{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "version": 1,
  "components": [
    {
      "type": "application",
      "group": "com.google.code.findbugs",
      "name": "findbugs-project",
      "version": "3.0.0",
      "licenses": [
        {
          "license": {
            "id": "LGPL-3.0-or-later",
            "url": "https://www.gnu.org/licenses/lgpl-3.0-standalone.html"
          }
        }
      ],
      "purl": "pkg:maven/com.google.code.findbugs/findbugs-project@3.0.0",
      "evidence": {
        "identity": [
          {
            "field": "purl",
            "confidence": 1,
            "methods": [
              {
                "technique": "filename",
                "confidence": 0.1,
                "value": "findbugs-project-3.0.0.jar"
              },
              {
                "technique": "ast-fingerprint",
                "confidence": 0.9,
                "value": "61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab"
              },
              {
                "technique": "hash-comparison",
                "confidence": 0.7,
                "value": "7c547a9d67cc7bc315c93b6e2ff8e4b6b41ae5be454ac249655ecb5ca2a85abf"
              }
            ],
            "tools": [
              "bom-ref-of-tool-that-performed-analysis"
            ]
          }
        ],
        "occurrences": [
          {
            "bom-ref": "d6bf237e-4e11-4713-9f62-56d18d5e2079",
            "location": "/path/to/component"
          },
          {
            "bom-ref": "b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175",
            "location": "/another/path/to/component"
          }
        ],
        "callstack": {
          "frames": [
            {

              "package": "com.apache.logging.log4j.core",
              "module": "Logger.class",
              "function": "logMessage",
              "parameters": [
                "com.acme.HelloWorld", "Level.INFO", "null", "Hello World"
              ],
              "line": 150,
              "column": 17,
              "fullFilename": "/path/to/log4j-core-2.14.0.jar!/org/apache/logging/log4j/core/Logger.class"
            },
            {
              "module": "HelloWorld.class",
              "function": "main",
              "line": 20,
              "column": 12,
              "fullFilename": "/path/to/HelloWorld.class"
            }
          ]
        },
        "licenses": [
          {
            "license": {
              "id": "Apache-2.0",
              "url": "http://www.apache.org/licenses/LICENSE-2.0"
            }
          },
          {
            "license": {
              "id": "LGPL-2.1-only",
              "url": "https://opensource.org/licenses/LGPL-2.1"
            }
          }
        ],
        "copyright": [
          {
            "text": "Copyright 2012 Google Inc. All Rights Reserved."
          },
          {
            "text": "Copyright (C) 2004,2005 Dave Brosius <dbrosius@users.sourceforge.net>"
          },
          {
            "text": "Copyright (C) 2005 William Pugh"
          },
          {
            "text": "Copyright (C) 2004,2005 University of Maryland"
          }
        ]
      }
    }
  ]
}