote(source, path string) ComponentLock {
+func (lock BOSHReleaseTarballLock) WithRemote(source, path string) BOSHReleaseTarballLock {
 	lock.RemoteSource = source
 	lock.RemotePath = path
 	return lock
 }
 
-func (lock ComponentLock) ParseVersion() (*semver.Version, error) {
+func (lock BOSHReleaseTarballLock) ParseVersion() (*semver.Version, error) {
 	return semver.NewVersion(lock.Version)
 }
 
diff --git a/pkg/cargo/kilnfile_test.go b/pkg/cargo/kilnfile_test.go
index 90c988b47..a66eca739 100644
--- a/pkg/cargo/kilnfile_test.go
+++ b/pkg/cargo/kilnfile_test.go
@@ -18,7 +18,7 @@ remote_path: fake/path/to/fake-component-name
 `
 	damnit := NewWithT(t)
 
-	cl, err := yaml.Marshal(ComponentLock{
+	cl, err := yaml.Marshal(BOSHReleaseTarballLock{
 		Name:         "fake-component-name",
 		Version:      "fake-version",
 		SHA1:         "fake-component-sha1",
@@ -30,10 +30,10 @@ remote_path: fake/path/to/fake-component-name
 	damnit.Expect(string(cl)).To(Equal(validComponentLockYaml))
 }
 
-func TestKilnfileLock_UpdateReleaseLockWithName(t *testing.T) {
+func TestKilnfileLock_UpdateBOSHReleaseTarballLockWithName(t *testing.T) {
 	type args struct {
 		name string
-		lock ComponentLock
+		lock BOSHReleaseTarballLock
 	}
 	tests := []struct {
 		name                         string
@@ -46,24 +46,24 @@ func TestKilnfileLock_UpdateReleaseLockWithName(t *testing.T) {
 		{
 			name: "lock with name found",
 			KilnfileLock: KilnfileLock{
-				Releases: []ComponentLock{
+				Releases: []BOSHReleaseTarballLock{
 					{Name: "banana"},
 				},
 			},
 			KilnfileResult: KilnfileLock{
-				Releases: []ComponentLock{
+				Releases: []BOSHReleaseTarballLock{
 					{Name: "orange", Version: "some-version"},
 				},
 			},
 			args: args{
-				name: "banana", lock: ComponentLock{Name: "orange", Version: "some-version"},
+				name: "banana", lock: BOSHReleaseTarballLock{Name: "orange", Version: "some-version"},
 			},
 			wantErr: false,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.KilnfileLock.UpdateReleaseLockWithName(tt.args.name, tt.args.lock); tt.wantErr {
+			if err := tt.KilnfileLock.UpdateBOSHReleaseTarballLockWithName(tt.args.name, tt.args.lock); tt.wantErr {
 				assert.Error(t, err)
 			} else {
 				assert.NoError(t, err)
diff --git a/pkg/cargo/release_source.go b/pkg/cargo/release_source.go
index 3a607b80b..0860f14dc 100644
--- a/pkg/cargo/release_source.go
+++ b/pkg/cargo/release_source.go
@@ -1,36 +1,36 @@
 package cargo
 
 const (
-	// ReleaseSourceTypeBOSHIO is the value of the Type field on cargo.ReleaseSourceConfig
+	// BOSHReleaseTarballSourceTypeBOSHIO is the value of the Type field on cargo.ReleaseSourceConfig
 	// for fetching https://bosh.io releases.
-	ReleaseSourceTypeBOSHIO = "bosh.io"
+	BOSHReleaseTarballSourceTypeBOSHIO = "bosh.io"
 
-	// ReleaseSourceTypeS3 is the value for the Type field on cargo.ReleaseSourceConfig
+	// BOSHReleaseTarballSourceTypeS3 is the value for the Type field on cargo.ReleaseSourceConfig
 	// for releases stored on
-	ReleaseSourceTypeS3 = "s3"
+	BOSHReleaseTarballSourceTypeS3 = "s3"
 
-	// ReleaseSourceTypeGithub is the value for the Type field on cargo.ReleaseSourceConfig
+	// BOSHReleaseTarballSourceTypeGithub is the value for the Type field on cargo.ReleaseSourceConfig
 	// for releases stored on GitHub.
-	ReleaseSourceTypeGithub = "github"
+	BOSHReleaseTarballSourceTypeGithub = "github"
 
