# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.

spdxVersion: SPDX-2.3
dataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
name: orchard-gateway-4.2.0
documentNamespace: "https://sbom.orchard.example/spdx/a199a062-0945-4011-a6cd-d5c4768f4e59"
creationInfo:
  created: "2026-01-01T00:00:00Z"
  creators:
    - "Organization: Example Softworks (fictional)"
    - "Tool: novus-sbom-fixture-1.0.0"
  licenseListVersion: 3.22
  comment: "SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented."
packages:
  - SPDXID: SPDXRef-Package-orchard-example-gateway
    name: "@orchard-example/gateway"
    versionInfo: 4.2.0
    downloadLocation: "https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz"
    filesAnalyzed: false
    supplier: "Organization: Example Softworks (fictional)"
    licenseConcluded: Apache-2.0
    licenseDeclared: Apache-2.0
    copyrightText: NOASSERTION
    checksums:
      - algorithm: SHA256
        checksumValue: cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f
    externalRefs:
      - referenceCategory: PACKAGE-MANAGER
        referenceType: purl
        referenceLocator: "pkg:npm/%40orchard-example/gateway@4.2.0"
  - SPDXID: SPDXRef-Package-orchard-example-router
    name: "@orchard-example/router"
    versionInfo: 2.1.3
    downloadLocation: "https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz"
    filesAnalyzed: false
    supplier: "Organization: Example Softworks (fictional)"
    licenseConcluded: Apache-2.0
    licenseDeclared: Apache-2.0
    copyrightText: NOASSERTION
    checksums:
      - algorithm: SHA256
        checksumValue: d17f0a5171a018c41cdaaa2701b6c32bf49f7404032fa45e5721e2b794cd2e51
    externalRefs:
      - referenceCategory: PACKAGE-MANAGER
        referenceType: purl
        referenceLocator: "pkg:npm/%40orchard-example/router@2.1.3"
  - SPDXID: SPDXRef-Package-orchard-example-http-core
    name: "@orchard-example/http-core"
    versionInfo: 1.8.0
    downloadLocation: "https://registry.orchard.example/@orchard-example/http-core/-/http-core-1.8.0.tgz"
    filesAnalyzed: false
    supplier: "Organization: Example Softworks (fictional)"
    licenseConcluded: MIT
    licenseDeclared: MIT
    copyrightText: NOASSERTION
    checksums:
      - algorithm: SHA256
        checksumValue: 05dc223ec1875dfd80d8c5873f8c29f036f98587f2fe2d02abc7c718bfb4b8bf
    externalRefs:
      - referenceCategory: PACKAGE-MANAGER
        referenceType: purl
        referenceLocator: "pkg:npm/%40orchard-example/http-core@1.8.0"
  - SPDXID: SPDXRef-Package-example-metrics
    name: example-metrics
    versionInfo: 4.0.0
    downloadLocation: "https://registry.orchard.example/example-metrics/-/example-metrics-4.0.0.tgz"
    filesAnalyzed: false
    supplier: "Organization: Example Softworks (fictional)"
    licenseConcluded: MIT
    licenseDeclared: MIT
    copyrightText: NOASSERTION
    checksums:
      - algorithm: SHA256
        checksumValue: 4a8930c617fd12bb99d26e868224d9918e4a3e00f8dd26b876ed19eb6e664f73
    externalRefs:
      - referenceCategory: PACKAGE-MANAGER
        referenceType: purl
        referenceLocator: "pkg:npm/example-metrics@4.0.0"
  - SPDXID: SPDXRef-Package-example-cache
    name: example-cache
    versionInfo: 0.9.2
    downloadLocation: "https://registry.orchard.example/example-cache/-/example-cache-0.9.2.tgz"
    filesAnalyzed: false
    supplier: "Organization: Example Softworks (fictional)"
    licenseConcluded: BSD-3-Clause
    licenseDeclared: BSD-3-Clause
    copyrightText: NOASSERTION
    checksums:
      - algorithm: SHA256
        checksumValue: f7af2ad2d3c3daaa5991b0eae38ffa151a2e2f3bf0f2bdd7333adc3a1dc860f7
    externalRefs:
      - referenceCategory: PACKAGE-MANAGER
        referenceType: purl
        referenceLocator: "pkg:npm/example-cache@0.9.2"
  - SPDXID: SPDXRef-Package-example-crypto-shim
    name: example-crypto-shim
    versionInfo: 1.2.0
    downloadLocation: "https://registry.orchard.example/example-crypto-shim/-/example-crypto-shim-1.2.0.tgz"
    filesAnalyzed: false
    supplier: "Organization: Example Softworks (fictional)"
    licenseConcluded: MIT
    licenseDeclared: MIT
    copyrightText: NOASSERTION
    checksums:
      - algorithm: SHA256
        checksumValue: 25b4571f3faedb8df3979d9e509e331b6b88503d8d0057e6414e936e084a56cb
    externalRefs:
      - referenceCategory: PACKAGE-MANAGER
        referenceType: purl
        referenceLocator: "pkg:npm/example-crypto-shim@1.2.0"
