diff --git a/watchdog-agent/src/test/java/AgentTest.java b/watchdog-agent/src/test/java/AgentTest.java index d9b87868..dc0cfbf4 100644 --- a/watchdog-agent/src/test/java/AgentTest.java +++ b/watchdog-agent/src/test/java/AgentTest.java @@ -151,6 +151,14 @@ void pdfbox_3_0_0_cyclonedx_2_7_4(@TempDir Path dir) throws IOException, Interru assertThat(runPDFBoxWithSbom(project.resolve("bom.json"), output)).isEqualTo(1); } + @Test + void pdfbox_3_0_0_depscan_4_2_2(@TempDir Path dir) throws IOException, InterruptedException { + // contract: pdfbox-tools 3.0.0 should not execute as the SBOM has no root component + Path output = dir.resolve("output.txt"); + assertThat(runPDFBoxWithSbom(project.resolve("sbom-universal.json"), output)) + .isEqualTo(1); + } + private int runPDFBoxWithSbom(Path sbom, Path output) throws IOException, InterruptedException { Path appWhichContainsExecutable = project.resolve("pdfbox-tools-3.0.0.jar"); String mainClass = "org.apache.pdfbox.tools.PDFBox"; diff --git a/watchdog-agent/src/test/resources/pdfbox-3.0.0/sbom-universal.json b/watchdog-agent/src/test/resources/pdfbox-3.0.0/sbom-universal.json new file mode 100644 index 00000000..14ce97b1 --- /dev/null +++ b/watchdog-agent/src/test/resources/pdfbox-3.0.0/sbom-universal.json @@ -0,0 +1,666 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "serialNumber": "urn:uuid:f4279b74-f961-4a15-b151-782643f11581", + "version": 1, + "metadata": { + "timestamp": "2023-08-28T16:01:43.225Z", + "tools": [ + { + "vendor": "cyclonedx", + "name": "cdxgen", + "version": "8.0.5" + } + ], + "authors": [ + { + "name": "Prabhu Subramanian", + "email": "prabhu@appthreat.com" + } + ] + }, + "components": [ + { + "publisher": "", + "group": "org.bouncycastle", + "name": "bcmail-jdk18on", + "version": "1.76", + "description": "The Bouncy Castle Java S/MIME APIs for handling S/MIME protocols. This jar contains S/MIME APIs for JDK 1.8 and up. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs. The JavaMail API and the Java activation framework will also be needed.", + "scope": "optional", + "hashes": [ + { + "alg": "MD5", + "content": "ec1136764ac619bcf6fc2c00a5b2dc9b" + }, + { + "alg": "SHA-1", + "content": "33e17d91d00544c4d7e28826abf8ef38600f7d6b" + }, + { + "alg": "SHA-256", + "content": "0a5a8e7de098c2b707cbe7dd00a9f9fc37dec1ef229ef6221d743002a86de095" + }, + { + "alg": "SHA-512", + "content": "61aa59fdce09ba1ef59ebfe6c2b08fcb2883bf53ae7775872690eba91e0c1f63ccc3cb7d00ed0d1261a12b2597b034bc0de7ec9c2f2c61028cb4247bb797d38a" + }, + { + "alg": "SHA-384", + "content": "ef63fba5845f70bcf5bf250fd15435b674240c29e3e6ebb67fc7904ec5161526be19f82a4974943a36b25bb0f034c88c" + }, + { + "alg": "SHA3-384", + "content": "36443db1ea3120d353f803584461f01b3f0caefbc1706be78191e3b7699b513cc7d161f8a480332c0134d7efe638e114" + }, + { + "alg": "SHA3-256", + "content": "82324dfa6980c5fcd03afa6bc180b7f6d47336a67290d7fdde0fa49d938e8905" + }, + { + "alg": "SHA3-512", + "content": "8438409681ec16d0d3a330e1485133957b7937adfc671a4e4bd7be17d4b3d30fc5ba7e543bf86918804214ad1f13e480c1a5b471a7fe88946309c99351dbd014" + } + ], + "licenses": [ + { + "license": { + "name": "Bouncy Castle Licence", + "url": "https://www.bouncycastle.org/licence.html" + } + } + ], + "purl": "pkg:maven/org.bouncycastle/bcmail-jdk18on@1.76?type=jar", + "type": "library", + "bom-ref": "pkg:maven/org.bouncycastle/bcmail-jdk18on@1.76?type=jar" + }, + { + "publisher": "", + "group": "org.bouncycastle", + "name": "bcprov-jdk18on", + "version": "1.76", + "description": "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.8 and up.", + "hashes": [ + { + "alg": "MD5", + "content": "7020b9a9e1b951f5754a2168a26367f1" + }, + { + "alg": "SHA-1", + "content": "3a785d0b41806865ad7e311162bfa3fa60b3965b" + }, + { + "alg": "SHA-256", + "content": "fda85d777aaae168015860b23a77cad9b8d3a1d5c904fda875313427bd560179" + }, + { + "alg": "SHA-512", + "content": "dbc5b525d805823b53dbaded11547155a14f795212ce6fe1e93d6da431081ea9480718ea2fc17dc7906f8489aadb68e781afd1e771d26f9f8a09b21552bb165c" + }, + { + "alg": "SHA-384", + "content": "e694358472e4ff27bbeda8610581d09d20b70e8af3075ff17ec56ac5eb1cbe4f3bfb69c1ee376d036e9650feb7615703" + }, + { + "alg": "SHA3-384", + "content": "6462c5f3d18098fd50e40dd00733f75ff57e6b390099823ccb645bd7acd72a8a210d234b4fed0b889604c8048be1a742" + }, + { + "alg": "SHA3-256", + "content": "c1296b156a9d365b11076ed66a523fc74112874d5ac2910fa488cdfb716bd8be" + }, + { + "alg": "SHA3-512", + "content": "5ffb1bea400731911ed4fe07999843ba14af7b083aed422d9f2f5e02c4f18993eef5f891c0b06dedbce67cf7df3104b7a3c1e4f197d1c91b8f5a0f3257541d1b" + } + ], + "licenses": [ + { + "license": { + "name": "Bouncy Castle Licence", + "url": "https://www.bouncycastle.org/licence.html" + } + } + ], + "purl": "pkg:maven/org.bouncycastle/bcprov-jdk18on@1.76?type=jar", + "type": "library", + "bom-ref": "pkg:maven/org.bouncycastle/bcprov-jdk18on@1.76?type=jar" + }, + { + "publisher": "", + "group": "org.bouncycastle", + "name": "bcutil-jdk18on", + "version": "1.76", + "description": "The Bouncy Castle Java APIs for ASN.1 extension and utility APIs used to support bcpkix and bctls. This jar contains APIs for JDK 1.8 and up.", + "hashes": [ + { + "alg": "MD5", + "content": "4df5b021c310b4c7c07d4490318d75cb" + }, + { + "alg": "SHA-1", + "content": "8c7594e651a278bcde18e038d8ab55b1f97f4d31" + }, + { + "alg": "SHA-256", + "content": "1a65ad02958223a3f31373bd72eea942cafd1b1877a3ed0b492c2487e77c3c27" + }, + { + "alg": "SHA-512", + "content": "385d95b4c32053bb3734c342d5f3255bcc1cee7e35649965bb5fbf8733ec37009fd5f5e06817a45e7857a2e62e923563ce1231ee3a1de411f788dfa93d39ce41" + }, + { + "alg": "SHA-384", + "content": "fe120698485b9b3e1cfabb0c0b1c31c6190a8476b19be14e1370cd903f5201dae678a7178a68f5e9c33cec6659d94e07" + }, + { + "alg": "SHA3-384", + "content": "74eb3f0c46882d703e0113756f9204c2c382673ca7766c93713d329dc08c799ffe1ebbfdd59229349423e88ee37be0bc" + }, + { + "alg": "SHA3-256", + "content": "b1f66fd4bd357e5f784f490f9a2aa575b9bd35770e55ec968fc7670bbf7640b6" + }, + { + "alg": "SHA3-512", + "content": "768deeb2848b19ff3b91e3fe4369b0d49f3352770a2b438c5f090aafab27c5c37833be03342ea420a034f82102cdbd75d48a3e8e1c9ebd9ba73e401bf3ddb855" + } + ], + "licenses": [ + { + "license": { + "name": "Bouncy Castle Licence", + "url": "https://www.bouncycastle.org/licence.html" + } + } + ], + "purl": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.76?type=jar", + "type": "library", + "bom-ref": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.76?type=jar" + }, + { + "publisher": "", + "group": "org.bouncycastle", + "name": "bcpkix-jdk18on", + "version": "1.76", + "description": "The Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. This jar contains APIs for JDK 1.8 and up. The APIs can be used in conjunction with a JCE/JCA provider such as the one provided with the Bouncy Castle Cryptography APIs.", + "hashes": [ + { + "alg": "MD5", + "content": "661d57d384f768f2bf92c0392f88379e" + }, + { + "alg": "SHA-1", + "content": "10c9cf5c1b4d64abeda28ee32fbade3b74373622" + }, + { + "alg": "SHA-256", + "content": "935a388854c329f9a6f32708f30c90045d2f91294fa687281273145d4cf9834a" + }, + { + "alg": "SHA-512", + "content": "b924374168e25f21ab7f6dd4f6755e55a401cbbbaa0d6f17a0c9bf59e61dc42750b200c494c413f6f8c27fc16d9312f51fc15c979e4298916f5bd0c329cbbffa" + }, + { + "alg": "SHA-384", + "content": "d52951022d439bfff225af8d27aaaa2064806e5d3a6b58b27396045b4dc99d374fd162333d35c3b075e22f8a075a94cd" + }, + { + "alg": "SHA3-384", + "content": "89fe037a38351c32d0b0dc8af44da2cdc657af7d81bd7dafc1bcde78369a128d00f11a065910c4e8c5efa7e7b6a1ee4b" + }, + { + "alg": "SHA3-256", + "content": "34f22275a9af4982fe3677c02eeef549094108a2c9dcc3917bc43a752c58678d" + }, + { + "alg": "SHA3-512", + "content": "4888682241fdebbfcea315d43dea0148144959c90e4245378140e17f3315f5f9b71ee737402be1490f7d23c3228ae5c313d53fd6e6f52063e243d1fddfd471ec" + } + ], + "licenses": [ + { + "license": { + "name": "Bouncy Castle Licence", + "url": "https://www.bouncycastle.org/licence.html" + } + } + ], + "purl": "pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.76?type=jar", + "type": "library", + "bom-ref": "pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.76?type=jar" + }, + { + "publisher": "The Apache Software Foundation", + "group": "org.apache.pdfbox", + "name": "pdfbox-debugger", + "version": "3.0.0", + "description": "The Apache PDFBox library is an open source Java tool for working with PDF documents. This artefact contains the PDFDebugger.", + "scope": "required", + "hashes": [ + { + "alg": "MD5", + "content": "f4ec2464b9a6a56e369e9c3a404a402a" + }, + { + "alg": "SHA-1", + "content": "d47fcab2adeed39fa4405c7ab390b0900a604c6c" + }, + { + "alg": "SHA-256", + "content": "f783d863eee7e292ce1a85d334b87289d3d29a595477d880863720ee18ab73ba" + }, + { + "alg": "SHA-512", + "content": "7d0df639039277338f81096be07d5dbbaae82e0d866f799e078a163e62b3211b0a413910c40520c0087932828e0dcac80c73924e93f736952a9412e2c8fbc922" + }, + { + "alg": "SHA-384", + "content": "a4787e923d6989156818e28eecfe1141e816ae67fcb119cfb2b95ca8d1f65a3477d8c8384f8a048efff03fe331506072" + }, + { + "alg": "SHA3-384", + "content": "dd223b6c2fb33c9d30205aca44ebc43bf58a794ff3d5fde5725eaa80e55eb287e857a60738606227efc666e31f20139b" + }, + { + "alg": "SHA3-256", + "content": "c315dbf64cc80aab21efe2ec7a282c9da22d77020ffa14ed608cd94ae7c5f3d2" + }, + { + "alg": "SHA3-512", + "content": "0a1a790ad48cdbcc4ae82e4a418e669cdcb23c20e8cf1b86b5449609864d78c2e172f6545c3ab746df83aa61cff11cc04d84384b028907c2e6dbbaaccfe43be5" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0", + "url": "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl": "pkg:maven/org.apache.pdfbox/pdfbox-debugger@3.0.0?type=jar", + "type": "library", + "bom-ref": "pkg:maven/org.apache.pdfbox/pdfbox-debugger@3.0.0?type=jar" + }, + { + "publisher": "The Apache Software Foundation", + "group": "org.apache.pdfbox", + "name": "pdfbox", + "version": "3.0.0", + "description": "The Apache PDFBox library is an open source Java tool for working with PDF documents.", + "scope": "required", + "hashes": [ + { + "alg": "MD5", + "content": "abba7d47821b62c01772b56e621ab585" + }, + { + "alg": "SHA-1", + "content": "8903a0ddcdcb138b335ac4cd08d4923eb4163b8f" + }, + { + "alg": "SHA-256", + "content": "702d5d6c4a493ed3e0e085428b5ce9e1879a15950d74077354e28aeb98767104" + }, + { + "alg": "SHA-512", + "content": "22b4ab2950f1a761df2325b9ea464dec3d4890296d9fcdda14b8259f9cd4a2c2bb3787b3fa3495bc3fb5d4dde27a46405444d22681a9d2e00755bcb430daa047" + }, + { + "alg": "SHA-384", + "content": "5fa6a20d1dca1351981b16261c051a9d1bde109197cf32bb70793518c46aafb1bb2610a6c39688ed324273b74c9dbae8" + }, + { + "alg": "SHA3-384", + "content": "d49a23f06afc144b790d94900063d842876ff68938649e52d1e28739141a942132e58fdfdd29471ee720e13bb2d2740e" + }, + { + "alg": "SHA3-256", + "content": "a46b6e2aa986b7cf8545ebac91e2c5e73c0e3c5cbccf5bb739d4e969976bfb3a" + }, + { + "alg": "SHA3-512", + "content": "115ae70af6b268456c1b24bbf039ace31fa622a8e907898210d2c9c8da7e1e660203526e44f8d41a5d20121c19e0e03d02706a96971d95cad060f3c155d87c79" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0", + "url": "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl": "pkg:maven/org.apache.pdfbox/pdfbox@3.0.0?type=jar", + "type": "library", + "bom-ref": "pkg:maven/org.apache.pdfbox/pdfbox@3.0.0?type=jar" + }, + { + "publisher": "The Apache Software Foundation", + "group": "org.apache.pdfbox", + "name": "pdfbox-io", + "version": "3.0.0", + "description": "The Apache PDFBox library is an open source Java tool for working with PDF documents. This artefact contains IO related classes.", + "scope": "required", + "hashes": [ + { + "alg": "MD5", + "content": "bdbcc1e31badaaa1f4acea9cbc914305" + }, + { + "alg": "SHA-1", + "content": "014d85db521aa4f0b56dde0d90204d0973d92537" + }, + { + "alg": "SHA-256", + "content": "c72d403c1ba81ff493ee621938e7a0fc2f6bd3de1ee2e3280bbff91dc9e694e6" + }, + { + "alg": "SHA-512", + "content": "e62b1084f2144814f77d86a77b1c1bf20888edf204c91c763d5b9058259bd383fedf2f98756c98e6a240c13f39bdaeebddfa08cecadeff74a124ff14cc06c920" + }, + { + "alg": "SHA-384", + "content": "abcecda26a54eb79517f76826946f2716bb5fab42dad0f22913ce345d62326feebca8f7c40492a905a62ef2355db9fa8" + }, + { + "alg": "SHA3-384", + "content": "7abea0e3e1e5a21ab1ffb5d35e71a9c9897c73b71