-	// ReleaseSourceTypeArtifactory is the value for the Type field on cargo.ReleaseSourceConfig
+	// BOSHReleaseTarballSourceTypeArtifactory is the value for the Type field on cargo.ReleaseSourceConfig
 	// for releases stored on Artifactory.
-	ReleaseSourceTypeArtifactory = "artifactory"
+	BOSHReleaseTarballSourceTypeArtifactory = "artifactory"
 )
 
-func ReleaseSourceID(releaseConfig ReleaseSourceConfig) string {
+func BOSHReleaseTarballSourceID(releaseConfig ReleaseSourceConfig) string {
 	if releaseConfig.ID != "" {
 		return releaseConfig.ID
 	}
 	switch releaseConfig.Type {
-	case ReleaseSourceTypeBOSHIO:
-		return ReleaseSourceTypeBOSHIO
-	case ReleaseSourceTypeS3:
+	case BOSHReleaseTarballSourceTypeBOSHIO:
+		return BOSHReleaseTarballSourceTypeBOSHIO
+	case BOSHReleaseTarballSourceTypeS3:
 		return releaseConfig.Bucket
-	case ReleaseSourceTypeGithub:
+	case BOSHReleaseTarballSourceTypeGithub:
 		return releaseConfig.Org
-	case ReleaseSourceTypeArtifactory:
-		return ReleaseSourceTypeArtifactory
+	case BOSHReleaseTarballSourceTypeArtifactory:
+		return BOSHReleaseTarballSourceTypeArtifactory
 	default:
 		return ""
 	}
diff --git a/pkg/cargo/release_source_test.go b/pkg/cargo/release_source_test.go
index 0b5e24b21..46d1abe36 100644
--- a/pkg/cargo/release_source_test.go
+++ b/pkg/cargo/release_source_test.go
@@ -15,18 +15,18 @@ func TestReleaseSourceID(t *testing.T) {
 		{Name: "zero value", ExpectedID: "", Configuration: ReleaseSourceConfig{}},
 		{Name: "unknown type", ExpectedID: "", Configuration: ReleaseSourceConfig{Type: "banana"}},
 
-		{Name: ReleaseSourceTypeArtifactory + " with ID set", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "identifier", Type: ReleaseSourceTypeArtifactory}},
-		{Name: ReleaseSourceTypeBOSHIO + " with ID set", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "identifier", Type: ReleaseSourceTypeBOSHIO}},
-		{Name: ReleaseSourceTypeGithub + " with ID set", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "identifier", Type: ReleaseSourceTypeGithub}},
-		{Name: ReleaseSourceTypeS3 + " with ID set", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "identifier", Type: ReleaseSourceTypeS3}},
+		{Name: BOSHReleaseTarballSourceTypeArtifactory + " with ID set", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "identifier", Type: BOSHReleaseTarballSourceTypeArtifactory}},
+		{Name: BOSHReleaseTarballSourceTypeBOSHIO + " with ID set", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "identifier", Type: BOSHReleaseTarballSourceTypeBOSHIO}},
+		{Name: BOSHReleaseTarballSourceTypeGithub + " with ID set", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "identifier", Type: BOSHReleaseTarballSourceTypeGithub}},
+		{Name: BOSHReleaseTarballSourceTypeS3 + " with ID set", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "identifier", Type: BOSHReleaseTarballSourceTypeS3}},
 
-		{Name: ReleaseSourceTypeArtifactory + " default", ExpectedID: ReleaseSourceTypeArtifactory, Configuration: ReleaseSourceConfig{ID: "", Type: ReleaseSourceTypeArtifactory}},
-		{Name: ReleaseSourceTypeBOSHIO + " default", ExpectedID: ReleaseSourceTypeBOSHIO, Configuration: ReleaseSourceConfig{ID: "", Type: ReleaseSourceTypeBOSHIO}},
-		{Name: ReleaseSourceTypeGithub + " default", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "", Type: ReleaseSourceTypeGithub, Org: "identifier"}},
-		{Name: ReleaseSourceTypeS3 + " default", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "", Type: ReleaseSourceTypeS3, Bucket: "identifier"}},
+		{Name: BOSHReleaseTarballSourceTypeArtifactory + " default", ExpectedID: BOSHReleaseTarballSourceTypeArtifactory, Configuration: ReleaseSourceConfig{ID: "", Type: BOSHReleaseTarballSourceTypeArtifactory}},
+		{Name: BOSHReleaseTarballSourceTypeBOSHIO + " default", ExpectedID: BOSHReleaseTarballSourceTypeBOSHIO, Configuration: ReleaseSourceConfig{ID: "", Type: BOSHReleaseTarballSourceTypeBOSHIO}},
+		{Name: BOSHReleaseTarballSourceTypeGithub + " default", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "", Type: BOSHReleaseTarballSourceTypeGithub, Org: "identifier"}},
+		{Name: BOSHReleaseTarballSourceTypeS3 + " default", ExpectedID: "identifier", Configuration: ReleaseSourceConfig{ID: "", Type: BOSHReleaseTarballSourceTypeS3, Bucket: "identifier"}},
 	} {
 		t.Run(tt.Name, func(t *testing.T) {
-			assert.Equal(t, tt.ExpectedID, ReleaseSourceID(tt.Configuration))
+			assert.Equal(t, tt.ExpectedID, BOSHReleaseTarballSourceID(tt.Configuration))
 		})
 	}
 }
diff --git a/pkg/cargo/validate.go b/pkg/cargo/validate.go
index 4cc8b4174..fb14b1c1d 100644
--- a/pkg/cargo/validate.go
+++ b/pkg/cargo/validate.go
@@ -16,7 +16,7 @@ func Validate(spec Kilnfile, lock KilnfileLock) []error {
 			continue
 		}
 
