{"id":19459,"date":"2022-07-21T18:30:20","date_gmt":"2022-07-21T16:30:20","guid":{"rendered":"http:\/\/blog.wenzlaff.de\/?p=19459"},"modified":"2023-08-25T17:03:54","modified_gmt":"2023-08-25T15:03:54","slug":"einfaches-generieren-von-software-bill-of-materials-sbom-mit-maven-cyclonedx-plugin","status":"publish","type":"post","link":"http:\/\/blog.wenzlaff.de\/?p=19459","title":{"rendered":"Einfaches generieren von Software Bill of Materials (SBOM) mit Maven CycloneDX Plugin"},"content":{"rendered":"

SBOM<\/a> (Software Bill of Materials) ist eine Inventar Liste einer Codebasis (hier im Beispiel Java), einschlie\u00dflich aller identifizierbaren Komponenten samt ihrer Lizenz- und Versionsinformationen sowie Angaben zu eventuell vorhandenen Sicherheitsl\u00fccken.
\nSBOM<\/a> soll helfen, den Softwarecode samt bekannter Bugs und lizenzrechtlicher Fallstricke in der Codebasis zu inventarisieren, um so Risiken auszumerzen.<\/p>\n

\"\"<\/p>\n

Diese SBOM Listen im Json oder XML Format k\u00f6nnen leicht mit dem Maven Plugin CycloneDX <\/a> erzeugt werden.<\/p>\n

Das Plugin kann in der pom.xml an die Package-Phase wie folgt mit den default Werten angekoppelt werden:<\/p>\n

<plugins>\r\n    <plugin>\r\n        <groupId>org.cyclonedx<\/groupId>\r\n        <artifactId>cyclonedx-maven-plugin<\/artifactId>\r\n        <version>2.7.1<\/version>\r\n        <executions>\r\n            <execution>\r\n                <phase>package<\/phase>\r\n                <goals>\r\n                    <goal>makeAggregateBom<\/goal>\r\n                <\/goals>\r\n            <\/execution>\r\n        <\/executions>\r\n        <configuration>\r\n            <projectType>library<\/projectType>\r\n            <schemaVersion>1.4<\/schemaVersion>\r\n            <includeBomSerialNumber>true<\/includeBomSerialNumber>\r\n            <includeCompileScope>true<\/includeCompileScope>\r\n            <includeProvidedScope>true<\/includeProvidedScope>\r\n            <includeRuntimeScope>true<\/includeRuntimeScope>\r\n            <includeSystemScope>true<\/includeSystemScope>\r\n            <includeTestScope>false<\/includeTestScope>\r\n            <includeLicenseText>false<\/includeLicenseText>\r\n            <outputReactorProjects>true<\/outputReactorProjects>\r\n            <outputFormat>all<\/outputFormat>\r\n            <outputName>bom<\/outputName>\r\n        <\/configuration>\r\n    <\/plugin>\r\n<\/plugins><\/pre>\n
Hier die erzeugten Beispiel SBOM<\/a> f\u00fcr das TWBibel<\/a> Projekt im XML Format (entfernt).<\/p>\n
Und im JSON Format:<\/p>\n
{\r\n  \"bomFormat\" : \"CycloneDX\",\r\n  \"specVersion\" : \"1.4\",\r\n  \"serialNumber\" : \"urn:uuid:80c3922e-4622-4e43-980f-a7f5512abc43\",\r\n  \"version\" : 1,\r\n  \"metadata\" : {\r\n    \"timestamp\" : \"2022-07-21T16:12:38Z\",\r\n    \"tools\" : [\r\n      {\r\n        \"vendor\" : \"OWASP Foundation\",\r\n        \"name\" : \"CycloneDX Maven plugin\",\r\n        \"version\" : \"2.7.1\",\r\n        \"hashes\" : [\r\n          {\r\n            \"alg\" : \"MD5\",\r\n            \"content\" : \"538c878ebf89b372876e247d056a3fc5\"\r\n          },\r\n          {\r\n            \"alg\" : \"SHA-1\",\r\n            \"content\" : \"4561e50edb47e12a03712b1afce9b20cba32fd28\"\r\n          },\r\n          {\r\n            \"alg\" : \"SHA-256\",\r\n            \"content\" : \"f0ea7b3bcf5c7ba649b8d9807e805385330501881677d47333aebce8305ef4d4\"\r\n          },\r\n          {\r\n            \"alg\" : \"SHA-512\",\r\n            \"content\" : \"a35400ca6411692ae8964fe7030eaba2a83a2fa50e2883def3054191283c3b48e2dcdd68bf80f5a0ede3898cc6b7cb7b998aacd2c1e969320053c43b6ab8d873\"\r\n          },\r\n          {\r\n            \"alg\" : \"SHA-384\",\r\n            \"content\" : \"75c0c03a03c69e82ad1f7b942d6d733da8261c4058174355d6b24ebd88cee34180f2e8484d2b0fedaf459078bdf6e927\"\r\n          },\r\n          {\r\n            \"alg\" : \"SHA3-384\",\r\n            \"content\" : \"98cd312d4dfc104a0a66d65023d0aade423f08951f2a9e0215e703f0c81c4f274d8e11a2db1abc30a558b820d65860c4\"\r\n          },\r\n          {\r\n            \"alg\" : \"SHA3-256\",\r\n            \"content\" : \"0c5fd65013128de457b049a824c4ad11212d668b503613ce19a54d545e5cf82d\"\r\n          },\r\n          {\r\n            \"alg\" : \"SHA3-512\",\r\n            \"content\" : \"72ea0ed8faa3cc4493db96d0223094842e7153890b091ff364040ad3ad89363157fc9d1bd852262124aec83134f0c19aa4fd0fa482031d38a76d74dfd36b7964\"\r\n          }\r\n        ]\r\n      }\r\n    ],\r\n    \"component\" : {\r\n      \"group\" : \"de.wenzlaff.twbibel\",\r\n      \"name\" : \"de.wenzlaff.twbibel\",\r\n      \"version\" : \"0.1.1\",\r\n      \"description\" : \"Bible BEs\",\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"Apache-2.0\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/de.wenzlaff.twbibel\/de.wenzlaff.twbibel@0.1.1?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"distribution\",\r\n          \"url\" : \"https:\/\/oss.sonatype.org\/service\/local\/staging\/deploy\/maven2\/\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/gitlab.com\/IT-Berater\/twbibel\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/de.wenzlaff.twbibel\/de.wenzlaff.twbibel@0.1.1?type=jar\"\r\n    }\r\n  },\r\n  \"components\" : [\r\n    {\r\n      \"group\" : \"org.openjfx\",\r\n      \"name\" : \"javafx-graphics\",\r\n      \"version\" : \"17.0.1\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"15f69c53f8abd8ba682382ae02895392\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"60505369f7528056d4d8c5ea080df5447bdb0264\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"95f31f7e600af94ef9cc1356ad6c71ee94b1a96e399684fb7938c61fa1908ab8\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"55c91d2001b16706bc6a77e4cd407bac4adcf6ea88b2e6db4437c2f93b758f2339285af50b29ca88228941068de458ca423e75d2a308ce2048809840fa14a220\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"3ec7ada6b738c0402a9f300ce173e236ad8840585d17b966d2842ce508f5d6a771720f467c03ea08762e51c684c50b77\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"abfb96f3de1cb500e8243a260cc3e747d03c060be599da90349a3d203322f15b2e1980a69f751e9de7fb68ac3833b060\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"8b47999f0070e37fd5a7ed4f2a21ccd0125e34de29d004c62115b2f9aed7b2c4\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"0008222b86330c03f1d9ce2c2a0310155d7d72e1ef7284efd32abad7e2b8bee4e248cc114f90f0c6ebdefa2b6b4ac12981976a0c5cd12d2eeb23dfcc0c141622\"\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.openjfx\/javafx-graphics@17.0.1?classifier=mac&type=jar\",\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.openjfx\/javafx-graphics@17.0.1?classifier=mac&type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"org.openjfx\",\r\n      \"name\" : \"javafx-base\",\r\n      \"version\" : \"17.0.1\",\r\n      \"description\" : \"OpenJFX JavaFX\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"481b4f438a0b0e5b9ffb432cde040e58\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"2c53dcf0d89ff42a63b09d941cab75c5a052ef32\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"045700bcabd5441a50964944f38babbee8fc2e8159179b8cb5e64d18274e3853\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"9f6303ea590a5a78beac4f5558f2995f8312b20b5dcb44da1a4b07b74f4f67a4bf4bd39ed997f49a93eca459496c6952d8a196ad6cf32bc30acfee7797440b1c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"c77280bb6ce0238daa2a42a5f9ce7d04727ffe53d9bbb07359a1309dfdf011cfb4fffd322b7dd3f08385980c95e34eba\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"521cb39f95cb766f5e68a394932bf0d0805d195d382453b0dee3c6c74116ade61c5b6f5c95ae4400a42e66776f2e832f\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"a00a8c62a461838dbf0df3abdfa87882bd8a0ca9587c725b1d87d912bd173cff\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"5a2230091a56e0e85869c09ceaeb14df8639ba49938010fe98b42d2263c2921d09e3eeecb9c06cf9256e5247ad26245b6c08da5f8e2921b0aea5677672f3377c\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"GPL-2.0-with-classpath-exception\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.openjfx\/javafx-base@17.0.1?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/github.com\/openjdk\/jfx\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.openjfx\/javafx-base@17.0.1?type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"org.openjfx\",\r\n      \"name\" : \"javafx-fxml\",\r\n      \"version\" : \"16-ea+5\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"ad8219af4809b18b80e9f0e13326a7f4\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"49b4a39949045a4a783703e4c836547d78ff2308\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"a932151babd4f2bdce00751180eb4cd8dcd7d55c8ecd4c01db106d619132be60\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"f02c49908bb1a4a8d11928c2cf864b576f94f98ddb2ad14f85de33b29b1ddac12281a6d8d9a362cbb937a67d790cad0cedc36d472e94a648567423eaf55f6fe9\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"1f06b2661ef7f1522c843927933fe8ea7e502ec5bce6ed4c5cc3c68718583d7b0cfa45500968ecd75085de38e38adf6c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"018af2810c6e2e6dc86522120823e904b9e085d1c3eaa4362ba83ee282b9daebce5a5b122d2f8ae93e32d4c6110ad297\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"4dcb1b9f708fd9c49dd1a55f6163d336a3072e327b63edd323f041295bd2c919\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"c02e2123dca3d94b7e572cce65af1ecbf0eb7429327121afa90cf2e23b06c8e540f42376415ff104416e29ef353b5a9ed6be7d1f548d968faf6af00a6161d73e\"\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.openjfx\/javafx-fxml@16-ea%2B5?classifier=mac&type=jar\",\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.openjfx\/javafx-fxml@16-ea%2B5?classifier=mac&type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"org.openjfx\",\r\n      \"name\" : \"javafx-controls\",\r\n      \"version\" : \"16-ea+5\",\r\n      \"description\" : \"OpenJFX JavaFX\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"81108571eb8f3651f51768f7527d729d\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"a6c9aa44542e32292303e3809c4dcc64f18d39b2\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"836e365e866228d8cc52cee57e81af662da5963ea91d428eecde9f45116374a2\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"e02d6b1ab4c5f908213854b3def1d9768081e6f9458c2558317b0493e84cfcb248e229e35e779ad65bcf0c87c129c59f4d33ce314e78fe81a2630fcc4b25ffe2\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"81616a0053a8cc908eaaf6a2f2644a2e7e2ba80812085e2caeaf10e464fc3e912647ee4898c2021bd2d4773f1c3597f9\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"8525d5554ece56033f0c41d02b06928c3488021049bd4a666747815b067b1c1461b8d18f99de59c44fba27c6af429801\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"81673caa41289262a6d8b8d417d6e9aecce2c27ddea0c0b70f35f5fa1bd323ca\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"ff735610a65c601c2929b7cb7aebac7096e01726e18a6b6b333c888b64ae15baa7a0387563d2fa8c896399acbd24c833c74f6ef357e0aa1e4804472c260e7015\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"GPL-2.0-with-classpath-exception\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.openjfx\/javafx-controls@16-ea%2B5?