##### SPDX tag-value document — SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented. SPDXVersion: SPDX-2.3 DataLicense: CC0-1.0 SPDXID: SPDXRef-DOCUMENT DocumentName: orchard-gateway-4.2.0 DocumentNamespace: https://sbom.orchard.example/spdx/e5078ed7-f5eb-46be-a663-2890ca53b9fb Creator: Organization: Example Softworks (fictional) Creator: Tool: novus-sbom-fixture-1.0.0 Created: 2026-01-01T00:00:00Z CreatorComment: Fictional component tree. No package named here exists. ##### Package: @orchard-example/gateway PackageName: @orchard-example/gateway SPDXID: SPDXRef-Package-orchard-example-gateway PackageVersion: 4.2.0 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz FilesAnalyzed: false PackageChecksum: SHA256: cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f PackageLicenseConcluded: Apache-2.0 PackageLicenseDeclared: Apache-2.0 PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/gateway@4.2.0 ##### Package: @orchard-example/router PackageName: @orchard-example/router SPDXID: SPDXRef-Package-orchard-example-router PackageVersion: 2.1.3 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz FilesAnalyzed: false PackageChecksum: SHA256: d17f0a5171a018c41cdaaa2701b6c32bf49f7404032fa45e5721e2b794cd2e51 PackageLicenseConcluded: Apache-2.0 PackageLicenseDeclared: Apache-2.0 PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/router@2.1.3 ##### Package: @orchard-example/http-core PackageName: @orchard-example/http-core SPDXID: SPDXRef-Package-orchard-example-http-core PackageVersion: 1.8.0 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/@orchard-example/http-core/-/http-core-1.8.0.tgz FilesAnalyzed: false PackageChecksum: SHA256: 05dc223ec1875dfd80d8c5873f8c29f036f98587f2fe2d02abc7c718bfb4b8bf PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/http-core@1.8.0 ##### Package: example-metrics PackageName: example-metrics SPDXID: SPDXRef-Package-example-metrics PackageVersion: 4.0.0 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/example-metrics/-/example-metrics-4.0.0.tgz FilesAnalyzed: false PackageChecksum: SHA256: 4a8930c617fd12bb99d26e868224d9918e4a3e00f8dd26b876ed19eb6e664f73 PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/example-metrics@4.0.0 ##### Package: example-cache PackageName: example-cache SPDXID: SPDXRef-Package-example-cache PackageVersion: 0.9.2 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/example-cache/-/example-cache-0.9.2.tgz FilesAnalyzed: false PackageChecksum: SHA256: f7af2ad2d3c3daaa5991b0eae38ffa151a2e2f3bf0f2bdd7333adc3a1dc860f7 PackageLicenseConcluded: BSD-3-Clause PackageLicenseDeclared: BSD-3-Clause PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/example-cache@0.9.2 ##### Package: example-crypto-shim PackageName: example-crypto-shim SPDXID: SPDXRef-Package-example-crypto-shim PackageVersion: 1.2.0 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/example-crypto-shim/-/example-crypto-shim-1.2.0.tgz FilesAnalyzed: false PackageChecksum: SHA256: 25b4571f3faedb8df3979d9e509e331b6b88503d8d0057e6414e936e084a56cb PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/example-crypto-shim@1.2.0 ##### Package: example-logger PackageName: example-logger SPDXID: SPDXRef-Package-example-logger PackageVersion: 3.4.1 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/example-logger/-/example-logger-3.4.1.tgz FilesAnalyzed: false PackageChecksum: SHA256: 7fb72ea58987e5327259b66384f96f5e657c3ce5225b8891c567cac6b58430ec PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/example-logger@3.4.1 ##### Package: example-retry PackageName: example-retry SPDXID: SPDXRef-Package-example-retry PackageVersion: 1.0.4 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/example-retry/-/example-retry-1.0.4.tgz FilesAnalyzed: false PackageChecksum: SHA256: 4f2a78f8fb4883a2efd6b73b447f632599790c08e25bb7184f501b5f2b9af33f PackageLicenseConcluded: ISC PackageLicenseDeclared: ISC PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/example-retry@1.0.4 ##### Package: example-json-path PackageName: example-json-path SPDXID: SPDXRef-Package-example-json-path PackageVersion: 2.0.5 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/example-json-path/-/example-json-path-2.0.5.tgz FilesAnalyzed: false PackageChecksum: SHA256: 74e30e4812a0cc92bd7c1a965e6f953f5d92b9eaf3cd77d90663a7344e939b63 PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/example-json-path@2.0.5 ##### Package: example-yaml-lite PackageName: example-yaml-lite SPDXID: SPDXRef-Package-example-yaml-lite PackageVersion: 1.1.7 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/example-yaml-lite/-/example-yaml-lite-1.1.7.tgz FilesAnalyzed: false PackageChecksum: SHA256: d7094de3c8e15621381e5f9f02c0eecb9977d249a8a06ab2b0a34f5344a039af PackageLicenseConcluded: Apache-2.0 PackageLicenseDeclared: Apache-2.0 PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/example-yaml-lite@1.1.7 ##### Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-orchard-example-gateway Relationship: SPDXRef-Package-orchard-example-gateway DEPENDS_ON SPDXRef-Package-orchard-example-router Relationship: SPDXRef-Package-orchard-example-gateway DEPENDS_ON SPDXRef-Package-orchard-example-http-core Relationship: SPDXRef-Package-orchard-example-gateway DEPENDS_ON SPDXRef-Package-example-metrics Relationship: SPDXRef-Package-orchard-example-gateway DEPENDS_ON SPDXRef-Package-example-cache Relationship: SPDXRef-Package-orchard-example-gateway DEPENDS_ON SPDXRef-Package-example-crypto-shim Relationship: SPDXRef-Package-orchard-example-router DEPENDS_ON SPDXRef-Package-example-logger Relationship: SPDXRef-Package-orchard-example-router DEPENDS_ON SPDXRef-Package-example-retry Relationship: SPDXRef-Package-orchard-example-http-core DEPENDS_ON SPDXRef-Package-example-logger Relationship: SPDXRef-Package-orchard-example-http-core DEPENDS_ON SPDXRef-Package-example-json-path Relationship: SPDXRef-Package-example-metrics DEPENDS_ON SPDXRef-Package-example-logger Relationship: SPDXRef-Package-example-cache DEPENDS_ON SPDXRef-Package-example-yaml-lite Relationship: SPDXRef-Package-example-yaml-lite DEPENDS_ON SPDXRef-Package-example-json-path