-		componentLock, err := lock.FindReleaseWithName(componentSpec.Name)
+		componentLock, err := lock.FindBOSHReleaseWithName(componentSpec.Name)
 		if err != nil {
 			result = append(result,
 				fmt.Errorf("component spec for release %q not found in lock", componentSpec.Name))
@@ -41,7 +41,7 @@ func ensureRemoteSourceExistsForEachReleaseLock(spec Kilnfile, lock KilnfileLock
 	var result []error
 	for _, release := range lock.Releases {
 		if releaseSourceIndex := slices.IndexFunc(spec.ReleaseSources, func(config ReleaseSourceConfig) bool {
-			return ReleaseSourceID(config) == release.RemoteSource
+			return BOSHReleaseTarballSourceID(config) == release.RemoteSource
 		}); releaseSourceIndex < 0 {
 			result = append(result,
 				fmt.Errorf("release source %q for release lock %q not found in Kilnfile", release.RemoteSource, release.Name))
@@ -50,7 +50,7 @@ func ensureRemoteSourceExistsForEachReleaseLock(spec Kilnfile, lock KilnfileLock
 	return result
 }
 
-func checkComponentVersionsAndConstraint(spec ComponentSpec, lock ComponentLock, index int) error {
+func checkComponentVersionsAndConstraint(spec BOSHReleaseTarballSpecification, lock BOSHReleaseTarballLock, index int) error {
 	v, err := semver.NewVersion(lock.Version)
 	if err != nil {
 		return fmt.Errorf("spec %s (index %d in Kilnfile.lock) has invalid lock version %q: %w",
diff --git a/pkg/cargo/validate_test.go b/pkg/cargo/validate_test.go
index 9cf3bb444..b8b0ca7fb 100644
--- a/pkg/cargo/validate_test.go
+++ b/pkg/cargo/validate_test.go
@@ -17,11 +17,11 @@ func TestValidate_MissingName(t *testing.T) {
 		ReleaseSources: []ReleaseSourceConfig{
 			{ID: someReleaseSourceID},
 		},
-		Releases: []ComponentSpec{
+		Releases: []BOSHReleaseTarballSpecification{
 			{},
 		},
 	}, KilnfileLock{
-		Releases: []ComponentLock{
+		Releases: []BOSHReleaseTarballLock{
 			{Name: "banana", Version: "1.2.3", RemoteSource: someReleaseSourceID},
 		},
 	})
@@ -35,11 +35,11 @@ func TestValidate_FloatingRelease(t *testing.T) {
 		ReleaseSources: []ReleaseSourceConfig{
 			{ID: someReleaseSourceID},
 		},
-		Releases: []ComponentSpec{
+		Releases: []BOSHReleaseTarballSpecification{
 			{Name: "banana", Version: "1.1.*"},
 		},
 	}, KilnfileLock{
-		Releases: []ComponentLock{
+		Releases: []BOSHReleaseTarballLock{
 			{Name: "banana", Version: "1.1.12", RemoteSource: someReleaseSourceID},
 		},
 	})
@@ -50,7 +50,7 @@ func TestValidate_MissingLock(t *testing.T) {
 	t.Parallel()
 	please := NewWithT(t)
 	results := Validate(Kilnfile{
-		Releases: []ComponentSpec{
+		Releases: []BOSHReleaseTarballSpecification{
 			{Name: "banana", Version: "1.1.*"},
 		},
 	}, KilnfileLock{})
@@ -64,11 +64,11 @@ func TestValidate_InvalidConstraint(t *testing.T) {
 		ReleaseSources: []ReleaseSourceConfig{
 			{ID: someReleaseSourceID},
 		},
-		Releases: []ComponentSpec{
+		Releases: []BOSHReleaseTarballSpecification{
 			{Name: "banana", Version: "NOT A CONSTRAINT"},
 		},
 	}, KilnfileLock{
-		Releases: []ComponentLock{
+		Releases: []BOSHReleaseTarballLock{
 			{Name: "banana", Version: "1.2.3", RemoteSource: someReleaseSourceID},
 		},
 	})
@@ -82,11 +82,11 @@ func TestValidate_PinnedRelease(t *testing.T) {
 		ReleaseSources: []ReleaseSourceConfig{
 			{ID: someReleaseSourceID},
 		},
-		Releases: []ComponentSpec{
+		Releases: []BOSHReleaseTarballSpecification{
 			{Name: "banana", Version: "1.2.3"},
 		},
 	}, KilnfileLock{
-		Releases: []ComponentLock{
+		Releases: []BOSHReleaseTarballLock{
 			{Name: "banana", Version: "1.2.3", RemoteSource: someReleaseSourceID},
 		},
 	})