  - SPDXID: SPDXRef-Package-example-logger
    name: example-logger
    versionInfo: 3.4.1
    downloadLocation: "https://registry.orchard.example/example-logger/-/example-logger-3.4.1.tgz"
    filesAnalyzed: false
    supplier: "Organization: Example Softworks (fictional)"
    licenseConcluded: MIT
    licenseDeclared: MIT
    copyrightText: NOASSERTION
    checksums:
      - algorithm: SHA256
        checksumValue: 7fb72ea58987e5327259b66384f96f5e657c3ce5225b8891c567cac6b58430ec
    externalRefs:
      - referenceCategory: PACKAGE-MANAGER
        referenceType: purl
        referenceLocator: "pkg:npm/example-logger@3.4.1"
  - SPDXID: SPDXRef-Package-example-retry
    name: example-retry
    versionInfo: 1.0.4
    downloadLocation: "https://registry.orchard.example/example-retry/-/example-retry-1.0.4.tgz"
    filesAnalyzed: false
    supplier: "Organization: Example Softworks (fictional)"
    licenseConcluded: ISC
    licenseDeclared: ISC
    copyrightText: NOASSERTION
    checksums:
      - algorithm: SHA256
        checksumValue: 4f2a78f8fb4883a2efd6b73b447f632599790c08e25bb7184f501b5f2b9af33f
    externalRefs:
      - referenceCategory: PACKAGE-MANAGER
        referenceType: purl
        referenceLocator: "pkg:npm/example-retry@1.0.4"
  - SPDXID: SPDXRef-Package-example-json-path
    name: example-json-path
    versionInfo: 2.0.5
    downloadLocation: "https://registry.orchard.example/example-json-path/-/example-json-path-2.0.5.tgz"
    filesAnalyzed: false
    supplier: "Organization: Example Softworks (fictional)"
    licenseConcluded: MIT
    licenseDeclared: MIT
    copyrightText: NOASSERTION
    checksums:
      - algorithm: SHA256
        checksumValue: 74e30e4812a0cc92bd7c1a965e6f953f5d92b9eaf3cd77d90663a7344e939b63
    externalRefs:
      - referenceCategory: PACKAGE-MANAGER
        referenceType: purl
        referenceLocator: "pkg:npm/example-json-path@2.0.5"
  - SPDXID: SPDXRef-Package-example-yaml-lite
    name: example-yaml-lite
    versionInfo: 1.1.7
    downloadLocation: "https://registry.orchard.example/example-yaml-lite/-/example-yaml-lite-1.1.7.tgz"
    filesAnalyzed: false
    supplier: "Organization: Example Softworks (fictional)"
    licenseConcluded: Apache-2.0
    licenseDeclared: Apache-2.0
    copyrightText: NOASSERTION
    checksums:
      - algorithm: SHA256
        checksumValue: d7094de3c8e15621381e5f9f02c0eecb9977d249a8a06ab2b0a34f5344a039af
    externalRefs:
      - referenceCategory: PACKAGE-MANAGER
        referenceType: purl
        referenceLocator: "pkg:npm/example-yaml-lite@1.1.7"
relationships:
  - spdxElementId: SPDXRef-DOCUMENT
    relatedSpdxElement: SPDXRef-Package-orchard-example-gateway
    relationshipType: DESCRIBES
  - spdxElementId: SPDXRef-Package-orchard-example-gateway
    relatedSpdxElement: SPDXRef-Package-orchard-example-router
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-orchard-example-gateway
    relatedSpdxElement: SPDXRef-Package-orchard-example-http-core
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-orchard-example-gateway
    relatedSpdxElement: SPDXRef-Package-example-metrics
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-orchard-example-gateway
    relatedSpdxElement: SPDXRef-Package-example-cache
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-orchard-example-gateway
    relatedSpdxElement: SPDXRef-Package-example-crypto-shim
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-orchard-example-router
    relatedSpdxElement: SPDXRef-Package-example-logger
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-orchard-example-router
    relatedSpdxElement: SPDXRef-Package-example-retry
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-orchard-example-http-core
    relatedSpdxElement: SPDXRef-Package-example-logger
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-orchard-example-http-core
    relatedSpdxElement: SPDXRef-Package-example-json-path
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-example-metrics
    relatedSpdxElement: SPDXRef-Package-example-logger
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-example-cache
    relatedSpdxElement: SPDXRef-Package-example-yaml-lite
    relationshipType: DEPENDS_ON
  - spdxElementId: SPDXRef-Package-example-yaml-lite
    relatedSpdxElement: SPDXRef-Package-example-json-path
    relationshipType: DEPENDS_ON
documentDescribes:
  - SPDXRef-Package-orchard-example-gateway