<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.6" serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1">
  <components>
    <component type="application">
      <group>com.google.code.findbugs</group>
      <name>findbugs-project</name>
      <version>3.0.0</version>
      <licenses>
        <license>
          <id>LGPL-3.0-or-later</id>
          <url>https://www.gnu.org/licenses/lgpl-3.0-standalone.html</url>
        </license>
      </licenses>
      <purl>pkg:maven/com.google.code.findbugs/findbugs-project@3.0.0</purl>
      <evidence>
        <identity>
          <field>purl</field>
          <confidence>1</confidence>
          <methods>
            <method>
              <technique>filename</technique>
              <confidence>0.1</confidence>
              <value>findbugs-project-3.0.0.jar</value>
            </method>
            <method>
              <technique>ast-fingerprint</technique>
              <confidence>0.9</confidence>
              <value>61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab</value>
            </method>
            <method>
              <technique>hash-comparison</technique>
              <confidence>0.7</confidence>
              <value>7c547a9d67cc7bc315c93b6e2ff8e4b6b41ae5be454ac249655ecb5ca2a85abf</value>
            </method>
          </methods>
          <tools>
            <tool ref="bom-ref-of-tool-that-performed-analysis"></tool>
          </tools>
        </identity>
        <occurrences>
          <occurrence bom-ref="d6bf237e-4e11-4713-9f62-56d18d5e2079">
            <location>/path/to/component</location>
          </occurrence>
          <occurrence bom-ref="b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175">
            <location>/another/path/to/component</location>
          </occurrence>
        </occurrences>
        <callstack>
          <frames>
            <frame>
              <package>com.apache.logging.log4j.core</package>
              <module>Logger.class</module>
              <function>logMessage</function>
              <parameters>
                <parameter>com.acme.HelloWorld</parameter>
                <parameter>Level.INFO</parameter>
                <parameter>null</parameter>
                <parameter>Hello World</parameter>
              </parameters>
              <line>150</line>
              <column>17</column>
              <fullFilename>/path/to/log4j-core-2.14.0.jar!/org/apache/logging/log4j/core/Logger.class</fullFilename>
            </frame>
            <frame>
              <module>HelloWorld.class</module>
              <function>main</function>
              <line>20</line>
              <column>12</column>
              <fullFilename>/path/to/HelloWorld.class</fullFilename>
            </frame>
          </frames>
        </callstack>
        <licenses>
          <license>
            <id>Apache-2.0</id>
            <url>http://www.apache.org/licenses/LICENSE-2.0</url>
          </license>
          <license>
            <id>LGPL-2.1-only</id>
            <url>https://opensource.org/licenses/LGPL-2.1</url>
          </license>
        </licenses>
        <copyright>
          <text>Copyright 2012 Google Inc. All Rights Reserved.</text>
          <text>Copyright (C) 2004,2005 Dave Brosius &lt;dbrosius@users.sourceforge.net&gt;</text>
          <text>Copyright (C) 2005 William Pugh</text>
          <text>Copyright (C) 2004,2005 University of Maryland</text>
        </copyright>
      </evidence>
    </component>
  </components>
</bom>