@@ -100,12 +100,12 @@ func TestValidate_release_sources(t *testing.T) {
 			ReleaseSources: []ReleaseSourceConfig{
 				{ID: "ORANGE_SOURCE"},
 			},
-			Releases: []ComponentSpec{
+			Releases: []BOSHReleaseTarballSpecification{
 				{Name: "lemon"},
 				{Name: "orange"},
 			},
 		}, KilnfileLock{
-			Releases: []ComponentLock{
+			Releases: []BOSHReleaseTarballLock{
 				{Name: "lemon", Version: "1.2.3", RemoteSource: "LEMON_SOURCE"},
 				{Name: "orange", Version: "1.2.3", RemoteSource: "ORANGE_SOURCE"},
 			},
@@ -120,12 +120,12 @@ func TestValidate_release_sources(t *testing.T) {
 			ReleaseSources: []ReleaseSourceConfig{
 				{ID: "SOME_TREE"},
 			},
-			Releases: []ComponentSpec{
+			Releases: []BOSHReleaseTarballSpecification{
 				{Name: "lemon"},
 				{Name: "orange"},
 			},
 		}, KilnfileLock{
-			Releases: []ComponentLock{
+			Releases: []BOSHReleaseTarballLock{
 				{Name: "lemon", Version: "1.2.3", RemoteSource: "SOME_TREE"},
 				{Name: "orange", Version: "1.2.3", RemoteSource: "SOME_TREE"},
 			},
@@ -136,14 +136,14 @@ func TestValidate_release_sources(t *testing.T) {
 		please := NewWithT(t)
 		results := Validate(Kilnfile{
 			ReleaseSources: []ReleaseSourceConfig{
-				{Type: ReleaseSourceTypeBOSHIO},
+				{Type: BOSHReleaseTarballSourceTypeBOSHIO},
 			},
-			Releases: []ComponentSpec{
+			Releases: []BOSHReleaseTarballSpecification{
 				{Name: "orange"},
 			},
 		}, KilnfileLock{
-			Releases: []ComponentLock{
-				{Name: "orange", Version: "1.2.3", RemoteSource: ReleaseSourceTypeBOSHIO},
+			Releases: []BOSHReleaseTarballLock{
+				{Name: "orange", Version: "1.2.3", RemoteSource: BOSHReleaseTarballSourceTypeBOSHIO},
 			},
 		})
 		please.Expect(results).To(BeEmpty())
@@ -152,14 +152,14 @@ func TestValidate_release_sources(t *testing.T) {
 		please := NewWithT(t)
 		results := Validate(Kilnfile{
 			ReleaseSources: []ReleaseSourceConfig{
-				{ID: "open source", Type: ReleaseSourceTypeBOSHIO},
+				{ID: "open source", Type: BOSHReleaseTarballSourceTypeBOSHIO},
 			},
-			Releases: []ComponentSpec{
+			Releases: []BOSHReleaseTarballSpecification{
 				{Name: "orange"},
 			},
 		}, KilnfileLock{
-			Releases: []ComponentLock{
-				{Name: "orange", Version: "1.2.3", RemoteSource: ReleaseSourceTypeBOSHIO},
+			Releases: []BOSHReleaseTarballLock{
+				{Name: "orange", Version: "1.2.3", RemoteSource: BOSHReleaseTarballSourceTypeBOSHIO},
 			},
 		})
 		please.Expect(results).To(HaveLen(1))
@@ -168,13 +168,13 @@ func TestValidate_release_sources(t *testing.T) {
 		please := NewWithT(t)
 		results := Validate(Kilnfile{
 			ReleaseSources: []ReleaseSourceConfig{
-				{Org: "crhntr", Type: ReleaseSourceTypeGithub},
+				{Org: "crhntr", Type: BOSHReleaseTarballSourceTypeGithub},
 			},
-			Releases: []ComponentSpec{
+			Releases: []BOSHReleaseTarballSpecification{
 				{Name: "hello-tile", GitHubRepository: "https://github.com/crhntr/hello-tile"},
 			},
 		}, KilnfileLock{
-			Releases: []ComponentLock{
+			Releases: []BOSHReleaseTarballLock{
 				{Name: "hello-tile", Version: "1.2.3", RemoteSource: "crhntr"},
 			},
 		})
@@ -185,10 +185,10 @@ func TestValidate_release_sources(t *testing.T) {
 func TestValidate_checkComponentVersionsAndConstraint(t *testing.T) {
 	t.Run("no version", func(t *testing.T) {
 		please := NewWithT(t)
-		r := ComponentSpec{
+		r := BOSHReleaseTarballSpecification{
 			Name: "capi",
 		}
-		l := ComponentLock{
+		l := BOSHReleaseTarballLock{
 			Name:    "capi",
 			Version: "2.3.4",
 		}
@@ -198,11 +198,11 @@ func TestValidate_checkComponentVersionsAndConstraint(t *testing.T) {
 