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/github.com\/openjdk\/jfx\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.openjfx\/javafx-controls@16-ea%2B5?type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"org.openjfx\",\r\n      \"name\" : \"javafx-controls\",\r\n      \"version\" : \"17.0.1\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"2d7449f7e25c42d43409e8d665d7f7c3\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"9c4e3c7ee4fe3f2d71cb94811910695f43040dc5\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"9bcaff9cb652f7d5e8c3ab36ea837c6d123ae93e43ee66767dc0f65f15563640\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"b019fa6aa881272e0c294071e962b5462bd54f3b4f649ca95a599f900df0fb3a5a1e60923d730b9c9a98d9aea9fb7a7d2ad5f4f1e2f169c0956685aef53e7dd2\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"071645e68313539caaba560bb9f581099826d185a3af2f61de2f672c279432cb22fb7d9bdee146f62a41da3e7087efbd\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"0d16aeb35e7bb98a0d819ac226d8ca0b38588bd5627902b82dae6fd3dcebc29278f32714c49c20637988f6cf25bfed3a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"4f8e6cbf12e45a2ba38ab33019952c9d82a19c8dfed673a9b438df3eaee7fd30\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"07cbc07c40189f6243e9680521289f7d9a0b474d50ade55896a2723c0c65494bc4f4fd0926b0746fa38b0b756e96db601691fa7f62475a7c6b455713cbb654ed\"\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.openjfx\/javafx-controls@17.0.1?classifier=mac&type=jar\",\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.openjfx\/javafx-controls@17.0.1?classifier=mac&type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"org.openjfx\",\r\n      \"name\" : \"javafx-graphics\",\r\n      \"version\" : \"17.0.1\",\r\n      \"description\" : \"OpenJFX JavaFX\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"7545a300bfc844c796a9c293b396a968\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"324fd0f6c9c55330fc64a44dde0887d9646e800a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"53d60cef64ab6a1549da4d0239c009f8ef8084b62ecd18c3bda782b4d6520a8f\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"a366830966ba519d627d73be30799b24f1531b1afe15cbad976611825b4f322ecc566e26913fa74e7864d226524fff32f33e96c476f5f1786e93924724eaf4db\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"d05fe8360cd031c9fc7742e2bb68f4050fd054164579b27497c35655ac7ead728a1bd50a61da9ae17af1c8ac3af0bda8\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"6cd338d15a94f8f8025b9d7203527c0c6d6c6f8f82972e8c7553cb552a51219aaae9e66294a6b453833057fe0c1c2c2e\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"aeca507caa11797d3d98a781e618501478eb45121d17909b010593bead9ea783\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"c09d1c99287e87e773c1d3583d22aa7d3ed90a69e4533114bfd54ecfa824fc11b0172afb759f0186d8985df7b846edd84dbf410d8c83d30e5c60dfe50756afe7\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"GPL-2.0-with-classpath-exception\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.openjfx\/javafx-graphics@17.0.1?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/github.com\/openjdk\/jfx\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.openjfx\/javafx-graphics@17.0.1?type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"org.openjfx\",\r\n      \"name\" : \"javafx-base\",\r\n      \"version\" : \"17.0.1\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"a7521cc0781a6ec5bbcfd30da3396187\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"75cfa6f780ea3b3fd4ae336161e9e136ebb91ef2\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"2a4f9e646dace35300abb19464f350691e7a00d883b24c6595832448a1cee0ef\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"d6ca4560816e79793735f786a5f3ea0d80920d6a84dc17c7cfd02d2470e6d0436922f7fd023c448271e6cb805d1ca16bd39d4f25c41f14e4f708ed60e6516198\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"0893c40a5cf5c663364ffdcccde7ed1d1908ac43d4cf2102b119ae1aa16709b9a708d36417c3e6328a594538ed8ff44b\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"7ba9d349cf9f43a56366a54f13d8efaaca58ca74d1bf24c8c017056d6d7f0197cc200432fcbdc092f731360ad642ce0f\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"d90f73d262a73f4e1225f1c0602db59c0e0ce5f7fd0b157ed15be6847d5ef80f\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"cbbd379f63b34e7bc21073a64473e9bda0e667f903d3875d0b842f184532c0b6d0d0622116fbac520e3f822dc57774e94539b8ca3111e73d4f5aa7d35c49a7e8\"\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.openjfx\/javafx-base@17.0.1?classifier=mac&type=jar\",\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.openjfx\/javafx-base@17.0.1?classifier=mac&type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"The Apache Software Foundation\",\r\n      \"group\" : \"org.apache.httpcomponents\",\r\n      \"name\" : \"httpclient\",\r\n      \"version\" : \"4.5.13\",\r\n      \"description\" : \"Apache HttpComponents Client\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"40d6b9075fbd28fa10292a45a0db9457\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"e5f6cae5ca7ecaac1ec2827a9e2d65ae2869cada\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"6fe9026a566c6a5001608cf3fc32196641f6c1e5e1986d1037ccdbd5f31ef743\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"3567739186e551f84cad3e4b6b270c5b8b19aba297675a96bcdff3663ff7d20d188611d21f675fe5ff1bfd7d8ca31362070910d7b92ab1b699872a120aa6f089\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"093ac3e2dde58e34aa70309c7305eb3c9b5be2509a9293f1672494da55479a86bd112e83326746dc7a32855472952b99\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"cd6882e7868624164e460f2f3ea01466f863c0dcb902b031c656b57356f563be83b29530df41d88d634ed3d01fc9964d\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"710b1d8d7dae0b8e4270756694ca9c83d64965f42d3b4170c609b14d47c2762c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"276fa6a6599dc89382d658115695cf4da6b0d39b34e9c349c17a5dbd64122eaee553bb9ed75c0378ec4a83be157c8aa39370662de3c9b8fd55ebc1dd608383e6\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"Apache-2.0\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.apache.httpcomponents\/httpclient@4.5.13?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"http:\/\/www.apache.org\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"http:\/\/issues.apache.org\/jira\/browse\/HTTPCLIENT\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"http:\/\/mail-archives.apache.org\/mod_mbox\/hc-httpclient-users\/\"\r\n        },\r\n        {\r\n          \"type\" : \"distribution\",\r\n          \"url\" : \"https:\/\/repository.apache.org\/service\/local\/staging\/deploy\/maven2\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.apache.httpcomponents\/httpclient@4.5.13?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"The Apache Software Foundation\",\r\n      \"group\" : \"org.apache.httpcomponents\",\r\n      \"name\" : \"httpcore\",\r\n      \"version\" : \"4.4.13\",\r\n      \"description\" : \"Apache HttpComponents Core (blocking I\/O)\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"e07a248f61c52776a2366c075dcd4963\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"853b96d3afbb7bf8cc303fe27ee96836a10c1834\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"e06e89d40943245fcfa39ec537cdbfce3762aecde8f9c597780d2b00c2b43424\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"23430cde8b9bed33c91474ba49f1143284135df1b25fdcbc37bc3bb7e9549e77b3918eb40250093db652ae200367e87316129b23b4f6987e94939d60f467498d\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"b776d57492478c162d428bdd3139be0fa6c3cf4503355c3a04710ca7bc3ee74d66627f49eb42814fd8f8364dbd17aa91\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"f6f9e70b76717b705d040f0b33857f0dde89736f2e6d55ea56585235eb1b6d0ce4d5aa18c82050391ac968dcb5ec29e2\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"721a9fc1bb353ddf3e438bed4306a3fa5b55ffafb474be5dc8715bd23d7a5afa\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"c78f9d464e4b840e28266658512b1cab0ece1470bef2764deb2dc20ba69b73d526d92a19494ccb87b4408f9235c4294417f2e10ba709469f4bd62d017b9e3cbe\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"Apache-2.0\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.apache.httpcomponents\/httpcore@4.4.13?