{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d3404549-5ca3-4f2b-a6bb-b6c565548517",
  "version": 1,
  "metadata": {
    "timestamp": "2026-01-01T00:00:00Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "name": "novus-sbom-fixture",
          "version": "1.0.0"
        }
      ]
    },
    "authors": [
      {
        "name": "Orchard SBOM Team (fictional)",
        "email": "sbom@orchard.example"
      }
    ],
    "component": {
      "type": "application",
      "bom-ref": "pkg:npm/%40orchard-example/gateway@4.2.0",
      "name": "@orchard-example/gateway",
      "version": "4.2.0",
      "purl": "pkg:npm/%40orchard-example/gateway@4.2.0",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/gateway"
        }
      ]
    },
    "properties": [
      {
        "name": "novus:sample",
        "value": "SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented."
      }
    ]
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:npm/%40orchard-example/router@2.1.3",
      "name": "@orchard-example/router",
      "version": "2.1.3",
      "purl": "pkg:npm/%40orchard-example/router@2.1.3",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "d17f0a5171a018c41cdaaa2701b6c32bf49f7404032fa45e5721e2b794cd2e51"
        },
        {
          "alg": "SHA-512",
          "content": "aad9cce25f63f3352ea90f480acc4275f97cefd3ed76e70760f8aa3b5e75a84bba6c1bf8f3ecee61b4db9ffbd24c919b09dd91bc6a43af2fcd12449ed5b69b68"
        },
        {
          "alg": "SHA-1",
          "content": "c3aa903f22575d5bea7e6ff067103a131766d60c"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/router"
        },
        {
          "type": "issue-tracker",
          "url": "https://issues.orchard.example/@orchard-example/router"
        },
        {
          "type": "documentation",
          "url": "https://docs.orchard.example/@orchard-example/router"
        },
        {
          "type": "build-system",
          "url": "https://build.orchard.example/ci"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:npm/%40orchard-example/http-core@1.8.0",
      "name": "@orchard-example/http-core",
      "version": "1.8.0",
      "purl": "pkg:npm/%40orchard-example/http-core@1.8.0",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "05dc223ec1875dfd80d8c5873f8c29f036f98587f2fe2d02abc7c718bfb4b8bf"
        },
        {
          "alg": "SHA-512",
          "content": "7c6f402661bedfbfac967fde3153e66eefdb21c57e41b2776e26d257da1bf0f57a1983458a7ae14894181719046041f17245c19fb1310e29b9f6ba920da62816"
        },
        {
          "alg": "SHA-1",
          "content": "634ae1b58d5d034e68d484a85f5809818b512042"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/@orchard-example/http-core/-/http-core-1.8.0.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/http-core"
        },
        {
          "type": "issue-tracker",
          "url": "https://issues.orchard.example/@orchard-example/http-core"
        },
        {
          "type": "documentation",
          "url": "https://docs.orchard.example/@orchard-example/http-core"
        },
        {
          "type": "build-system",
          "url": "https://build.orchard.example/ci"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:npm/example-metrics@4.0.0",
      "name": "example-metrics",
      "version": "4.0.0",
      "purl": "pkg:npm/example-metrics@4.0.0",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "4a8930c617fd12bb99d26e868224d9918e4a3e00f8dd26b876ed19eb6e664f73"
        },
        {
          "alg": "SHA-512",
          "content": "4aaddcc59f81aefe1b80b77ee41fe8deea50d4ee982a36ebe933f964165fc385d58e76baffc62439e079da22e1ad10e3b35522179bf6d088ebedb109b4729c39"
        },
        {
          "alg": "SHA-1",
          "content": "8aaf92e62a994bde6b37a39eba672370f38e1483"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/example-metrics/-/example-metrics-4.0.0.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/example-metrics"
        },
        {
          "type": "issue-tracker",
          "url": "https://issues.orchard.example/example-metrics"
        },
        {
          "type": "documentation",
          "url": "https://docs.orchard.example/example-metrics"
        },
        {
          "type": "build-system",
          "url": "https://build.orchard.example/ci"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:npm/example-cache@0.9.2",
