{ "bomFormat" : "CycloneDX", "specVersion" : "1.4", "serialNumber" : "urn:uuid:90c66ec2-33c8-3ddf-af8c-a9d286a4d958", "version" : 1, "metadata" : { "tools" : [ { "vendor" : "OWASP Foundation", "name" : "CycloneDX Maven plugin", "version" : "2.9.1", "hashes" : [ { "alg" : "MD5", "content" : "9c7a565cf28cce58557d0c621c5ea4b1" }, { "alg" : "SHA-1", "content" : "be882d5a22050bfa9d19090b1420c188617d0e1c" }, { "alg" : "SHA-256", "content" : "698e0f37184a5b28c245c4065fd036dfce253b52f82fbb7113d81d36326cc249" }, { "alg" : "SHA-512", "content" : "c0f0b11026858166f872a2eb54719492e5cecaa0bc9cd6b30b3ecb4a174eed220f4a1b5829d18d6734128e778d3cb3db7ffed177c92866133129cb29081814a0" }, { "alg" : "SHA-384", "content" : "d80964707dfe5caca8c70521d5066f57589304c0a657e6fbc7c0614ea0fc7b3b3dbe7778361eee0f54ba111e9cb0ffcb" }, { "alg" : "SHA3-384", "content" : "80bc3a275d9514bc457461ff52a72add8c7ecbbc01d8912efce57139016c544ee776981851be0a58fa977ab4221f703f" }, { "alg" : "SHA3-256", "content" : "142317d6f245390f4fd2d0c100b16281b8dfc5c0c2cff86943bdcc97039cb699" }, { "alg" : "SHA3-512", "content" : "af0fb9137c90b65d1a07f72e4d51ae509956cdb8800f35c961b037cdda1fe4a14ce3b496cef71ba85f1621affcfe29cd42704ae4191ff0b090a9602087c8997b" } ] } ], "component" : { "type" : "library", "bom-ref" : "pkg:maven/org.eclipse.jgit/org.eclipse.jgit.ssh.apache@7.4.0.202509020913-r?type=jar", "publisher" : "Eclipse JGit Project", "group" : "org.eclipse.jgit", "name" : "org.eclipse.jgit.ssh.apache", "version" : "7.4.0.202509020913-r", "description" : "SSH support for JGit based on Apache MINA sshd", "licenses" : [ { "license" : { "id" : "BSD-3-Clause", "url" : "https://opensource.org/licenses/BSD-3-Clause" } } ], "purl" : "pkg:maven/org.eclipse.jgit/org.eclipse.jgit.ssh.apache@7.4.0.202509020913-r?type=jar", "externalReferences" : [ { "type" : "website", "url" : "https://www.eclipse.org/jgit//org.eclipse.jgit.ssh.apache" }, { "type" : "build-system", "url" : "https://ci.eclipse.org/jgit" }, { "type" : "distribution", "url" : "https://repo.eclipse.org/content/repositories/jgit-releases/" }, { "type" : "issue-tracker", "url" : "https://github.com/eclipse-jgit/jgit/issues" }, { "type" : "mailing-list", "url" : "http://dev.eclipse.org/mhonarc/lists/jgit-dev" }, { "type" : "vcs", "url" : "https://eclipse.gerrithub.io/admin/repos/eclipse-jgit/jgit/org.eclipse.jgit.ssh.apache" } ] }, "properties" : [ { "name" : "maven.goal", "value" : "makeBom" }, { "name" : "maven.scopes", "value" : "compile,provided,runtime,system" }, { "name" : "maven.optional.unused", "value" : "true" }, { "name" : "cdx:reproducible", "value" : "enabled" } ] }, "components" : [ { "type" : "library", "bom-ref" : "pkg:maven/org.eclipse.jgit/org.eclipse.jgit@7.4.0.202509020913-r?type=jar", "publisher" : "Eclipse JGit Project", "group" : "org.eclipse.jgit", "name" : "org.eclipse.jgit", "version" : "7.4.0.202509020913-r", "description" : "Repository access and algorithms", "scope" : "required", "hashes" : [ { "alg" : "MD5", "content" : "76f7064ce3a3d5c539b5a63b97f37d63" }, { "alg" : "SHA-1", "content" : "29f269cdcdf02c9b3d52b452e5679cf79de99622" }, { "alg" : "SHA-256", "content" : "9bc7cf2d0400a130e3405e4ae9c78775d9bdb1037098d00b2d8ea79436f3a7f3" }, { "alg" : "SHA-512", "content" : "d23cb9f706a005a9e4648187d5b2e470b9aa9c43fdaebf92de4a6fa66139e6a1e2e398b132bef6fdd3b12c7f398174f60b2584d852f23623c42f894fcdf4bd8e" }, { "alg" : "SHA-384", "content" : "3f68679662e10ee1d3eec5bf3519f0a664a78dff350d22e8c1b25a18ef560d83e8d67732cab62097743f2a22ae7fb8ea" }, { "alg" : "SHA3-384", "content" : "054a73ba3b3d88f100391c7e3b25338b52b460df17629e5a61230d2c00f1d410b0ee1c28aac217404202dfcb1be9ac27" }, { "alg" : "SHA3-256", "content" : "e1e00f68cb119f8a59afaada42daf00a5efff05eda2832f64b86726539f1523e" }, { "alg" : "SHA3-512", "content" : "a34e7ac0f3dfed1c6acd1da9baa3facf445e03b9d403084f4eecae6ddc33b1eaecd56e72bb29472a50b83287dea5bd75cdde52cd5805868da8eadfc7fd63a308" } ], "licenses" : [ { "license" : { "id" : "BSD-3-Clause", "url" : "https://opensource.org/licenses/BSD-3-Clause" } } ], "purl" : "pkg:maven/org.eclipse.jgit/org.eclipse.jgit@7.4.0.202509020913-r?type=jar", "externalReferences" : [ { "type" : "website", "url" : "https://www.eclipse.org/jgit//org.eclipse.jgit" }, { "type" : "build-system", "url" : "https://ci.eclipse.org/jgit" }, { "type" : "distribution", "url" : "https://repo.eclipse.org/content/repositories/jgit-releases/" }, { "type" : "issue-tracker", "url" : "https://github.com/eclipse-jgit/jgit/issues" }, { "type" : "mailing-list", "url" : "http://dev.eclipse.org/mhonarc/lists/jgit-dev" }, { "type" : "vcs", "url" : "https://eclipse.gerrithub.io/admin/repos/eclipse-jgit/jgit/org.eclipse.jgit" } ] }, { "type" : "library", "bom-ref" : "pkg:maven/com.googlecode.javaewah/JavaEWAH@1.2.3?type=jar", "group" : "com.googlecode.javaewah", "name" : "JavaEWAH", "version" : "1.2.3", "description" : "The bit array data structure is implemented in Java as the BitSet class. Unfortunately, this fails to scale without compression. JavaEWAH is a word-aligned compressed variant of the Java bitset class. It uses a 64-bit run-length encoding (RLE) compression scheme. The goal of word-aligned compression is not to achieve the best compression, but rather to improve query processing time. Hence, we try to save CPU cycles, maybe at the expense of storage. However, the EWAH scheme we implemented is always more efficient storage-wise than an uncompressed bitmap (implemented in Java as the BitSet class). Unlike some alternatives, javaewah does not rely on a patented scheme.", "hashes" : [ { "alg" : "MD5", "content" : "8fdeda28c1fb10e67b3d79f86bef5e61" }, { "alg" : "SHA-1", "content" : "13a27c856e0c8808cee9a64032c58eee11c3adc9" }, { "alg" : "SHA-256", "content" : "d65226949713c4c61a784f41c51167e7b0316f93764398ebba9e4336b3d954c2" }, { "alg" : "SHA-512", "content" : "48cd9df9252c58e9ffe4583e68607944bcdf2ad7a3be7b4317467f503c4f56cdbde358ca7c4f34fa620d01615072a42f3a572fc4f1237e266310b7508e79bcac" }, { "alg" : "SHA-384", "content" : "d1fd074f21b8a54a07d3f4579376d7c3ab72f24814ebc9ba92