<?xml version="1.0"?>
<bom serialNumber="urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79" version="1" xmlns="http://cyclonedx.org/schema/bom/1.6">
    <components>
        <component type="application">
            <group>com.google.code.findbugs</group>
            <name>findbugs-project</name>
            <version>3.0.0</version>
            <licenses>
                <license>
                    <id>LGPL-3.0-or-later</id>
                    <url>https://www.gnu.org/licenses/lgpl-3.0-standalone.html</url>
                </license>
            </licenses>
            <purl>pkg:maven/com.google.code.findbugs/findbugs-project@3.0.0</purl>
            <evidence>
                <identity>
                    <field>purl</field>
                    <confidence>1</confidence>
                    <methods>
                        <method>
                            <technique>filename</technique>
                            <confidence>0.1</confidence>
                            <value>findbugs-project-3.0.0.jar</value>
                        </method>
                        <method>
                            <technique>ast-fingerprint</technique>
                            <confidence>0.9</confidence>
                            <value>61e4bc08251761c3a73b606b9110a65899cb7d44f3b14c81ebc1e67c98e1d9ab</value>
                        </method>
                        <method>
                            <technique>hash-comparison</technique>
                            <confidence>0.7</confidence>
                            <value>7c547a9d67cc7bc315c93b6e2ff8e4b6b41ae5be454ac249655ecb5ca2a85abf</value>
                        </method>
                    </methods>
                    <tools>
                        <tool ref="bom-ref-of-tool-that-performed-analysis"/>
                    </tools>
                </identity>
                <occurrences>
                    <occurrence bom-ref="d6bf237e-4e11-4713-9f62-56d18d5e2079">
                        <location>/path/to/component</location>
                    </occurrence>
                    <occurrence bom-ref="b574d5d1-e3cf-4dcd-9ba5-f3507eb1b175">
                        <location>/another/path/to/component</location>
                    </occurrence>
                </occurrences>
                <callstack>
                    <frames>
                        <frame>
                            <package>com.apache.logging.log4j.core</package>
                            <module>Logger.class</module>
                            <function>logMessage</function>
                            <parameters>
                                <parameter>com.acme.HelloWorld</parameter>
                                <parameter>Level.INFO</parameter>
                                <parameter>null</parameter>
                                <parameter>Hello World</parameter>
                            </parameters>
                            <line>150</line>
                            <column>17</column>
                            <fullFilename>/path/to/log4j-core-2.14.0.jar!/org/apache/logging/log4j/core/Logger.class</fullFilename>
                        </frame>
                        <frame>
                            <module>HelloWorld.class</module>
                            <function>main</function>
                            <line>20</line>
                            <column>12</column>
                            <fullFilename>/path/to/HelloWorld.class</fullFilename>
                        </frame>
                    </frames>
                </callstack>
                <licenses>
                    <license>
                        <id>Apache-2.0</id>
                        <url>http://www.apache.org/licenses/LICENSE-2.0</url>
                    </license>
                    <license>
                        <id>LGPL-2.1-only</id>
                        <url>https://opensource.org/licenses/LGPL-2.1</url>
                    </license>
                </licenses>
                <copyright>
                    <text><![CDATA[Copyright 2012 Google Inc. All Rights Reserved.]]></text>
                    <text><![CDATA[Copyright (C) 2004,2005 Dave Brosius <dbrosius@users.sourceforge.net>]]></text>
                    <text><![CDATA[Copyright (C) 2005 William Pugh]]></text>
                    <text><![CDATA[Copyright (C) 2004,2005 University of Maryland]]></text>
                </copyright>
            </evidence>
        </component>
    </components>
</bom>