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"http:\/\/www.apache.org\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"http:\/\/issues.apache.org\/jira\/browse\/HTTPCORE\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"http:\/\/mail-archives.apache.org\/mod_mbox\/hc-httpclient-users\/\"\r\n        },\r\n        {\r\n          \"type\" : \"distribution\",\r\n          \"url\" : \"https:\/\/repository.apache.org\/service\/local\/staging\/deploy\/maven2\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.apache.httpcomponents\/httpcore@4.4.13?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"The Apache Software Foundation\",\r\n      \"group\" : \"commons-logging\",\r\n      \"name\" : \"commons-logging\",\r\n      \"version\" : \"1.2\",\r\n      \"description\" : \"Apache Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"040b4b4d8eac886f6b4a2a3bd2f31b00\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"4bfc12adfe4842bf07b657f0369c4cb522955686\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"ed00dbfabd9ae00efa26dd400983601d076fe36408b7d6520084b447e5d1fa527ce65bd6afdcb58506c3a808323d28e88f26cb99c6f5db9ff64f6525ecdfa557\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"ac20720d7156131478205f1b454395abf84cfc8da2f163301af32f63bd3c4764bd26cb54ed53800f33193ae591f3ce9c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"628eb4407e95dca84da1a06b08a6d9b832a49de8472b1b217e8607f08efeeed18b996232d64dd07f03e78e0e3bb4b078\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"9aab62deccf156ee6e324c925dfc30ecb53e8465802863a551901a461424e807\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"3fd76857f6d20c03799537cc961c1c4ddf1c375c6c192fb982363e3b9397ba138b77f24ef38b4202f44e37586789c0320e4de18fdadd2772304fd14a9b26d552\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"Apache-2.0\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/commons-logging\/commons-logging@1.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"http:\/\/issues.apache.org\/jira\/browse\/LOGGING\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"http:\/\/svn.apache.org\/repos\/asf\/commons\/proper\/logging\/trunk\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/continuum-ci.apache.org\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"http:\/\/mail-archives.apache.org\/mod_mbox\/commons-user\/\"\r\n        },\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"http:\/\/www.apache.org\/\"\r\n        },\r\n        {\r\n          \"type\" : \"distribution\",\r\n          \"url\" : \"https:\/\/repository.apache.org\/service\/local\/staging\/deploy\/maven2\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/commons-logging\/commons-logging@1.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"The Apache Software Foundation\",\r\n      \"group\" : \"org.apache.logging.log4j\",\r\n      \"name\" : \"log4j-core\",\r\n      \"version\" : \"2.17.2\",\r\n      \"description\" : \"The Apache Log4j Implementation\",\r\n      \"scope\" : \"optional\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"b35d06ffd3ea52e5ba9efe455108745c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"fa43ba4467f5300b16d1e0742934149bfc5ac564\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"5adb34ff4197cd16a8d24f63035856a933cb59562a6888dde86e9450fcfef646\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"c2fc60a1e8c866c09f4787d1edb1bd87a5a5fe114c477d065a3c43f4e513f055d61560b597f06ef6d95c09763b6adb3be17812c8611c00df6f4959311bc9599d\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"a8e03c55833df8f96d7066645440281ba212040af247733db6f4debcb38b7fe8e1e9ac79eb9b67105670e82136125e7c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"f59e8609518ae9be81b30a480bf72a93cbf2b5e25e1465a0124945817a0a98969205147289177631a2a38783d3815af4\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"ce14c5b6c9c5285db2089e70bd78ade549b6b3109b897aad868a4a2e642489b7\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"51f5519f25b534e1d9eb43b9e53d56e93c373b0dd64fa9d80a187e1ede7b5c32823d6fa5a034ec37f2a8c19d8af4dba0827912e7546824320a98af5348e6e83f\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"Apache-2.0\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.apache.logging.log4j\/log4j-core@2.17.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/ci-builds.apache.org\/job\/Logging\/job\/log4j\/\"\r\n        },\r\n        {\r\n          \"type\" : \"distribution\",\r\n          \"url\" : \"https:\/\/logging.apache.org\/log4j\/2.x\/download.html\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/issues.apache.org\/jira\/browse\/LOG4J2\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/lists.apache.org\/list.html?log4j-user@logging.apache.org\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/gitbox.apache.org\/repos\/asf?p=logging-log4j2.git\"\r\n        },\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/www.apache.org\/\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.apache.logging.log4j\/log4j-core@2.17.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"The Apache Software Foundation\",\r\n      \"group\" : \"org.apache.logging.log4j\",\r\n      \"name\" : \"log4j-api\",\r\n      \"version\" : \"2.17.2\",\r\n      \"description\" : \"The Apache Log4j API\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"0c39d90e7819c92c111e447bdf786a90\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"f42d6afa111b4dec5d2aea0fe2197240749a4ea6\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"09351b5a03828f369cdcff76f4ed39e6a6fc20f24f046935d0b28ef5152f8ce4\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"8f986171ee6ca94ba8eacfc83b5b45bb87221c176076eb152715fcb4e1f351c4e9f88d56420fc02ee166ebe0b896fb52eda21355dec49302ab3e83a56b245d04\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"e4ba0afbfd91ef295e6c1c1edfa7854e216a29705b5c4b520f803697ae6badf3630c5d55e56394954988fa88e62176b4\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"ef8ecf2f848bcb18790d79b1d4e0fac0582e94f226eb8c7039d7316bd9f4c472556a4052b4a93958eb1248c7a3756433\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"bdcccb79127c28c0f42374eeac65891e7c0d02f18e1469c705e946f74cfc89db\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"14a4d4f38dc5392f378e006994780d686095e1190d476fd18efcd4211bd4dcd64b699d79c5f4351c51f2d26a3ab98b4a49745df6dbd404e3bc981797a5b8c075\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"Apache-2.0\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.apache.logging.log4j\/log4j-api@2.17.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/ci-builds.apache.org\/job\/Logging\/job\/log4j\/\"\r\n        },\r\n        {\r\n          \"type\" : \"distribution\",\r\n          \"url\" : \"https:\/\/logging.apache.org\/log4j\/2.x\/download.html\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/issues.apache.org\/jira\/browse\/LOG4J2\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/lists.apache.org\/list.html?log4j-user@logging.apache.org\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/gitbox.apache.org\/repos\/asf?p=logging-log4j2.git\"\r\n        },\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/www.apache.org\/\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.apache.logging.log4j\/log4j-api@2.17.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"QOS.ch\",\r\n      \"group\" : \"org.slf4j\",\r\n      \"name\" : \"slf4j-simple\",\r\n      \"version\" : \"2.0.0-alpha5\",\r\n      \"description\" : \"SLF4J Simple binding\",\r\n      \"scope\" : \"optional\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"38adc719300aa7c7c014e1080491d39a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"5a3906d6c39e2bc4e38782228b13f8da5eef7fb2\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"d56dacb6baccb6695061fbc5fb5761f09b84e0760d20a4873a634bf2a51c5242\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"907320c05ff54fe02c71cc041ba70a9f2d2483a3f1618b76a99dd9d03388fb98de31cc492156f719e048f03510e06a95697051e231bd7ebd04a0a7d925376b90\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"de90c6f560e1cb157ee156bd4dca17af1f2e8a326f0151727501ec654c2d77486ff8391c5b6e4f8861b91dfd8844650e\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"da0c34404aa65affcda1e71f386c8d337ab49374b761dda1c362a548f7633bd78b901fe742972bb9e8284b0a836753c9\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"a443f45ae729c6b7442a0e70b91cc5225d0db160f0e55915d8851a295daef09c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"1e0a9f01265caec83cd6d43df9613dd3e83211e0fc2ed2993000ac93ae7336db410cc09bb2d4a34489021abf67857615489a5d9fdf5350e7a6647fad8ea9a50a\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"MIT\",\r\n            \"url\" : \"https:\/\/opensource.org\/licenses\/MIT\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.slf4j\/slf4j-simple@2.0.0-alpha5?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"http:\/\/www.qos.ch\"\r\n        },\r\n        {\r\n          \"type\" : \"distribution\",\r\n          \"url\" : \"https:\/\/oss.sonatype.org\/service\/local\/staging\/deploy\/maven2\/\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/github.com\/qos-ch\/slf4j\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.slf4j\/slf4j-simple@2.0.0-alpha5?