 	t.Run("invalid version constraint", func(t *testing.T) {
 		please := NewWithT(t)
-		r := ComponentSpec{
+		r := BOSHReleaseTarballSpecification{
 			Name:    "capi",
 			Version: "meh",
 		}
-		l := ComponentLock{
+		l := BOSHReleaseTarballLock{
 			Name:    "capi",
 			Version: "2.3.4",
 		}
@@ -215,11 +215,11 @@ func TestValidate_checkComponentVersionsAndConstraint(t *testing.T) {
 
 	t.Run("version does not match constraint", func(t *testing.T) {
 		please := NewWithT(t)
-		r := ComponentSpec{
+		r := BOSHReleaseTarballSpecification{
 			Name:    "capi",
 			Version: "~2",
 		}
-		l := ComponentLock{
+		l := BOSHReleaseTarballLock{
 			Name:    "capi",
 			Version: "3.0.5",
 		}
@@ -232,11 +232,11 @@ func TestValidate_checkComponentVersionsAndConstraint(t *testing.T) {
 
 	t.Run("invalid lock version", func(t *testing.T) {
 		please := NewWithT(t)
-		r := ComponentSpec{
+		r := BOSHReleaseTarballSpecification{
 			Name:    "capi",
 			Version: "~2",
 		}
-		l := ComponentLock{
+		l := BOSHReleaseTarballLock{
 			Name:    "capi",
 			Version: "BAD",
 		}
diff --git a/pkg/history/historic_test.go b/pkg/history/historic_test.go
index 2d5eeae94..dcec7d28b 100644
--- a/pkg/history/historic_test.go
+++ b/pkg/history/historic_test.go
@@ -87,7 +87,7 @@ func TestKilnfile(t *testing.T) {
 		p := wt.Filesystem.Join(tileDir, "Kilnfile")
 		f, _ := wt.Filesystem.Create(p)
 		buf, _ := yaml.Marshal(cargo.Kilnfile{
-			Releases: []cargo.ComponentSpec{
+			Releases: []cargo.BOSHReleaseTarballSpecification{
 				{Name: "banana"},
 				{Name: "lemon"},
 			},
@@ -125,7 +125,7 @@ func TestKilnfile(t *testing.T) {
 		_, kl, err := Kilnfile(repo.Storer, initialHash, "tile")
 
 		please.Expect(err).NotTo(HaveOccurred())
-		please.Expect(kl.Releases).To(Equal([]cargo.ComponentLock{
+		please.Expect(kl.Releases).To(Equal([]cargo.BOSHReleaseTarballLock{
 			{Name: "banana", Version: "0.1.0"},
 			{Name: "lemon", Version: "1.1.0"},
 		}))
@@ -137,7 +137,7 @@ func TestKilnfile(t *testing.T) {
 		_, finalKF, err := Kilnfile(repo.Storer, finalHash, "tile/Kilnfile")
 
