{
  "schema": "novus-sample/build-metadata/1",
  "product": {
    "name": "orchard-gateway",
    "version": "4.2.0"
  },
  "source": {
    "repository": "https://git.orchard.example/orchard/gateway",
    "ref": "refs/tags/v4.2.0",
    "commit": "902ea810fbdd8ff73082bd2873585709f2ca500b",
    "dirty": false
  },
  "build": {
    "id": "8814",
    "builder": "https://build.orchard.example/builders/hosted/v1",
    "startedOn": "2026-01-01T00:00:00Z",
    "finishedOn": "2026-01-01T00:06:12Z",
    "durationSeconds": 372,
    "trigger": "tag",
    "reproducible": true
  },
  "outputs": [
    {
      "name": "orchard-gateway-4.2.0.tgz",
      "sha256": "06af88e316cf889e0b72645f235f77c900d48972456b1ff6ba4df49ae24be734",
      "bytes": 184320
    },
    {
      "name": "gateway-4.2.0.sbom.json",
      "sha256": "060bd96bd9eb91fc78c63d8db571ff7e56fb743b51bc1b670b60cce5299e4a76",
      "bytes": 11500
    }
  ],
  "toolchain": {
    "node": "20.11.1",
    "npm": "10.4.0",
    "os": "example-linux 3.20"
  },
  "novus_sample_note": "SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented."
}