344e9da4721e9bfa3cda3a599137e4ddf2395a3c5b88e4" }, { "alg" : "SHA3-384", "content" : "a553864f196f73c139a104170ab79e780046fb5f322072c5494a6590361021f875afd7168f858b0531b61918ab49b94e" }, { "alg" : "SHA3-256", "content" : "bab97f3f893af36c36218a151b0c3fece27d47f358cc19e1ca9c22d77942bb76" }, { "alg" : "SHA3-512", "content" : "be817b93c7093d44ec8dded565d7e5651772ce38e9c72283c05191b33d0ecb2798cd385395f553500446573ac49dccc21f4ba3067d71eb89e03daa384d0193be" } ], "licenses" : [ { "license" : { "id" : "Apache-2.0" } } ], "purl" : "pkg:maven/com.googlecode.javaewah/JavaEWAH@1.2.3?type=jar", "externalReferences" : [ { "type" : "website", "url" : "https://github.com/lemire/javaewah" }, { "type" : "distribution", "url" : "https://oss.sonatype.org/service/local/staging/deploy/maven2/" }, { "type" : "issue-tracker", "url" : "https://github.com/lemire/javaewah/issues" }, { "type" : "vcs", "url" : "scm:git:git@github.com:lemire/javaewah.git" } ] }, { "type" : "library", "bom-ref" : "pkg:maven/commons-codec/commons-codec@1.19.0?type=jar", "publisher" : "The Apache Software Foundation", "group" : "commons-codec", "name" : "commons-codec", "version" : "1.19.0", "description" : "The Apache Commons Codec component contains encoders and decoders for formats such as Base16, Base32, Base64, digest, and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.", "hashes" : [ { "alg" : "MD5", "content" : "e46fa78c69544eb6239c4e8447e72544" }, { "alg" : "SHA-1", "content" : "8c0dbe3ae883fceda9b50a6c76e745e548073388" }, { "alg" : "SHA-256", "content" : "5c3881e4f556855e9c532927ee0c9dfde94cc66760d5805c031a59887070af5f" }, { "alg" : "SHA-512", "content" : "d98a7a1cfcc08aa9cce4f7778e3f37ecb99da7b1da01944e5fa8faf06fbf9f969f2efb0b416832f419d53085250f711c071f1dac9fa0968483c37034198367fb" }, { "alg" : "SHA-384", "content" : "f0edec3cd84b2320e6930380d3fe13335d33f041470d27fb93789db0c696ec01dda21b471f0015bf70bffffcbfdb67c0" }, { "alg" : "SHA3-384", "content" : "ce771ef9f0df326a34ab37e70f710801bb18d545aca0ee492db62770db323ab8a0b5082123ca4826f3d3182748537cfc" }, { "alg" : "SHA3-256", "content" : "8296db95bb2fac86a0eb68e61e9730084f4272ad6a4a4327a5259c631840e98e" }, { "alg" : "SHA3-512", "content" : "05da2f8674a257c5d8a1137cadbda71d2635f22237450bf2cbc980380a56905247bea38049c8cd80e60077be2be73b1eae6b466c228e4277763a54979cf856fb" } ], "licenses" : [ { "license" : { "id" : "Apache-2.0", "url" : "https://www.apache.org/licenses/LICENSE-2.0" } } ], "purl" : "pkg:maven/commons-codec/commons-codec@1.19.0?type=jar", "externalReferences" : [ { "type" : "website", "url" : "https://commons.apache.org/proper/commons-codec/" }, { "type" : "build-system", "url" : "https://github.com/apache/commons-cli/actions" }, { "type" : "distribution", "url" : "https://repository.apache.org/service/local/staging/deploy/maven2" }, { "type" : "issue-tracker", "url" : "https://issues.apache.org/jira/browse/CODEC" }, { "type" : "mailing-list", "url" : "https://mail-archives.apache.org/mod_mbox/commons-user/" }, { "type" : "vcs", "url" : "https://github.com/apache/commons-codec" } ] }, { "type" : "library", "bom-ref" : "pkg:maven/org.apache.sshd/sshd-osgi@2.16.0?type=jar", "publisher" : "The