 		please.Expect(err).NotTo(HaveOccurred())
-		please.Expect(finalKF.Releases).To(Equal([]cargo.ComponentLock{
+		please.Expect(finalKF.Releases).To(Equal([]cargo.BOSHReleaseTarballLock{
 			{Name: "banana", Version: "0.9.0"},
 			{Name: "lemon", Version: "1.9.0"},
 			{Name: "apple", Version: "0.0.1"},
@@ -150,7 +150,7 @@ func TestKilnfile(t *testing.T) {
 		kf, _, err := Kilnfile(repo.Storer, finalHash, "tile")
 
 		please.Expect(err).NotTo(HaveOccurred())
-		please.Expect(kf.Releases).To(Equal([]cargo.ComponentSpec{
+		please.Expect(kf.Releases).To(Equal([]cargo.BOSHReleaseTarballSpecification{
 			{Name: "banana"},
 			{Name: "lemon"},
 		}))
diff --git a/pkg/notes/notes_data.go b/pkg/notes/notes_data.go
index aacd617e9..cdadf6215 100644
--- a/pkg/notes/notes_data.go
+++ b/pkg/notes/notes_data.go
@@ -29,7 +29,7 @@ import (
 )
 
 type BOSHReleaseData struct {
-	cargo.ComponentLock
+	cargo.BOSHReleaseTarballLock
 	Releases []*github.RepositoryRelease
 }
 
@@ -151,8 +151,8 @@ func FetchDataWithoutRepo(ctx context.Context, client *github.Client, tileRepoOw
 
 	for _, c := range kilnfileLockFinal.Releases {
 		data.Components = append(data.Components, BOSHReleaseData{
-			ComponentLock: c,
-			Releases:      data.Bumps.ForLock(c).Releases,
+			BOSHReleaseTarballLock: c,
+			Releases:               data.Bumps.ForLock(c).Releases,
 		})
 	}
 
@@ -236,8 +236,8 @@ func (r fetchNotesData) fetch(ctx context.Context) (Data, error) {
 
 	for _, c := range finalKilnfileLock.Releases {
 		data.Components = append(data.Components, BOSHReleaseData{
-			ComponentLock: c,
-			Releases:      data.Bumps.ForLock(c).Releases,
+			BOSHReleaseTarballLock: c,
+			Releases:               data.Bumps.ForLock(c).Releases,
 		})
 	}
 