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"QOS.ch\",\r\n      \"group\" : \"org.slf4j\",\r\n      \"name\" : \"slf4j-api\",\r\n      \"version\" : \"2.0.0-alpha5\",\r\n      \"description\" : \"The slf4j API\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"17f3fb533a070f0e3e61a1609b7da32a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"241721b0e0ef3cd6cf584b8f0e24d24ea80799ea\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"299f935195950ec5441aaa332c7fccb758fbca59163c93c1b1627b5985f4fedb\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"7a0a06175efccc3119d8e6e073dd5580cc32ab46875217680090231e53bfa3a9f7d963c44f7a8e5aeed1e8168ba11fdcba66aafa3123c95062aaf5f7e68e03ec\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"409d08229fa689500d4194c27d3c62353ae8ceaef841da5b91cf9f627a8e8bf69d4edd8495b4b582f6e73f6e2a68c166\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"82e6f8ea53aef20ed9d1bf5da33c9598d3d8533779737502b60d70f0a1e281f3878361d8a3cfbd13541140b0f66121a5\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"4a54303e58fb8c0155365a07bd66ad66e91875d578186229c928f423f014f714\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"44ab6763cb1d7ef3d54a57d858acfaae220150faf782cfe064e31979122fada826f05fc2f51d2af63f9dbc30eb2a784cc2b1b8c8a022b2720c84b676cf45ed5b\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"MIT\",\r\n            \"url\" : \"https:\/\/opensource.org\/licenses\/MIT\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.slf4j\/slf4j-api@2.0.0-alpha5?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"http:\/\/www.qos.ch\"\r\n        },\r\n        {\r\n          \"type\" : \"distribution\",\r\n          \"url\" : \"https:\/\/oss.sonatype.org\/service\/local\/staging\/deploy\/maven2\/\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/github.com\/qos-ch\/slf4j\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.slf4j\/slf4j-api@2.0.0-alpha5?type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"org.mnode.ical4j\",\r\n      \"name\" : \"ical4j\",\r\n      \"version\" : \"3.0.4\",\r\n      \"description\" : \"A Java library for reading and writing iCalendar (*.ics) files\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"a88534595acac0de514a0517df0e098e\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"822c90df39a712b8d5aac4052a39871094b66f70\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"9b05caa3cd03d5dd828b21fc00c41eb98dddc317d4d6a1818a1c795d8d09c48a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"3ebe70ac67a3acc2f613e4585daa1696117af633898186bdb242821734b43bda26922a2135d783e950eaf23f254cb356d757575255afec2fc491b5bed640ffe3\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"c2effb780212f1c265679058b36883d233eadfec090a470be21bd7c63de13538ccbe4341fe3ede35487661f410ec7a97\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"538b13a205dcf73d58cd22d65c0aa1691d4265f97f0f3189b39930e5b1d9d257297968bd5ee383d183a2e679dad3c3a7\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"bdfd8ffeb4ec8a0b1f8e3e7c52bebadeb6c4967ce2b53cd748fd8c6035afe755\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"88238d8488971a0b22e90472fe22a285a7a07cedaf9b1274e2711a7ac0074fcc7e02f60108be36aeaebdf71ec7e1f365df95004d17c4f38d9e28e238eb6030e3\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"iCal4j - License\",\r\n            \"url\" : \"https:\/\/raw.githubusercontent.com\/ical4j\/ical4j\/master\/LICENSE\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.mnode.ical4j\/ical4j@3.0.4?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/github.com\/ical4j\/ical4j\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.mnode.ical4j\/ical4j@3.0.4?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"The Apache Software Foundation\",\r\n      \"group\" : \"org.apache.commons\",\r\n      \"name\" : \"commons-lang3\",\r\n      \"version\" : \"3.6\",\r\n      \"description\" : \"Apache Commons Lang, a package of Java utility classes for the classes that are in java.lang's hierarchy, or are considered to be so standard as to justify existence in java.lang.\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"5d18f68b5122fd398c118df53ab4cf55\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"9d28a6b23650e8a7e9063c04588ace6cf7012c17\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"89c27f03fff18d0b06e7afd7ef25e209766df95b6c1269d6c3ebbdea48d5f284\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"88501994a338221464b2e87c83dd12b6572daf882cb760419edd66ca2805dbb09d96693c21144b00026e68919436af87534f719896bcd5e3f9a66cef12736675\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"d4420dc812feb3ee261b144a29ad9cdd08c03840530134b3f5149a561c0cd8ead3838a66c5f6d5aacb8573188293193f\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"d2254530c9f37c904a7c6e5484b5f8fe95f06b8ba75066ac0e96ef3fb6efebbdfa521dd65545dc4be56d4d4b324f2a1d\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"ac16eab0dbd28ff2f1a26454be50492bb5681dc540399fda389c662ab0652d01\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"713971e9ac9eab4163834e200c02ffd0fb69dbe29dca9374c3a7c19e4783476229dbec17e10d88a1273aeab0309cadd036e2ea6394498d3158b4e1ab99db031d\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"Apache-2.0\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.apache.commons\/commons-lang3@3.6?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"http:\/\/issues.apache.org\/jira\/browse\/LANG\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git-wip-us.apache.org\/repos\/asf?p=commons-lang.git\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/builds.apache.org\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"http:\/\/mail-archives.apache.org\/mod_mbox\/commons-user\/\"\r\n        },\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/www.apache.org\/\"\r\n        },\r\n        {\r\n          \"type\" : \"distribution\",\r\n          \"url\" : \"https:\/\/repository.apache.org\/service\/local\/staging\/deploy\/maven2\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.apache.commons\/commons-lang3@3.6?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"The Apache Software Foundation\",\r\n      \"group\" : \"org.apache.commons\",\r\n      \"name\" : \"commons-collections4\",\r\n      \"version\" : \"4.1\",\r\n      \"description\" : \"The Apache Commons Collections package contains types that extend and augment the Java Collections Framework.\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"45af6a8e5b51d5945de6c7411e290bd1\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"a4cf4688fe1c7e3a63aa636cc96d013af537768e\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"b1fe8b5968b57d8465425357ed2d9dc695504518bed2df5b565c4b8e68c1c8a5\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"1553751f9126b24f8c893b169df881052483ccf1586efeed4215b6ef013e115e001b96a09d348055df6d1be338a0fa1b14b28fedca3f1663273931a7d17e1363\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"76724283c14e799f161e999cfe24a2444764a83027c2fc43099153c6586d704682eca31b045c3adcfd9440fa073af4da\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"54c6fd77fd95fe1859438d5e550ae5f82f13b8ea4e789a4c9c1d0de943b6a16c142bf1f422dec9e075d3e5f9d052b27e\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"874dea7fc249c98eafa0bed0801583cd84393b7ef4d1fcb3d0451a8d83335fc5\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"a72d4f6987f253753e2f6b5e1367493e4261d935e5e84c9f487f48beaf05702dc0fd90050e830a9edcc56b3a075beb26a72741360eb7691208b73e3d771b675e\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"Apache-2.0\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.apache.commons\/commons-collections4@4.1?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"http:\/\/issues.apache.org\/jira\/browse\/COLLECTIONS\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"http:\/\/svn.apache.org\/viewvc\/commons\/proper\/collections\/trunk\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/continuum-ci.apache.org\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"http:\/\/mail-archives.apache.org\/mod_mbox\/commons-user\/\"\r\n        },\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"http:\/\/www.apache.org\/\"\r\n        },\r\n        {\r\n          \"type\" : \"distribution\",\r\n          \"url\" : \"https:\/\/repository.apache.org\/service\/local\/staging\/deploy\/maven2\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.apache.commons\/commons-collections4@4.1?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"The Apache Software Foundation\",\r\n      \"group\" : \"commons-cli\",\r\n      \"name\" : \"commons-cli\",\r\n      \"version\" : \"1.2\",\r\n      \"description\" : \"Commons CLI provides a simple API for presenting, processing and validating a command line interface.\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"bfdcae1ff93f0c07d733f03bdce28c9e\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"2bf96b7aa8b611c177d329452af1dc933e14501c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"e7cd8951956d349b568b7ccfd4f5b2529a8c113e67c32b028f52ffda371259d9\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"0b8f4610d3a05a589026b1af605cf976f73e6fecb9b9cce9f572e5883ce0a78e8a9cfe48e06257bb68cb8eea080ffe84a2b0b73682036f85dbbb3c03cfdedfaa\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"3e39c2926a3d022280dc6a706f0be11d073541500b641dfe485c7b054469a8a01902cbc8692e38ff976bc69fd974174f\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"c22f48ca48d04a717549df9b083aba508af9bc87439a33edbfb05e9a3d458eb6b3ec5f0014242547ccb24eb59f2d7b8f\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"006a8f27b555487fc21e99848344dfa671be826310aef75138cbb0e9be773b6b\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"841bd6703e4fe9792736de93a5ea54821af0dc4f297ff96b3116067895650e3fb3721159dc6b7d34214e376b4d1f936414b21747562f2462b818c576cf0e73a6\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"Apache-2.0\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/commons-cli\/commons-cli@1.