Apache Software Foundation", "group" : "org.apache.sshd", "name" : "sshd-osgi", "version" : "2.16.0", "description" : "The Apache Software Foundation provides support for the Apache community of open-source software projects. The Apache projects are characterized by a collaborative, consensus based development process, an open and pragmatic software license, and a desire to create high quality software that leads the way in its field. We consider ourselves not simply a group of projects sharing a server, but rather a community of developers and users.", "scope" : "required", "hashes" : [ { "alg" : "MD5", "content" : "928732e1e3ee12dbe5cdf20f45621ca7" }, { "alg" : "SHA-1", "content" : "87cab2aaa6e06c5d48d746e90f0b3635f8c06419" }, { "alg" : "SHA-256", "content" : "398ee51e36d55f9ad72cb39f7edf552ac3d9e123736162ca0f8bc3776e51d855" }, { "alg" : "SHA-512", "content" : "db8649cb7200b9a97c448a543181a01d898834b580d5c6ac9d232a9ca5f995214c2b58232ac6a44aaad991915fc5318c0c08b83604aec9c403f32cc11e779074" }, { "alg" : "SHA-384", "content" : "7eb66986f221384f5628b5abdbefcf25d15c1f820e538694ea3b15b598c4d9b0bf529025dbc12233d653c740b186160c" }, { "alg" : "SHA3-384", "content" : "6d86ecc89535d72c723c4c5f102f824a8ce0af671268749f27c903ea3ec296d4827c6f80a49fb090058b95749d93f826" }, { "alg" : "SHA3-256", "content" : "81258611bc96d7a1926ad3b966897c96021bed0d0e786cb724620419a51f40e8" }, { "alg" : "SHA3-512", "content" : "b1d7e655797530fe40eaa2f1d62c2f0b730128489acf80cf1e90f737151780031f3dfb8d8e5b0274013bcbcfdaca4976e5e5ebc19556fb1b69cd37e0d7d6f48d" } ], "licenses" : [ { "license" : { "id" : "Apache-2.0", "url" : "https://www.apache.org/licenses/LICENSE-2.0" } } ], "purl" : "pkg:maven/org.apache.sshd/sshd-osgi@2.16.0?type=jar", "externalReferences" : [ { "type" : "website", "url" : "https://www.apache.org/sshd/sshd-osgi/" }, { "type" : "issue-tracker", "url" : "https://github.com/apache/mina-sshd/issues" }, { "type" : "mailing-list", "url" : "https://mail-archives.apache.org/mod_mbox/mina-users/" }, { "type" : "vcs", "url" : "https://github.com/apache/mina-sshd/tree/sshd-2.16.0/sshd-osgi" } ] }, { "type" : "library", "bom-ref" : "pkg:maven/org.slf4j/jcl-over-slf4j@1.7.36?type=jar", "publisher" : "QOS.ch", "group" : "org.slf4j", "name" : "jcl-over-slf4j", "version" : "1.7.36", "description" : "JCL 1.2 implemented over SLF4J", "hashes" : [ { "alg" : "MD5", "content" : "8065610cde33ed9fd5d34367912c1938" }, { "alg" : "SHA-1", "content" : "d877e195a05aca4a2f1ad2ff14bfec1393af4b5e" }, { "alg" : "SHA-256", "content" : "ab57ca8fd223772c17365d121f59e94ecbf0ae59d08c03a3cb5b81071c019195" }, { "alg" : "SHA-512", "content" : "ac231ab44521bb5478742af13624db5c14aea809c3a2c13b989fba30186ba6db840f2d1b4aea54f9c1f779547b975fd042dd353f54025592774d40192bd71148" }, { "alg" : "SHA-384", "content" : "618704032ab3f8f87091ac797e2c9319a4b7f36a53e060695d56173b67ce9bc9e16c74cba228e758ac90e279df75428a" }, { "alg" : "SHA3-384", "content" : "95a189173932d8080d91de8b71b9d1bca49a330db7cad9c41d51fe9514a9f6299b24e31441f06681b3dcc188807dcf40" }, { "alg" : "SHA3-256", "content" : "7aef3380fdeae9b7a4adfa6ad69c2c92f246fcdbd4fcd3d1056ee846d8ef92fb" }, { "alg" : "SHA3-512", "content" : "da7d1b8e5a150300e1051dda5755df64275e5822256ef624fd8a37c582cc2774aadce97f8732de52e54b1c74e28ba601d3bfc3482abb4a24f7e9f779e7e8dd64" } ], "licenses" : [ { "license" : { "id" : "Apache-2.0" } } ], "purl" : "pkg:maven/org.slf4j/jcl-over-slf4j@1.7.36?type=jar", "externalReferences" : [ { "type" : "website", "url" : "http://www.slf4j.org" }, { "type" : "distribution", "url" : "https://oss.sonatype.org/service/local/staging/deploy/maven2/" }, { "type" : "vcs", "url" : "https://github.com/qos-ch/slf4j/jcl-over-slf4j" } ] }, { "type" : "library", "bom-ref" : "pkg:maven/org.apache.sshd/sshd-sftp@2.16.0?type=jar", "publisher" : "The Apache Software Foundation", "group" : "org.apache.sshd", "name" : "sshd-sftp", "version" : "2.16.0", "description" : "The Apache Software Foundation provides support for the Apache community of open-source software projects. The Apache projects are characterized by a collaborative, consensus based development process, an open and pragmatic software license, and a desire to create high quality software that leads the way in its field. We consider ourselves not simply a group of projects sharing a server, but rather a community of developers and users.", "scope" : "required", "hashes" : [ { "alg" : "MD5", "content" : "1dcda94ef1919f1d8fac8d9c25163707" }, { "alg" : "SHA-1", "content" : "09d9e7024535fb4a3f74367ba7e0a2f5093af638" }, { "alg" : "SHA-256", "content" : "88e38bfba0ae9dbd69155c9f9ecf925c5ccf6b34d2d903989803165bc8a917f3" }, { "alg" : "SHA-512", "content" : "1a6d3d7c1433120e53efb12a29de43eccf853914fa3a17d100b67f1080e397362c95a9d318c2939502ee37c5b04c294b97d6557accf6eb2d1e3ce727b25e49d0" }, { "alg" : "SHA-384", "content" : "efc0eafe25d5e545cd6106d1577d5005daa958112af914c300d5d4578e93c49fafbf01f07aa6206658c523a392f2d017" }, { "alg" : "SHA3-384", "content" : "8fbb2627c83220b745b084454a233f906fd74561f02907040fa60db9f1ebdbbe5bd3eb695fb2d6b28c4bc3451191cf1a" }, { "alg" : "SHA3-256", "content" : "ef0e3281b5b22e8250d19c8db7274b2fa213f03241925e9820a0e30c0f6492a3" }, { "alg" : "SHA3-512", "content" : "386b49eeee0055d33816e89ed02ea63624059b1f819cc08a638eb19df165519f9f21e297a696c3903f5c816f741c6084446d30913a6e9d4286ea02389898fc59" } ], "licenses" : [ { "license" : { "id" : "Apache-2.0", "url" : "https://www.apache.org/licenses/LICENSE-2.0" } } ], "purl" : "pkg:maven/org.apache.sshd/sshd-sftp@2.16.0?type=jar", "externalReferences" : [ { "type" : "website", "url" : "https://www.apache.org/sshd/sshd-sftp/" }, { "type" : "issue-tracker", "url" : "https://github.com/apache/mina-sshd/issues" }, { "type" : "mailing-list", "url" : "https://mail-archives.apache.org/mod_mbox/mina-users/" }, { "type" : "vcs", "url" : "https://github.com/apache/mina-sshd/tree/sshd-2.16.0/sshd-sftp" } ] }, { "type" : "library", "bom-ref" : "pkg:maven/org.slf4j/slf4j-api@1.7.36?type=jar", "publisher" : "QOS.ch", "group" : "org.slf4j", "name" : "slf4j-api", "version" : "1.7.36", "description" : "The