@@ -526,7 +526,7 @@ func setEmptyComponentGitHubRepositoryFromOtherKilnfile(k1, k2 cargo.Kilnfile) c
 		if r.GitHubRepository != "" {
 			continue
 		}
-		spec, err := k2.ComponentSpec(r.Name)
+		spec, err := k2.BOSHReleaseTarballSpecification(r.Name)
 		if err != nil {
 			continue
 		}
diff --git a/pkg/notes/notes_data_test.go b/pkg/notes/notes_data_test.go
index 41b4aa6fd..ca67b0171 100644
--- a/pkg/notes/notes_data_test.go
+++ b/pkg/notes/notes_data_test.go
@@ -42,7 +42,7 @@ func Test_fetch(t *testing.T) {
 			OS:      "fruit-tree",
 			Version: "40000.1",
 		},
-		Releases: []cargo.ComponentLock{
+		Releases: []cargo.BOSHReleaseTarballLock{
 			{Name: "banana", Version: "1.1.0"},
 			{Name: "lemon", Version: "1.1.0"},
 		},
@@ -52,13 +52,13 @@ func Test_fetch(t *testing.T) {
 			OS:      "fruit-tree",
 			Version: "40000.2",
 		},
-		Releases: []cargo.ComponentSpec{
+		Releases: []cargo.BOSHReleaseTarballSpecification{
 			{Name: "banana", GitHubRepository: "https://github.com/pivotal-cf/lts-banana-release"},
 			{Name: "lemon"},
 		},
 		Slug: "elastic-runtime",
 	}, cargo.KilnfileLock{
-		Releases: []cargo.ComponentLock{
+		Releases: []cargo.BOSHReleaseTarballLock{
 			{Name: "banana", Version: "1.2.0"},
 			{Name: "lemon", Version: "1.1.0"},
 		},
diff --git a/pkg/notes/notes_page_test.go b/pkg/notes/notes_page_test.go
index ecb99df67..5ff4d80a6 100644
--- a/pkg/notes/notes_page_test.go
+++ b/pkg/notes/notes_page_test.go
@@ -71,54 +71,54 @@ func TestParseNotesPage(t *testing.T) {
 			OS: "ubuntu-xenial", Version: "456.0",
 		},
 		Components: []BOSHReleaseData{
-			{ComponentLock: cargo.ComponentLock{Name: "backup-and-restore-sdk", Version: "1.18.26"}},
-			{ComponentLock: cargo.ComponentLock{Name: "binary-offline-buildpack", Version: "1.0.40"}},
-			{ComponentLock: cargo.ComponentLock{Name: "bosh-dns-aliases", Version: "0.0.3"}},
-			{ComponentLock: cargo.ComponentLock{Name: "bosh-system-metrics-forwarder", Version: "0.0.20"}},
-			{ComponentLock: cargo.ComponentLock{Name: "bpm", Version: "1.1.15"}},
-			{ComponentLock: cargo.ComponentLock{Name: "capi", Version: "1.84.20"}},
-			{ComponentLock: cargo.ComponentLock{Name: "cf-autoscaling", Version: "241"}},
-			{ComponentLock: cargo.ComponentLock{Name: "cf-backup-and-restore", Version: "0.0.11"}},
-			{ComponentLock: cargo.ComponentLock{Name: "cf-cli", Version: "1.32.0"}},
-			{ComponentLock: cargo.ComponentLock{Name: "cf-networking", Version: "2.40.0"}},
-			{ComponentLock: cargo.ComponentLock{Name: "cf-smoke-tests", Version: "40.0.134"}},
-			{ComponentLock: cargo.ComponentLock{Name: "cf-syslog-drain", Version: "10.2.5"}},
-			{ComponentLock: cargo.ComponentLock{Name: "cflinuxfs3", Version: "0.264.0"}},
-			{ComponentLock: cargo.ComponentLock{Name: "credhub", Version: "2.5.13"}},
-			{ComponentLock: cargo.ComponentLock{Name: "diego", Version: "2.53.0"}},
-			{ComponentLock: cargo.ComponentLock{Name: "dotnet-core-offline-buildpack", Version: "2.3.36"}},
-			{ComponentLock: cargo.ComponentLock{Name: "garden-runc", Version: "1.19.30"}},
-			{ComponentLock: cargo.ComponentLock{Name: "go-offline-buildpack", Version: "1.9.37"}},
-			{ComponentLock: cargo.ComponentLock{Name: "haproxy", Version: "9.6.1"}},
-			{ComponentLock: cargo.ComponentLock{Name: "istio", Version: "1.3.0"}},
-			{ComponentLock: cargo.ComponentLock{Name: "java-offline-buildpack", Version: "4.42"}},
-			{ComponentLock: cargo.ComponentLock{Name: "leadership-election", Version: "1.4.2"}},
-			{ComponentLock: cargo.ComponentLock{Name: "log-cache", Version: "2.1.17"}},
-			{ComponentLock: cargo.ComponentLock{Name: "loggregator-agent", Version: "3.21.18"}},
-			{ComponentLock: cargo.ComponentLock{Name: "loggregator", Version: "105.6.8"}},
-			{ComponentLock: cargo.ComponentLock{Name: "mapfs", Version: "1.2.4"}},
-			{ComponentLock: cargo.ComponentLock{Name: "metric-registrar", Version: "1.1.9"}},
-			{ComponentLock: cargo.ComponentLock{Name: "mysql-monitoring", Version: "9.7.0"}},
-			{ComponentLock: cargo.ComponentLock{Name: "nats", Version: "40"}},
-			{ComponentLock: cargo.ComponentLock{Name: "nfs-volume", Version: "2.3.10"}},
-			{ComponentLock: cargo.ComponentLock{Name: "nginx-offline-buildpack", Version: "1.1.32"}},
-			{ComponentLock: cargo.ComponentLock{Name: "nodejs-offline-buildpack", Version: "1.7.63"}},
-			{ComponentLock: cargo.ComponentLock{Name: "notifications-ui", Version: "39"}},
-			{ComponentLock: cargo.ComponentLock{Name: "notifications", Version: "62"}},
-			{ComponentLock: cargo.ComponentLock{Name: "php-offline-buildpack", Version: "4.4.48"}},
-			{ComponentLock: cargo.ComponentLock{Name: "push-apps-manager-release", Version: "670.0.29"}},
-			{ComponentLock: cargo.ComponentLock{Name: "push-usage-service-release", Version: "670.0.36"}},
-			{ComponentLock: cargo.ComponentLock{Name: "pxc", Version: "0.39.0"}},
-			{ComponentLock: cargo.ComponentLock{Name: "python-offline-buildpack", Version: "1.7.47"}},
-			{ComponentLock: cargo.ComponentLock{Name: "r-offline-buildpack", Version: "1.1.23"}},
-			{ComponentLock: cargo.ComponentLock{Name: "routing", Version: "0.226.0"}},
-			{ComponentLock: cargo.ComponentLock{Name: "ruby-offline-buildpack", Version: "1.8.48"}},
-			{ComponentLock: cargo.ComponentLock{Name: "silk", Version: "2.40.0"}},
-			{ComponentLock: cargo.ComponentLock{Name: "smb-volume", Version: "3.0.1"}},
-			{ComponentLock: cargo.ComponentLock{Name: "staticfile-offline-buildpack", Version: "1.5.26"}},