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"http:\/\/issues.apache.org\/jira\/browse\/CLI\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"http:\/\/svn.apache.org\/viewvc\/commons\/proper\/cli\/branches\/cli-1.x\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"http:\/\/vmbuild.apache.org\/continuum\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"http:\/\/mail-archives.apache.org\/mod_mbox\/commons-user\/\"\r\n        },\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"http:\/\/www.apache.org\/\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/commons-cli\/commons-cli@1.2?type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"itext7-core\",\r\n      \"version\" : \"7.2.2\",\r\n      \"scope\" : \"optional\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"7de7c332191daab572adf25c3e5687ac\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"ad7868eed753503a76eca2d55b45a36d43c661b2\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"f4d9cd4684b13ad9dcbbde9d74bf55ab9824f9f6d813619e2f2e23d5e1b30e9a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"18df5cd3939a257ba62011362120cb09250e7ae8da1ef0254f0b687d0bc88c2fad704eb5df2766b753ff5d78aa76ffc8d82d10aac6b2f446b8a655acfabde158\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"0265e332e9f500d1a263892d4a204a0625927b225bd8c3288f1fd4e69b4f89186a308a2ffc37f5c35cef0278aeaa6f8c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"62f265afd53af96cb4d4ee7a309ca3a4b2565b1eef31f5c8f80570a6c5ba1c4239b4d09a7c99eae41b955fdd399a6f40\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"8f3047857fb4e3ec39b717812e495280a3d67e39e22577780736161e045f902e\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"2a0cb33acd46c4b46278c3faaeb5d7c59043dea8765b2f02a550e69063b2acc502f7c0b121c59e343f59b0904fefca11c54c838a6af8895d9989d144c62af7b0\"\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/itext7-core@7.2.2?type=pom\",\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/itext7-core@7.2.2?type=pom\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"barcodes\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"A Free Java-PDF library\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"3dd4d9d277d89aef0d6591dc609d6a81\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"c49ffbabe3d34100a2c981c3e5080d900963e63c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"728ee1e1ce6cb81cc0b85abd6c2f4c427ec177e4d85639bd07858fe004333899\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"af69a28a68dbc4f98de7f3872c027cf482f80d43be5581b1dbe925feed2796ba558cef6126449a5a709b6adae7d9b5d033c8ee28dcb214de6f04e38c8d7944c7\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"9460560ffc023623b75d27cf3ec42782391b425933e4528eedcc0ea21492640b01a57bde63a0271a9b43c89f22edb7b5\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"6cd97670052ed94e03518239ef8eb31670bf9d72db5ebeb496d6e443c5f4f4b66b193a29ce04b924815895d809e04961\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"fcd8ef982685c3223e6ebb3bea63da6ec321d2564a46db56506530ab75c179ee\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"361ef5b657eccda591d0853388eed6ba23ef4c6e9ce82fc2e946b3d5e73fb314b9a7af3980dc8fe2e81aa08d8199776c8733af332f1e5b67997028fca9cc33dd\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"GNU Affero General Public License v3\",\r\n            \"url\" : \"http:\/\/www.fsf.org\/licensing\/licenses\/agpl-3.0.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/barcodes@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/barcodes@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"font-asian\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"iText Asian fonts for use in conjunction with iText 7, a free Java-PDF library\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"636ba26afdd74d4085fe3907577c4cdc\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"5c1c77a8399bd675585d5448ca806afb320bb03f\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"cfa8ba8283e3607e8465cc6fe28229282330bc20adab337d5fd3bc6a5d1db094\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"298ffceeed227524a46fe515f0878cf952b5e3bb44dd36ec34aad5dc2516e86bb46fc59bba79a157388ed94ddb7f74c460650c2b6f282d7b3d9b0a3c8281e931\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"9b25b0d83320bd7da5cd04fa3eb7fabb367e082b224730a93fc9af2a35a91e8bcbefc902669ff41af40906948743c298\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"7db64cc0c5adfb1dc2f5c45b33fbb9a76cf1a7053246aa889cd3b554b586e8fcd7690cead58e01ed582902f40bfbd6f8\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"a9734684907ce6a06347a4c864eda2149162a738014f465b43d895dc363ec066\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"e3ac0c4e2b5bc38b133131a6091db4e480145e82cc21cbba13f447eca85494ad8f27541f2189eb7ab8aaeb5d8162b31ec2e1d0b5edc2b95bcd24a46f0916d0fe\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"Various licenses (see individual files)\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/font-asian@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/font-asian@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"forms\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"A Free Java-PDF library\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"8ec6b0f615c5e443620364b32ad58877\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"50864f947e2dcc85649056fd580c79a664655f33\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"48552f05fd64be580aa6d04ad51edb878b1f36a30c13f53a1ddf8d8b709cf893\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"a0613549afeb9b45c17c2c9d6df5f4f69ff078c46648daa881c8d80a83bec27a30fccca143ed9ff466bd05e9472e620485c4e08117ca47e68fb5d00395f11e31\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"a252e4e79f2d0ceb1dcc82fc71b9ff0bb54956a53eaeabe21a13032346b6fa940c67deaed2e16efdcc68fe29c276f292\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"b94316833bc3d6918cb1682c81834d752b2ad6cb0fb0949464fe35caf240a47b7b76dca8e12595011d9486c86b40cd95\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"67443a4a864458f2fb63dfaec0864b1c8f7cea87b996ebb4563e7d0de97b595b\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"fbbd26a08a468a05aa92f3a4e5c8ed55781fcafc94b3cad9a0c9437983cb958d48b3e79addb0147ce3f8cac5ba520ed09da4bf2dc132809acc813148e6055141\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"GNU Affero General Public License v3\",\r\n            \"url\" : \"http:\/\/www.fsf.org\/licensing\/licenses\/agpl-3.0.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/forms@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/forms@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"hyph\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"XML files that can be used for hyphenation\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"91445e6a91ac58b464cae5ce52cca4fb\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"5865942ed26bb3c48cff58e4331628dfa94bcf5a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"a4f48d140aad8a0197cfc11d7efa3edc2a5ec34984160d88a40f44a046a53636\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"d51438d4861db96377d094bcbd92760fb4ce13e6f6cd66152913cdc48e6b5d6a8192a5bf80a71857c711234a3092f8bf0dffc7f8d77063ba1ff2cdcb77d207ae\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"bdc3a842cb5a0aaaf10f9db83073d71cd93ada9741d4b229bfe2bb78e4fe5e504881486950a72aa752f43ecf76fa83cb\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"92d0688cae51396468625d998306d027edc2781f4aed63e28371f82d43333fd4e02a7618e4aa96a41d5bd00e8cca7c4e\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"75fc4c3f086ce7b2539812bed4be6e9f6dae44cda6a802f76aaf594f91d6aa85\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"38085decc5497c38ea9fb3c2164cf8175a98736795d40bf12e1becb03b189710c9254d42be603af00b9f1ef540fde9c8eb9a77344cbfbe8b47a17e9d26a109e5\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"Various licenses (see individual files)\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/hyph@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/hyph@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"pdfa\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"A Free Java-PDF library\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"0167db66d5cf9695ccf50a1e5559b5c1\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"afff915b19274a35838a53b2867f9fbd7d73bcd0\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"ebc185f88630fa6fec22a2a8e6c97db506bf8fc28c6fe357db0d39c87583cd65\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"4ebcb3bb32cb325e73be8c4679a6818dc87329aa632f3a50dafa933ef5cbbd10c00659d5b8aff0fc63aaea157bda741c2bc57f1135d058ba6e473254d56eb55a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"7d9d0f91a5cb3a016164aea07f9af5aac37b5ea8d2c3928f0fae27b8490ee0f0ca79bb8c91ddc40e92077edecbfb78f0\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"e53676e87cbcdec878fda6f147118f494cf21f4d20f967bf1b3d5e0ff6e71733629d967959e63cd37912f554729aab21\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"df0ad54e27bd8d0a76e3e40541f533a131aa2b92061cc78202360866e562e719\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"5ff48b54941ecc6a82b32085e2b4fb6704a20a534abddad1b42773593bf76a1a5e6023aae27e7d79f80ecb15ee61ac7d6b6f17be53a63e1d5ac33e3d22e887cd\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"GNU Affero General Public License v3\",\r\n            \"url\" : \"http:\/\/www.fsf.org\/licensing\/licenses\/agpl-3.0.