<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.6" serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1">
  <metadata>
    <tools>
      <components>
        <component type="application">
          <group>Awesome Vendor</group>
          <name>Awesome Tool</name>
          <version>9.1.2</version>
          <hashes>
            <hash alg="SHA-1">25ed8e31b995bb927966616df2a42b979a2717f0</hash>
            <hash alg="SHA-256">a74f733635a19aefb1f73e5947cef59cd7440c6952ef0f03d09d974274cbd6df</hash>
          </hashes>
        </component>
      </components>
      <services>
        <service>
          <provider>
            <name>Acme Org</name>
            <url>https://example.com</url>
          </provider>
          <group>com.example</group>
          <name>Acme Signing Server</name>
          <description>Signs artifacts</description>
          <endpoints>
            <endpoint>https://example.com/sign</endpoint>
            <endpoint>https://example.com/verify</endpoint>
            <endpoint>https://example.com/tsa</endpoint>
          </endpoints>
        </service>
      </services>
    </tools>
  </metadata>
</bom>