-			{ComponentLock: cargo.ComponentLock{Name: "statsd-injector", Version: "1.11.16"}},
-			{ComponentLock: cargo.ComponentLock{Name: "syslog", Version: "11.7.5"}},
-			{ComponentLock: cargo.ComponentLock{Name: "uaa", Version: "73.4.32"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "backup-and-restore-sdk", Version: "1.18.26"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "binary-offline-buildpack", Version: "1.0.40"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "bosh-dns-aliases", Version: "0.0.3"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "bosh-system-metrics-forwarder", Version: "0.0.20"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "bpm", Version: "1.1.15"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "capi", Version: "1.84.20"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "cf-autoscaling", Version: "241"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "cf-backup-and-restore", Version: "0.0.11"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "cf-cli", Version: "1.32.0"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "cf-networking", Version: "2.40.0"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "cf-smoke-tests", Version: "40.0.134"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "cf-syslog-drain", Version: "10.2.5"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "cflinuxfs3", Version: "0.264.0"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "credhub", Version: "2.5.13"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "diego", Version: "2.53.0"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "dotnet-core-offline-buildpack", Version: "2.3.36"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "garden-runc", Version: "1.19.30"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "go-offline-buildpack", Version: "1.9.37"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "haproxy", Version: "9.6.1"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "istio", Version: "1.3.0"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "java-offline-buildpack", Version: "4.42"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "leadership-election", Version: "1.4.2"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "log-cache", Version: "2.1.17"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "loggregator-agent", Version: "3.21.18"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "loggregator", Version: "105.6.8"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "mapfs", Version: "1.2.4"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "metric-registrar", Version: "1.1.9"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "mysql-monitoring", Version: "9.7.0"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "nats", Version: "40"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "nfs-volume", Version: "2.3.10"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "nginx-offline-buildpack", Version: "1.1.32"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "nodejs-offline-buildpack", Version: "1.7.63"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "notifications-ui", Version: "39"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "notifications", Version: "62"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "php-offline-buildpack", Version: "4.4.48"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "push-apps-manager-release", Version: "670.0.29"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "push-usage-service-release", Version: "670.0.36"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "pxc", Version: "0.39.0"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "python-offline-buildpack", Version: "1.7.47"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "r-offline-buildpack", Version: "1.1.23"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "routing", Version: "0.226.0"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "ruby-offline-buildpack", Version: "1.8.48"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "silk", Version: "2.40.0"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "smb-volume", Version: "3.0.1"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "staticfile-offline-buildpack", Version: "1.5.26"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "statsd-injector", Version: "1.11.16"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "syslog", Version: "11.7.5"}},
+			{BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "uaa", Version: "73.4.32"}},
 		},
 		Bumps: cargo.BumpList{
 			{Name: "backup-and-restore-sdk", ToVersion: "1.18.26"},
diff --git a/pkg/notes/notes_template_test.go b/pkg/notes/notes_template_test.go
index c6479322f..78bdb3c3b 100644
--- a/pkg/notes/notes_template_test.go
+++ b/pkg/notes/notes_template_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/google/go-github/v40/github"
 	. "github.com/onsi/gomega"
 
-	"github.com/pivotal-cf/kiln/internal/component"
+	"github.com/pivotal-cf/kiln/pkg/cargo"
 )
 
 func Test_defaultReleaseNotesTemplate(t *testing.T) {
@@ -22,7 +22,7 @@ func Test_defaultReleaseNotesTemplate(t *testing.T) {
 			Version: semver.MustParse("0.0.0"),
 			Components: []BOSHReleaseData{
 				{
-					ComponentLock: component.Lock{Name: "banana", Version: "1.2"},
+					BOSHReleaseTarballLock: cargo.BOSHReleaseTarballLock{Name: "banana", Version: "1.2"},
 					Releases: []*github.RepositoryRelease{
 						{TagName: strPtr("1.1"), Body: strPtr("\n   ")},
 						{TagName: strPtr("1.2"), Body: strPtr("")},