##### SPDX tag-value document — SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.

SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: orchard-gateway-4.2.0
DocumentNamespace: https://sbom.orchard.example/spdx/606ea3ac-261b-482c-a69b-0eb119b287ad
Creator: Organization: Example Softworks (fictional)
Creator: Tool: novus-sbom-fixture-1.0.0
Created: 2026-01-01T00:00:00Z
CreatorComment: <text>Fictional component tree. No package named here exists.</text>

##### Package: @orchard-example/gateway

PackageName: @orchard-example/gateway
SPDXID: SPDXRef-Package-orchard-example-gateway
PackageVersion: 4.2.0
PackageSupplier: Organization: Example Softworks (fictional)
PackageDownloadLocation: https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz
FilesAnalyzed: false
PackageChecksum: SHA256: cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f
PackageLicenseConcluded: Apache-2.0
PackageLicenseDeclared: Apache-2.0
PackageCopyrightText: NOASSERTION
ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/gateway@4.2.0

##### Package: @orchard-example/router

PackageName: @orchard-example/router
SPDXID: SPDXRef-Package-orchard-example-router
PackageVersion: 2.1.3
PackageSupplier: Organization: Example Softworks (fictional)
PackageDownloadLocation: https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz
PackageLicenseConclude