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/pdfa@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/pdfa@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"sign\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"A Free Java-PDF library\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"4114079a195bc56392e5b977b7f94816\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"dfe222045ae956b7e9ef0882c68158861937e1bd\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"6b923bde58208e66ddc02edddc03f29c9e8350d03703fd332f87d51ebb3e7433\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"094286e9d5ebd3acdc80231581066b1d698c4610d78c823b81dd66940f73383313ce2dcdc9444630cdc0eff5a505d01737cd3c5eb810f40e3613c965062f1878\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"48f4f75903f2b13776ea6881996f25c05ce80a7470c9bc4508540075f39d71bec7281ace3aa744f0b72606aeced96e85\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"a64b804f754e92bb176b7095df97cee03303586191099f4462a6d721f189f56f03de5a520f4aa9dba90d974768e96939\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"0e27d5e7580be0a2d831d621d7603f5215537d48fda39186d1c745c2083b8c44\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"6b6d0e9b3f4af2aa4642237bf00c534cf96f6a5fef171b1dc1023ee4af85ad6614f639948ae2824b423d4dfae66169236edf3dad1ec13727eacff24568446828\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"GNU Affero General Public License v3\",\r\n            \"url\" : \"http:\/\/www.fsf.org\/licensing\/licenses\/agpl-3.0.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/sign@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/sign@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"styled-xml-parser\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"Styled XML parser is used by iText7 modules to parse HTML and XML\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"0fc03234c107454322edf6e53dc9fd6c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"1ae9a60eda61adb5748c90771b883271dd8f952b\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"04649d5cfc8690dee4cf3ec5a45c73a0ecee296a98f4be0a790db19c91e23960\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"b982732639856cd620a77b613d77524391c3c4b454adc64a1eed37ea611f12d0a754f53fdd291fdfec9c193a80e8710ed8fbbb618098775a55a4375e39810f46\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"22c37848050f23a02153b512db920c3e1730fd5c977e5545d66a231fcc4bddab9fd1687573c7f6e51b950cb04e8cad4b\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"dee1c42f307cbce9127c0b6ab204a415a3bde8019eb141692a02d70fb10efb8b8605a662f67f1c74e071f87ff29e12b6\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"33d6685fe5ee2624d673f8eb2afffa6796c6f059db5b5d90623f1b8ff437bcaf\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"1d6f3cdfe589e1d0f80359ebefe250e0f13abafa0976e4a52338267c945ebb806c3efe4c351199841a02ed0c45ebabbed560892c6cf13bdd4897843aadb694d7\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"GNU Affero General Public License v3\",\r\n            \"url\" : \"http:\/\/www.fsf.org\/licensing\/licenses\/agpl-3.0.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/styled-xml-parser@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/styled-xml-parser@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"svg\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"svg is a module for iText7 that allows you to integrate SVG images in your PDF creation and manipulation process\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"82fe6b897ce033f1a09778e65d261db0\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"4bc5ae6dd793e937f7056c0007d1d749dab4c67a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"8bd2d146f7efc8c6ff9509749ceb6504c5664489a4e84c05852fac1cbd476d54\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"802e0eb578571f79c742d126ff17945edb7501834a60a523901ff95bc695ece24ec57d7fc74cd1553f29c48de40c239d114419dcf28d755acb0f908caa4dcd3f\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"c58bf0d8d42f295a33d1b743af7830135d1fc0f3c4aab6b57dc8b9646dd67af349085e2ed00b9368a26a75f68bcf432e\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"b01086a0fc165e397dc27704748c72e8446f8f8c5e8592f90e9187f4d69be6ab708c8e0ee7ba5dd4e3f2e9adcbfdb1f5\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"9994dce6d0bab71e18655dbacbbbce00a1d5610b5d87f4d42594e816e27ac875\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"304d47d0927b4fd0be2932cf17d61b7664187e3ec4e08e7dc6f5b10c2a490f301df5a18583ba2a9a8eb02a4f237eee9cab89ada8bc4ad61e73d1e22e4fae699c\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"GNU Affero General Public License v3\",\r\n            \"url\" : \"http:\/\/www.fsf.org\/licensing\/licenses\/agpl-3.0.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/svg@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/svg@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"layout\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"A Free Java-PDF library\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"1515a9584648f8eb35111c3d5c14e302\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"c25f01cdf16bd8ddc1da5c2e042aaa033d780a00\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"3ede1d839b0236ff607e51e4e77d2316c86aa6600e4bee84b22d5e699d875874\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"da0f6f6331a7cc3adfb4f5a55c29446ba2788ac1b46607a12e70279a00cc09a8643c4bcc85d824a756cb80ab59ac38103cd7b8299db6eeec2eebce0d17ab2704\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"b90d9b3f1bbcb0544f6e2fd38c87f63aaa7e5dffd9e653c1afb207cf9999174dfffa079a75883be4f9427cfb0fa06a98\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"f839912347c963430cff9290a4739cec600a76adbe5bb147ecad9e134e1f388dd00949cce603097fecd98afd7d8a65e7\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"ce8b98f1900cef1b296e44be5850c7f7783694fe64c2a58c98b2e7daa033c92e\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"e7179bd12bb156f33d8cf8080f98df7148390ebd1c02a297a1d67b262a1b7397d23be54f427a1beff115adaba4f6d11aeca0b2f868bbc5a042e57d05acde8532\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"GNU Affero General Public License v3\",\r\n            \"url\" : \"http:\/\/www.fsf.org\/licensing\/licenses\/agpl-3.0.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/layout@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/layout@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"kernel\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"A Free Java-PDF library\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"9808df2241f1c061f10bc06abe5563ca\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"39b29155bde729295254f0b7cc828810ba348c6a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"d8b0b5f2227fcbf35f501031777e53484d7b2ffeb30dff92894a62fe12800a27\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"dc55e98a565d54bcd3c9e8dc6cce0ce5d58d86bb1185d7c726a9435dd931cfc43d2fe20caabd054eb2dafd016f77b8846c70cbdafd8cef569250206d75de6086\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"59b9d04b037fb0e16056363efcb1a79966304072cc85d72bc407821e9723aa281f9954479c0f12a9988e1e5e0ab93c28\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"d57d0c875b9084ef427c470a86c6aedb06413be30658197c357c57c0ec204a941ca28aab72536b03eabf30356741279d\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"7d899745d909e892ee5a104acbbd1412fc75117a25760493bb56428de5979130\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"a1d1f078eb03c399bce2d28bf9b1ca499d02151d6d84099fe0698165c999ae22fa798f33ca119af8211bebc02d5787ffd7a3bd3c4f6798c7945934e451570e23\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"GNU Affero General Public License v3\",\r\n            \"url\" : \"http:\/\/www.fsf.org\/licensing\/licenses\/agpl-3.0.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"org.bouncycastle\",\r\n      \"name\" : \"bcpkix-jdk15on\",\r\n      \"version\" : \"1.70\",\r\n      \"description\" : \"The Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. This jar contains APIs for JDK 1.5 and up. The APIs can be used in conjunction with a JCE\/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"2c383f50d41937eae4fd32c35d8668cd\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"f81e5af49571a9d5a109a88f239a73ce87055417\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"e5b9cb821df57f70b0593358e89c0e8d7266515da9d088af6c646f63d433c07c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"477001e9556cdbe7fe9eca0c35b3ce29cd6b4d9cd5e13d1f44e3da6433d56a18e23f3679603a23730d78a93bd401113b804562c8bacb1e745e7944127f7afa4c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"249614fa138e4b405ad067f69ee538269ade5a517d8f47b6d69bfc8180ae48c019570540a47314f3b64060a6bca20682\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"13d1354f83de80b89fa91ffc44a14b0aeee418367ec7dde95aaecd70f6d219e4ed1bbf102e099cdfe64737c06dafc199\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"afc8204fb76d0ec343ba436eaeac7834156ee976a1e0b2bafd0075812451046a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"b55bcc09c9f9c87332160ce068ca349502d628c34b156ebb30a99d94f87606d59ccc62f8ded4a927d57ed9553d274b34a8f9b5602a5eefad66958f9eddbffa28\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"Bouncy Castle Licence\",\r\n            \"url\" : \"https:\/\/www.bouncycastle.org\/licence.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.bouncycastle\/bcpkix-jdk15on@1.70?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/github.com\/bcgit\/bc-java\/issues\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/github.com\/bcgit\/bc-java\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.bouncycastle\/bcpkix-jdk15on@1.70?type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"org.bouncycastle\",\r\n      \"name\" : \"bcutil-jdk15on\",\r\n      \"version\" : \"1.70\",\r\n      \"description\" : \"The Bouncy Castle Java APIs for ASN.1 extension and utility APIs used to support bcpkix and bctls. This jar contains APIs for JDK 1.5 and up.