slf4j API", "scope" : "required", "hashes" : [ { "alg" : "MD5", "content" : "872da51f5de7f3923da4de871d57fd85" }, { "alg" : "SHA-1", "content" : "6c62681a2f655b49963a5983b8b0950a6120ae14" }, { "alg" : "SHA-256", "content" : "d3ef575e3e4979678dc01bf1dcce51021493b4d11fb7f1be8ad982877c16a1c0" }, { "alg" : "SHA-512", "content" : "f9b033fc019a44f98b16048da7e2b59edd4a6a527ba60e358f65ab88e0afae03a9340f1b3e8a543d49fa542290f499c5594259affa1ff3e6e7bf3b428d4c610b" }, { "alg" : "SHA-384", "content" : "2b14ad035877087157e379d3277dcdcd79e58d6bdb147c47d29e377d75ce53ad42cafbf22f5fb7827c7e946ff4876b9a" }, { "alg" : "SHA3-384", "content" : "3bc3110dafb8d5be16a39f3b2671a466463cd99eb39610c0e4719a7bf2d928f2ea213c734887c6926a07c4cca7769e4b" }, { "alg" : "SHA3-256", "content" : "ba2608179fcf46e2291a90b9cbb4aa30d718e481f59c350cc21c73b88d826881" }, { "alg" : "SHA3-512", "content" : "14c4edcd19702ef607d78826839d8a6d3a39157df54b89a801d3d3cbbe1307131a77671b041c761122730fb1387888c5ec2e46bdd80e1cb07f8f144676441824" } ], "licenses" : [ { "license" : { "id" : "MIT", "url" : "https://opensource.org/license/mit/" } } ], "purl" : "pkg:maven/org.slf4j/slf4j-api@1.7.36?type=jar", "externalReferences" : [ { "type" : "website", "url" : "http://www.slf4j.org" }, { "type" : "distribution", "url" : "https://oss.sonatype.org/service/local/staging/deploy/maven2/" }, { "type" : "vcs", "url" : "https://github.com/qos-ch/slf4j/slf4j-api" } ] } ], "dependencies" : [ { "ref" : "pkg:maven/org.eclipse.jgit/org.eclipse.jgit.ssh.apache@7.4.0.202509020913-r?type=jar", "dependsOn" : [ "pkg:maven/org.eclipse.jgit/org.eclipse.jgit@7.4.0.202509020913-r?type=jar", "pkg:maven/org.apache.sshd/sshd-osgi@2.16.0?type=jar", "pkg:maven/org.apache.sshd/sshd-sftp@2.16.0?type=jar", "pkg:maven/org.slf4j/slf4j-api@1.7.36?type=jar" ] }, { "ref" : "pkg:maven/org.eclipse.jgit/org.eclipse.jgit@7.4.0.202509020913-r?type=jar", "dependsOn" : [ "pkg:maven/com.googlecode.javaewah/JavaEWAH@1.2.3?type=jar", "pkg:maven/org.slf4j/slf4j-api@1.7.36?type=jar", "pkg:maven/commons-codec/commons-codec@1.19.0?type=jar" ] }, { "ref" : "pkg:maven/com.googlecode.javaewah/JavaEWAH@1.2.3?type=jar", "dependsOn" : [ ] }, { "ref" : "pkg:maven/org.slf4j/slf4j-api@1.7.36?type=jar", "dependsOn" : [ ] }, { "ref" : "pkg:maven/commons-codec/commons-codec@1.19.0?type=jar", "dependsOn" : [ ] }, { "ref" : "pkg:maven/org.apache.sshd/sshd-osgi@2.16.0?type=jar", "dependsOn" : [ "pkg:maven/org.slf4j/slf4j-api@1.7.36?type=jar", "pkg:maven/org.slf4j/jcl-over-slf4j@1.7.36?type=jar" ] }, { "ref" : "pkg:maven/org.slf4j/jcl-over-slf4j@1.7.36?type=jar", "dependsOn" : [ "pkg:maven/org.slf4j/slf4j-api@1.7.36?type=jar" ] }, { "ref" : "pkg:maven/org.apache.sshd/sshd-sftp@2.16.0?type=jar", "dependsOn" : [ "pkg:maven/org.slf4j/slf4j-api@1.7.36?type=jar", "pkg:maven/org.slf4j/jcl-over-slf4j@1.7.36?type=jar" ] } ] }