      "name": "example-cache",
      "version": "0.9.2",
      "purl": "pkg:npm/example-cache@0.9.2",
      "licenses": [
        {
          "license": {
            "id": "BSD-3-Clause"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "f7af2ad2d3c3daaa5991b0eae38ffa151a2e2f3bf0f2bdd7333adc3a1dc860f7"
        },
        {
          "alg": "SHA-512",
          "content": "01fc1d09998b10052c73b5f1d337be5f8712cfa112f06eb7861dc9c31ee61c404950da7344b641abb7c361593bf9c561f6ca6efb7c1ecbc6b4543252e9c1294f"
        },
        {
          "alg": "SHA-1",
          "content": "bbacfa43f6daa8261bd1e80ca05bd1c115d180a6"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/example-cache/-/example-cache-0.9.2.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/example-cache"
        },
        {
          "type": "issue-tracker",
          "url": "https://issues.orchard.example/example-cache"
        },
        {
          "type": "documentation",
          "url": "https://docs.orchard.example/example-cache"
        },
        {
          "type": "build-system",
          "url": "https://build.orchard.example/ci"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:npm/example-crypto-shim@1.2.0",
      "name": "example-crypto-shim",
      "version": "1.2.0",
      "purl": "pkg:npm/example-crypto-shim@1.2.0",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "25b4571f3faedb8df3979d9e509e331b6b88503d8d0057e6414e936e084a56cb"
        },
        {
          "alg": "SHA-512",
          "content": "0bd8aa24fe9ffd2ed5fcdb111879d5bffbb69cfb678c53096ece29f2d31b8d14b1ac77848e5e803e89529e23ef3051f48e50d4b8ed3a9dbf3afdafc60c45912a"
        },
        {
          "alg": "SHA-1",
          "content": "3d03d41fb5136805d9a909fb3e9c1a03562661d1"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/example-crypto-shim/-/example-crypto-shim-1.2.0.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/example-crypto-shim"
        },
        {
          "type": "issue-tracker",
          "url": "https://issues.orchard.example/example-crypto-shim"
        },
        {
          "type": "documentation",
          "url": "https://docs.orchard.example/example-crypto-shim"
        },
        {
          "type": "build-system",
          "url": "https://build.orchard.example/ci"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:npm/example-logger@3.4.1",
      "name": "example-logger",
      "version": "3.4.1",
      "purl": "pkg:npm/example-logger@3.4.1",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "7fb72ea58987e5327259b66384f96f5e657c3ce5225b8891c567cac6b58430ec"
        },
        {
          "alg": "SHA-512",
          "content": "924fcb79bd5f619b616a8db7397f364a6722f8955c6bfe4bd1660b36202996d64dec639673aae7c462838b1af13501dd75bc8b3e51360e313882458544879a17"
        },
        {
          "alg": "SHA-1",
          "content": "63a84e671c264c4565e246e0aeddbef92e89c783"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/example-logger/-/example-logger-3.4.1.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/example-logger"
        },
        {
          "type": "issue-tracker",
          "url": "https://issues.orchard.example/example-logger"
        },
        {
          "type": "documentation",
          "url": "https://docs.orchard.example/example-logger"
        },
        {
          "type": "build-system",
          "url": "https://build.orchard.example/ci"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:npm/example-retry@1.0.4",
      "name": "example-retry",
      "version": "1.0.4",
      "purl": "pkg:npm/example-retry@1.0.4",
      "licenses": [
        {
          "license": {
            "id": "ISC"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "4f2a78f8fb4883a2efd6b73b447f632599790c08e25bb7184f501b5f2b9af33f"
        },
        {
          "alg": "SHA-512",
          "content": "f605859e10fb5d460078ebfedb44f06de1592bb2682fe1f360653dabdbafc03897db8ffc4c5d2ca06387cab244c17eb2c1b4d654ae0fd378d0d9de837311f67f"
        },
        {
          "alg": "SHA-1",
          "content": "e7ca7767c6b3f7090141fe3b6288cc955f3f1974"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/example-retry/-/example-retry-1.0.4.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/example-retry"
        },
        {