\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"805173dfb0891331dbe69d0e53371af4\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"54280e7195a7430d7911ded93fc01e07300b9526\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"52dc5551b0257666526c5095424567fed7dc7b00d2b1ba7bd52298411112b1d0\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"f65fc2af60be9b4a0cfa227cede3ba5ef994716dcd462a9935ef74535a32e67c56cff92e6af9d5168c7a866e5f7c9fd17797485b89eb020eda12f7018af0fca1\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"46f32ed832f447e519beab6c553ffbab455376bdaed3554bc8c687b876776861afa02bd5ae226cdc0dc3f0c2ae28c9a4\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"749aa3317618bc93fbdf12fb49f4c653f81321b4ee69d7807515f50234bf531539bd6eb5c3ed34955eeb60bdb56967dc\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"2dc5b7a38918f9eed8e3652c0794d8bf3eb674d8b0f24f03c64edc2e2ac251eb\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"0506c3a4cfad6c892568ffefb71b049ef7c943e5ab172ac8756cebcd53a7facee7c1472b18ed2211eb6f820dbfc6bd07da25dee62a5edc61dc6b333d42964fbc\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"Bouncy Castle Licence\",\r\n            \"url\" : \"https:\/\/www.bouncycastle.org\/licence.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.bouncycastle\/bcutil-jdk15on@1.70?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/github.com\/bcgit\/bc-java\/issues\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/github.com\/bcgit\/bc-java\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.bouncycastle\/bcutil-jdk15on@1.70?type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"org.bouncycastle\",\r\n      \"name\" : \"bcprov-jdk15on\",\r\n      \"version\" : \"1.70\",\r\n      \"description\" : \"The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 and up.\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"1809d0449a6374279c01fdd3be26cd92\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"4636a0d01f74acaf28082fb62b317f1080118371\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"8f3c20e3e2d565d26f33e8d4857a37d0d7f8ac39b62a7026496fcab1bdac30d4\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"7dccfc636ee4df1487615818cfa99c69941081df95e8ef1eaf4bca165594dff9547e3774fd70de3418abace77d2c45889f70bcd2e6823f8539f359e68eaf36d1\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"a0b35d204cd962f1d246fa94b6e8b0fcee1a7c3f37b7e87cda742f2124a25b48794ce11a903ea8d12009c86227b6808d\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"980d81d3d9906764bbf2ae9b3b364ea58628b485ce1dc3d06734e10495d79f2be2e7cc7df61ac88cd67c1104c7af9393\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"10a3572e42d29f609721d795116e3e5d0f6f03efef84bb979ce72e26908d242b\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"a0761cb6deeb86c94b96850c72c0a0eaf516ca849f4b8268f9f60c9ed2a6730e692c15098d47e617da294e931113c6cbcaddec8957c9f029fa595b5f14ff35ac\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"Bouncy Castle Licence\",\r\n            \"url\" : \"https:\/\/www.bouncycastle.org\/licence.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/org.bouncycastle\/bcprov-jdk15on@1.70?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/github.com\/bcgit\/bc-java\/issues\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/github.com\/bcgit\/bc-java\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/org.bouncycastle\/bcprov-jdk15on@1.70?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"io\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"A Free Java-PDF library\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"af0d5d79e49c556f4144183d35bcf9ac\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"ab280225933bd4724114509acfca08cb0215d19a\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"412b7f1628b5388951de125318579b241418a17c1b4ad612d0144c020a5c509b\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"5e3df3dd84274b073768f4eb0d125624764183f51bc34dfae6f12b196f431170d0896996d6ada29da148749747281303699a70bc936d2222dc967ef37377bc45\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"fbda6e3452bd37d7d9646ef5b5d09536ff4b9ed6dd5b27084fb37cde8a1c32626c5dbcb8be25bd34185277b8f2074dd0\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"17542c1c2d0314599b5e74055cdb68ba802f1f8bd86fbda2fbf2124e55492b43c82f37781ebb7dc59a5828f69ced7a31\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"d76b0b85e5b0a30030e2e66549730a8332482f82c72ff0d04c3288eb740088d2\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"5473f1d95908d569f876e670b49bb5d979c0fb9a61f1f503f60d65ba4d8f4e34820e5703934d25eb16a6d83ad27ca06059a335cfb4dea81aa03209a0b3c31d2e\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"GNU Affero General Public License v3\",\r\n            \"url\" : \"http:\/\/www.fsf.org\/licensing\/licenses\/agpl-3.0.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/io@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/io@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"publisher\" : \"iText Group NV\",\r\n      \"group\" : \"com.itextpdf\",\r\n      \"name\" : \"commons\",\r\n      \"version\" : \"7.2.2\",\r\n      \"description\" : \"A Free Java-PDF library\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"ab9952d9cb8a35270fc46c8d3327f360\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"b6f6c03afe61ca09fce222b5e2bbe4613e9a0fd4\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"4982d939d0aefcdffd2f593500e7d6e9e3a5faf432cb4869951fca3809cea7ac\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"07f37faed9a9865729ceb6f7543b64ee91100717fd4a9a396adc3194a221670a0a56929f4394d066211906da910d8197f95b62496e110ede2fe84010b594e53f\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"3c72ee93d50eefe2f7b98c976ae6ec45c9017b60ae6511e990487ce7699773858aab2713bc3461368281bb853d2195d2\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"93d29a8a7dffed4a406eda15e2b97717225ea265d50877309b6822b005faf94cba53351d96b6a252374cdda355feea8c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"8d60b5bcef56636b95c2f87ba9998958425e2ab614d8d8184cfa25ab441fd5aa\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"345515ddbf1f36f3cccb10957c524d529cdf5e5bd566bd1020ebc65579cc6b7869a6f9efecd663f2e02a0d239cc4b8ca64e40252be681451ca763b5c168f9fdc\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"name\" : \"GNU Affero General Public License v3\",\r\n            \"url\" : \"http:\/\/www.fsf.org\/licensing\/licenses\/agpl-3.0.html\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/com.itextpdf\/commons@7.2.2?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"website\",\r\n          \"url\" : \"https:\/\/itextpdf.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"build-system\",\r\n          \"url\" : \"https:\/\/jenkins.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"issue-tracker\",\r\n          \"url\" : \"https:\/\/jira.itextsupport.com\/\"\r\n        },\r\n        {\r\n          \"type\" : \"mailing-list\",\r\n          \"url\" : \"https:\/\/stackoverflow.com\/questions\/tagged\/itext7\"\r\n        },\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/git.itextsupport.com\/projects\/I7J\/repos\/itextcore\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/com.itextpdf\/commons@7.2.2?type=jar\"\r\n    },\r\n    {\r\n      \"group\" : \"info.picocli\",\r\n      \"name\" : \"picocli\",\r\n      \"version\" : \"4.6.1\",\r\n      \"description\" : \"Java command line parser with both an annotations API and a programmatic API. Usage help with ANSI styles and colors. Autocomplete. Nested subcommands. Easily included as source to avoid adding a dependency.\",\r\n      \"scope\" : \"required\",\r\n      \"hashes\" : [\r\n        {\r\n          \"alg\" : \"MD5\",\r\n          \"content\" : \"f09461a45f8d0591e6625bc4ecba5ced\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-1\",\r\n          \"content\" : \"49a67ee4b4d9722fa60f3f9ffaffa72861c32966\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-256\",\r\n          \"content\" : \"2a6e03310db149f8a11eb058aa78e775c229ef816333c9687379762d22833ad6\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-512\",\r\n          \"content\" : \"96ac6f7246444370b6d8d394f904ad818363759819275a14b8fc5d26398ad8db8984092c2d3de7ad91325a158bd7d74a6665a1fd4183afa6a872abbfcdbc9177\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA-384\",\r\n          \"content\" : \"39b9a9defc500ab665f3779a1d93f3fb565910fe545f1a10fc4955c512d7585bb11667c0f9f7b7ef52642f771f868454\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-384\",\r\n          \"content\" : \"6b3aa01915963c4df64de644fb80099f89b0ee1f1ee7e6e66f9b96bc24c58c58833dc722d57c616b2698c477d1e51d6c\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-256\",\r\n          \"content\" : \"49f9d4983ba32a94a5b8ecf55ada85e3cacdbfb333c2c97c143f6306f2e39e44\"\r\n        },\r\n        {\r\n          \"alg\" : \"SHA3-512\",\r\n          \"content\" : \"7c4ed578d560ee7e31881397b9be492db3ebdb8fd17b05adc4860daabf06540cc40da7006129a8f91156c87d3d599b6ec417a60d9610e677d0c2a31d77e01a36\"\r\n        }\r\n      ],\r\n      \"licenses\" : [\r\n        {\r\n          \"license\" : {\r\n            \"id\" : \"Apache-2.0\"\r\n          }\r\n        }\r\n      ],\r\n      \"purl\" : \"pkg:maven\/info.picocli\/picocli@4.6.1?type=jar\",\r\n      \"externalReferences\" : [\r\n        {\r\n          \"type\" : \"vcs\",\r\n          \"url\" : \"https:\/\/github.com\/remkop\/picocli\/tree\/master\"\r\n        }\r\n      ],\r\n      \"type\" : \"library\",\r\n      \"bom-ref\" : \"pkg:maven\/info.picocli\/picocli@4.6.1?type=jar\"\r\n    }\r\n  ],\r\n  \"dependencies\" : [\r\n    {\r\n      \"ref\" : \"pkg:maven\/de.wenzlaff.twbibel\/de.wenzlaff.twbibel@0.1.1?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.openjfx\/javafx-graphics@17.0.1?classifier=mac&type=jar\",\r\n        \"pkg:maven\/org.openjfx\/javafx-fxml@16-ea%2B5?classifier=mac&type=jar\",\r\n        \"pkg:maven\/org.openjfx\/javafx-controls@17.0.1?classifier=mac&type=jar\",\r\n        \"pkg:maven\/org.openjfx\/javafx-base@17.0.1?classifier=mac&type=jar\",\r\n        \"pkg:maven\/org.apache.httpcomponents\/httpclient@4.5.13?type=jar\",\r\n        \"pkg:maven\/org.apache.logging.log4j\/log4j-core@2.17.2?type=jar\",\r\n        \"pkg:maven\/org.apache.logging.log4j\/log4j-api@2.17.2?type=jar\",\r\n        \"pkg:maven\/org.slf4j\/slf4j-simple@2.0.0-alpha5?type=jar\",\r\n        \"pkg:maven\/org.mnode.ical4j\/ical4j@3.0.4?type=jar\",\r\n        \"pkg:maven\/commons-cli\/commons-cli@1.