##### SPDX tag-value document — SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented. SPDXVersion: SPDX-2.3 DataLicense: CC0-1.0 SPDXID: SPDXRef-DOCUMENT DocumentName: orchard-gateway-image-sha256-d09edb133f61 DocumentNamespace: https://sbom.orchard.example/spdx/c0b43fba-568c-4a01-a26e-cb9595624713 Creator: Organization: Example Softworks (fictional) Creator: Tool: novus-sbom-fixture-1.0.0 Created: 2026-01-01T00:00:00Z CreatorComment: Fictional component tree. No package named here exists. ##### Package: @orchard-example/gateway PackageName: @orchard-example/gateway SPDXID: SPDXRef-Package-orchard-example-gateway PackageVersion: 4.2.0 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz FilesAnalyzed: false PackageChecksum: SHA256: cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f PackageLicenseConcluded: Apache-2.0 PackageLicenseDeclared: Apache-2.0 PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/gateway@4.2.0 ##### Package: @orchard-example/router PackageName: @orchard-example/router SPDXID: SPDXRef-Package-orchard-example-router PackageVersion: 2.1.3 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz FilesAnalyzed: false PackageChecksum: SHA256: d17f0a5171a018c41cdaaa2701b6c32bf49f7404032fa45e5721e2b794cd2e51 PackageLicenseConcluded: Apache-2.0 PackageLicenseDeclared: Apache-2.0 PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/router@2.1.3 ##### Package: @orchard-example/http-core PackageName: @orchard-example/http-core SPDXID: SPDXRef-Package-orchard-example-http-core PackageVersion: 1.8.0 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/@orchard-example/http-core/-/http-core-1.8.0.tgz FilesAnalyzed: false PackageChecksum: SHA256: 05dc223ec1875dfd80d8c5873f8c29f036f98587f2fe2d02abc7c718bfb4b8bf PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/http-core@1.8.0 ##### Package: example-metrics PackageName: example-metrics SPDXID: SPDXRef-Package-example-metrics PackageVersion: 4.0.0 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/example-metrics/-/example-metrics-4.0.0.tgz FilesAnalyzed: false PackageChecksum: SHA256: 4a8930c617fd12bb99d26e868224d9918e4a3e00f8dd26b876ed19eb6e664f73 PackageLicenseConcluded: MIT PackageLicenseDeclared: MIT PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/example-metrics@4.0.0 ##### Package: example-cache PackageName: example-cache SPDXID: SPDXRef-Package-example-cache PackageVersion: 0.9.2 PackageSupplier: Organization: Example Softworks (fictional) PackageDownloadLocation: https://registry.orchard.example/example-cache/-/example-cache-0.9.2.tgz FilesAnalyzed: false PackageChecksum: SHA256: f7af2ad2d3c3daaa5991b0eae38ffa151a2e2f3bf0f2bdd7333adc3a1dc860f7 PackageLicenseConcluded: BSD-3-Clause PackageLicenseDeclared: BSD-3-Clause PackageCopyrightText: NOASSERTION ExternalRef: PACKAGE-MANAGER purl pkg:npm/example-cache@0.9.2 ##### Relationships Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-orchard-example-gateway Relationship: SPDXRef-Package-orchard-example-gateway DEPENDS_ON SPDXRef-Package-orchard-example-router Relationship: SPDXRef-Package-orchard-example-gateway DEPENDS_ON SPDXRef-Package-orchard-example-http-core Relationship: SPDXRef-Package-orchard-example-gateway DEPENDS_ON SPDXRef-Package-example-metrics Relationship: SPDXRef-Package-orchard-example-gateway DEPENDS_ON SPDXRef-Package-example-cache