          "type": "issue-tracker",
          "url": "https://issues.orchard.example/example-retry"
        },
        {
          "type": "documentation",
          "url": "https://docs.orchard.example/example-retry"
        },
        {
          "type": "build-system",
          "url": "https://build.orchard.example/ci"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:npm/example-json-path@2.0.5",
      "name": "example-json-path",
      "version": "2.0.5",
      "purl": "pkg:npm/example-json-path@2.0.5",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "74e30e4812a0cc92bd7c1a965e6f953f5d92b9eaf3cd77d90663a7344e939b63"
        },
        {
          "alg": "SHA-512",
          "content": "2f6b3e94c95fac9ce5cf9db7e2a83725a3efd7469221f4a28c59e6e7ec1d25f37f3f9986f1cf98528f9e3e26434088d856ea2f7bd5f106a4e3ae9f8d2ba5d0e7"
        },
        {
          "alg": "SHA-1",
          "content": "78cda5e1dad3803e04938356b02620cb17d0554a"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/example-json-path/-/example-json-path-2.0.5.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/example-json-path"
        },
        {
          "type": "issue-tracker",
          "url": "https://issues.orchard.example/example-json-path"
        },
        {
          "type": "documentation",
          "url": "https://docs.orchard.example/example-json-path"
        },
        {
          "type": "build-system",
          "url": "https://build.orchard.example/ci"
        }
      ]
    },
    {
      "type": "library",
      "bom-ref": "pkg:npm/example-yaml-lite@1.1.7",
      "name": "example-yaml-lite",
      "version": "1.1.7",
      "purl": "pkg:npm/example-yaml-lite@1.1.7",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "d7094de3c8e15621381e5f9f02c0eecb9977d249a8a06ab2b0a34f5344a039af"
        },
        {
          "alg": "SHA-512",
          "content": "023253ecdd60eed6b829a184550b4436d77d74e1bd24632ccce660dd9f1fc1bdafed2273ece20891ef8765916d894f2bcc7466984c92b08fd896223a2e281cee"
        },
        {
          "alg": "SHA-1",
          "content": "6f47fde1d98866c1b5ec56f6a9432976893db1aa"
        }
      ],
      "supplier": {
        "name": "Example Softworks (fictional)",
        "url": [
          "https://sbom.orchard.example/supplier"
        ]
      },
      "externalReferences": [
        {
          "type": "distribution",
          "url": "https://registry.orchard.example/example-yaml-lite/-/example-yaml-lite-1.1.7.tgz"
        },
        {
          "type": "vcs",
          "url": "https://git.orchard.example/example-yaml-lite"
        },
        {
          "type": "issue-tracker",
          "url": "https://issues.orchard.example/example-yaml-lite"
        },
        {
          "type": "documentation",
          "url": "https://docs.orchard.example/example-yaml-lite"
        },
        {
          "type": "build-system",
          "url": "https://build.orchard.example/ci"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/%40orchard-example/gateway@4.2.0",
      "dependsOn": [
        "pkg:npm/%40orchard-example/router@2.1.3",
        "pkg:npm/%40orchard-example/http-core@1.8.0",
        "pkg:npm/example-metrics@4.0.0",
        "pkg:npm/example-cache@0.9.2",
        "pkg:npm/example-crypto-shim@1.2.0"
      ]
    },
    {
      "ref": "pkg:npm/%40orchard-example/router@2.1.3",
      "dependsOn": [
        "pkg:npm/example-logger@3.4.1",
        "pkg:npm/example-retry@1.0.4"
      ]
    },
    {
      "ref": "pkg:npm/%40orchard-example/http-core@1.8.0",
      "dependsOn": [
        "pkg:npm/example-logger@3.4.1",
        "pkg:npm/example-json-path@2.0.5"
      ]
    },
    {
      "ref": "pkg:npm/example-metrics@4.0.0",
      "dependsOn": [
        "pkg:npm/example-logger@3.4.1"
      ]
    },
    {
      "ref": "pkg:npm/example-cache@0.9.2",
      "dependsOn": [
        "pkg:npm/example-yaml-lite@1.1.7"
      ]
    },
    {
      "ref": "pkg:npm/example-crypto-shim@1.2.0",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/example-logger@3.4.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/example-retry@1.0.4",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/example-json-path@2.0.5",
      "dependsOn": []
    },
    {
      "ref": "pkg:npm/example-yaml-lite@1.1.7",
      "dependsOn": [
        "pkg:npm/example-json-path@2.0.5"
      ]
    }
  ]
}