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/itext7-core@7.2.2?type=pom\",\r\n        \"pkg:maven\/com.itextpdf\/layout@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/io@7.2.2?type=jar\",\r\n        \"pkg:maven\/info.picocli\/picocli@4.6.1?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.openjfx\/javafx-graphics@17.0.1?classifier=mac&type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.openjfx\/javafx-base@17.0.1?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.openjfx\/javafx-base@17.0.1?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.openjfx\/javafx-base@17.0.1?classifier=mac&type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.openjfx\/javafx-base@17.0.1?classifier=mac&type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.openjfx\/javafx-fxml@16-ea%2B5?classifier=mac&type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.openjfx\/javafx-controls@16-ea%2B5?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.openjfx\/javafx-controls@16-ea%2B5?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.openjfx\/javafx-controls@17.0.1?classifier=mac&type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.openjfx\/javafx-graphics@17.0.1?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.openjfx\/javafx-graphics@17.0.1?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.openjfx\/javafx-graphics@17.0.1?classifier=mac&type=jar\",\r\n        \"pkg:maven\/org.openjfx\/javafx-base@17.0.1?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.apache.httpcomponents\/httpclient@4.5.13?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.apache.httpcomponents\/httpcore@4.4.13?type=jar\",\r\n        \"pkg:maven\/commons-logging\/commons-logging@1.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.apache.httpcomponents\/httpcore@4.4.13?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/commons-logging\/commons-logging@1.2?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.apache.logging.log4j\/log4j-core@2.17.2?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.apache.logging.log4j\/log4j-api@2.17.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.apache.logging.log4j\/log4j-api@2.17.2?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.slf4j\/slf4j-simple@2.0.0-alpha5?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.slf4j\/slf4j-api@2.0.0-alpha5?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.slf4j\/slf4j-api@2.0.0-alpha5?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.mnode.ical4j\/ical4j@3.0.4?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.apache.commons\/commons-lang3@3.6?type=jar\",\r\n        \"pkg:maven\/org.apache.commons\/commons-collections4@4.1?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.apache.commons\/commons-lang3@3.6?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.apache.commons\/commons-collections4@4.1?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/commons-cli\/commons-cli@1.2?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/itext7-core@7.2.2?type=pom\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/com.itextpdf\/barcodes@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/font-asian@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/forms@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/hyph@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/io@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/layout@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/pdfa@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/sign@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/styled-xml-parser@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/svg@7.2.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/barcodes@7.2.2?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/com.itextpdf\/io@7.2.2?type=jar\",\r\n        \"pkg:maven\/org.bouncycastle\/bcpkix-jdk15on@1.70?type=jar\",\r\n        \"pkg:maven\/org.bouncycastle\/bcprov-jdk15on@1.70?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/font-asian@7.2.2?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/forms@7.2.2?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/layout@7.2.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/layout@7.2.2?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/hyph@7.2.2?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/io@7.2.2?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/com.itextpdf\/commons@7.2.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/pdfa@7.2.2?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/sign@7.2.2?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/com.itextpdf\/forms@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/layout@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/pdfa@7.2.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/styled-xml-parser@7.2.2?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/com.itextpdf\/io@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/kernel@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/layout@7.2.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/svg@7.2.2?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/com.itextpdf\/layout@7.2.2?type=jar\",\r\n        \"pkg:maven\/com.itextpdf\/styled-xml-parser@7.2.2?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.bouncycastle\/bcpkix-jdk15on@1.70?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.bouncycastle\/bcprov-jdk15on@1.70?type=jar\",\r\n        \"pkg:maven\/org.bouncycastle\/bcutil-jdk15on@1.70?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.bouncycastle\/bcprov-jdk15on@1.70?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/org.bouncycastle\/bcutil-jdk15on@1.70?type=jar\",\r\n      \"dependsOn\" : [\r\n        \"pkg:maven\/org.bouncycastle\/bcprov-jdk15on@1.70?type=jar\"\r\n      ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/com.itextpdf\/commons@7.2.2?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    },\r\n    {\r\n      \"ref\" : \"pkg:maven\/info.picocli\/picocli@4.6.1?type=jar\",\r\n      \"dependsOn\" : [ ]\r\n    }\r\n  ]\r\n}<\/pre>\n
<\/p>\n
Bei jeder Generierung wird auch eine eindeutige Unique Identification Number<\/a> (serialNumber) erzeugt.<\/p>\n
Hier noch die Ausgabe des Maven Goals im Log:<\/p>\n
[INFO] --- cyclonedx-maven-plugin:2.7.1:makeAggregateBom (default) @ de.wenzlaff.twbibel ---\r\n[INFO] CycloneDX: Parameters\r\n[INFO] ------------------------------------------------------------------------\r\n[INFO] schemaVersion          : 1.4\r\n[INFO] includeBomSerialNumber : true\r\n[INFO] includeCompileScope    : true\r\n[INFO] includeProvidedScope   : true\r\n[INFO] includeRuntimeScope    : true\r\n[INFO] includeTestScope       : false\r\n[INFO] includeSystemScope     : true\r\n[INFO] includeLicenseText     : false\r\n[INFO] outputReactorProjects  : true\r\n[INFO] outputFormat           : all\r\n[INFO] outputName             : bom\r\n[INFO] ------------------------------------------------------------------------\r\n[INFO] CycloneDX: Creating BOM\r\n[INFO] CycloneDX: Writing BOM (XML): \/Users\/..\/twbibel\/target\/bom.xml\r\n[INFO] CycloneDX: Validating BOM (XML): \/Users\/..\/twbibel\/target\/bom.xml\r\n[INFO] CycloneDX: Writing BOM (JSON): \/Users\/..\/twbibel\/target\/bom.json\r\n[INFO] CycloneDX: Validating BOM (JSON): \/Users\/..\/twbibel\/target\/bom.json\r\n[WARNING] Unknown keyword additionalItems - you should define your own Meta Schema. If the keyword is irrelevant for validation, just use a NonValidationKeyword\r\n[INFO] ------------------------------------------------------------------------\r\n[INFO] BUILD SUCCESS<\/pre>\n
Fehlt nur noch der Link zum Schema<\/a>.<\/p>\n
Sp\u00e4ter noch die Installation eines dependencytrack<\/a> …<\/p>\n","protected":false},"excerpt":{"rendered":"
SBOM (Software Bill of Materials) ist eine Inventar Liste einer Codebasis (hier im Beispiel Java), einschlie\u00dflich aller identifizierbaren Komponenten samt ihrer Lizenz- und Versionsinformationen sowie Angaben zu eventuell vorhandenen Sicherheitsl\u00fccken. SBOM soll helfen, den Softwarecode samt bekannter Bugs und lizenzrechtlicher Fallstricke in der Codebasis zu inventarisieren, um so Risiken auszumerzen. Diese SBOM Listen im Json … <\/p>\n
\u201eEinfaches generieren von Software Bill of Materials (SBOM) mit Maven CycloneDX Plugin\u201c <\/span>weiterlesen<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_import_markdown_pro_load_document_selector":0,"_import_markdown_pro_submit_text_textarea":"","footnotes":""},"categories":[220,3161,5,3163,79,1319],"tags":[5277,5276,66,2099,293,5275],"class_list":["post-19459","post","type-post","status-publish","format-standard","hentry","category-anleitung","category-build","category-java","category-maven","category-programmierung","category-sicherheit-2","tag-bill-of-materials","tag-bom","tag-maven","tag-mvn","tag-plugin","tag-sbom"],"_links":{"self":[{"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=\/wp\/v2\/posts\/19459","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=19459"}],"version-history":[{"count":0,"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=\/wp\/v2\/posts\/19459\/revisions"}],"wp:attachment":[{"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19459"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19459"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19459"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}