502313cd36a83d233fed38827678b6de38d9c77e080a8a52a692e8a" + }, + { + "alg": "SHA3-256", + "content": "c0eaadc261d4c63afa8aa9eacb7ede160af40b99254bcf44ab521bc169df41b5" + }, + { + "alg": "SHA3-512", + "content": "9326cb6d4c8e60bbf861a93cda39302a0ca5f099fe11a4bc6bf04171237270b734dd26396474a4f2a91f0b2acbd985a22fba0bc9057addd3c7b81b418a88984c" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0", + "url": "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl": "pkg:maven/org.apache.pdfbox/pdfbox-io@3.0.0?type=jar", + "type": "library", + "bom-ref": "pkg:maven/org.apache.pdfbox/pdfbox-io@3.0.0?type=jar" + }, + { + "publisher": "The Apache Software Foundation", + "group": "org.apache.pdfbox", + "name": "fontbox", + "version": "3.0.0", + "description": "The Apache FontBox library is an open source Java tool to obtain low level information from font files. FontBox is a subproject of Apache PDFBox.", + "scope": "required", + "hashes": [ + { + "alg": "MD5", + "content": "28df5947f40ffd5772e2f8131482b1bc" + }, + { + "alg": "SHA-1", + "content": "ea02f9341689fb275f7b1969de51669d618a1d6f" + }, + { + "alg": "SHA-256", + "content": "6dcc4237ab52be066c9641cb4c49ca09ceb879b2d7d08ad6bfe4237222cb90b7" + }, + { + "alg": "SHA-512", + "content": "b5a92cdbdbd88bcf0136c7a13f80ce9a4bd3ff76ddeed266a233588e060ac0c8544964506f134bf6ff01909244c2d01e27a095e200d53a33881e394d2d475017" + }, + { + "alg": "SHA-384", + "content": "b7f31c7cc30ab667ef6789fbd7c7101f0e533c54da7707d32542c81085c40a8e8778e20281c4828f088afc61191f4652" + }, + { + "alg": "SHA3-384", + "content": "a1a00f33806113f4f252f02adb8a5991317e197eef6255bccf9464d2a51bcef11c66d820978b7f3dc065b95963300895" + }, + { + "alg": "SHA3-256", + "content": "0d3e7703630b6f922d1eeeef3e21dec7ec1e482fabffb21aac959313c29e979b" + }, + { + "alg": "SHA3-512", + "content": "b67b01fb26a4bdea6ecf5055e17f520c1e5013d9d11b66d1977fae576775bde8be04dde79776e512a050eab6d870f15bc26f170321e15b87197e258fb0e17768" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0", + "url": "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "purl": "pkg:maven/org.apache.pdfbox/fontbox@3.0.0?type=jar", + "type": "library", + "bom-ref": "pkg:maven/org.apache.pdfbox/fontbox@3.0.0?type=jar" + }, + { + "publisher": "", + "group": "commons-logging", + "name": "commons-logging", + "version": "1.2", + "description": "Apache Commons Logging is a thin adapter allowing configurable bridging to other, well known logging systems.", + "scope": "required", + "hashes": [ + { + "alg": "MD5", + "content": "040b4b4d8eac886f6b4a2a3bd2f31b00" + }, + { + "alg": "SHA-1", + "content": "4bfc12adfe4842bf07b657f0369c4cb522955686" + }, + { + "alg": "SHA-256", + "content": "daddea1ea0be0f56978ab3006b8ac92834afeefbd9b7e4e6316fca57df0fa636" + }, + { + "alg": "SHA-512", + "content": "ed00dbfabd9ae00efa26dd400983601d076fe36408b7d6520084b447e5d1fa527ce65bd6afdcb58506c3a808323d28e88f26cb99c6f5db9ff64f6525ecdfa557" + }, + { + "alg": "SHA-384", + "content": "ac20720d7156131478205f1b454395abf84cfc8da2f163301af32f63bd3c4764bd26cb54ed53800f33193ae591f3ce9c" + }, + { + "alg": "SHA3-384", + "content": "628eb4407e95dca84da1a06b08a6d9b832a49de8472b1b217e8607f08efeeed18b996232d64dd07f03e78e0e3bb4b078" + }, + { + "alg": "SHA3-256", + "content": "9aab62deccf156ee6e324c925dfc30ecb53e8465802863a551901a461424e807" + }, + { + "alg": "SHA3-512", + "content": "3fd76857f6d20c03799537cc961c1c4ddf1c375c6c192fb982363e3b9397ba138b77f24ef38b4202f44e37586789c0320e4de18fdadd2772304fd14a9b26d552" + } + ], + "licenses": [], + "purl": "pkg:maven/commons-logging/commons-logging@1.2?type=jar", + "type": "framework", + "bom-ref": "pkg:maven/commons-logging/commons-logging@1.2?type=jar" + }, + { + "publisher": "", + "group": "commons-io", + "name": "commons-io", + "version": "2.13.0", + "description": "The Apache Commons IO library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more.", + "scope": "required", + "hashes": [ + { + "alg": "MD5", + "content": "8d000fa8939b71b8894637f0ef6ea28c" + }, + { + "alg": "SHA-1", + "content": "8bb2bc9b4df17e2411533a0708a69f983bf5e83b" + }, + { + "alg": "SHA-256", + "content": "671eaa39688dac2ffaa4645b3c9980ae2d0ea2471e4ae6a5da199cd15ae23666" + }, + { + "alg": "SHA-512", + "content": "3a5698d0c995c395cf44180073615f087af42fd78e71f224eb38908d823da41f0d04f18e6a14df67b3b02830fbf542f35b9f43aafe39437f17fe18655fbcac07" + }, + { + "alg": "SHA-384", + "content": "51ce4e22195684565d9a93aebcf93bf9aed13e76e429601bdaf5e348430effb5d1276d848a98690040a4182706c731f4" + }, + { + "alg": "SHA3-384", + "content": "fd396f3c704aacf5d9fbb46d38c93c57ccd374fe0d194fdce9a2a29cf28a49f36546be9a58b525b72adc79f81b45406f" + }, + { + "alg": "SHA3-256", + "content": "fedde8561c6fe53171cbcc97ac3cf9e53803480a6b63413711edba58af121433" + }, + { + "alg": "SHA3-512", + "content": "875e3ef85e1445e2704db29a9d792b1df576786e6a24d4bcc2529eb5677f4fdfacf2af2a12aecf2a309fe76cc67422da05bea17bb1a95b719062d74dd7858544" + } + ], + "licenses": [], + "purl": "pkg:maven/commons-io/commons-io@2.13.0?type=jar", + "type": "library", + "bom-ref": "pkg:maven/commons-io/commons-io@2.13.0?type=jar" + }, + { + "publisher": "", + "group": "info.picocli", + "name": "picocli", + "version": "4.7.4", + "description": "Java command line parser with both an annotations API and a programmatic API. Usage help with ANSI styles and colors. Autocomplete. Nested subcommands. Easily included as source to avoid adding a dependency.", + "scope": "required", + "hashes": [ + { + "alg": "MD5", + "content": "21e112a8e2e9422faf7e1dcbd659fd34" + }, + { + "alg": "SHA-1", + "content": "6c036f65c4534c87c4b7f47ed659ee625bee79d4" + }, + { + "alg": "SHA-256", + "content": "1964e89575b43aa177aa4e534946b25bde9f3a48a9675d61d9ef7c4ca83d94b4" + }, + { + "alg": "SHA-512", + "content": "75483ca7701b3ab77c7e2e37236746d8c4f67dd7c0d6f1e7295c04cd8b29d90eb7340d4397f99382b9715022f6c1ad3cd43a575c4b7c7ad2c72193b09912ad57" + }, + { + "alg": "SHA-384", + "content": "4a9075726ddd880cb4b0ef027774922ead46855ae3b4a50e55c8ab2d3e122125ffb1a54c44fd2722fe77f810e28fa254" + }, + { + "alg": "SHA3-384", + "content": "ab8131dcb4cdc6b9eca7d96352459304d5306a35371251f15e8878344fe6348ee65a7e9b31b1537d1dc3ab8bcd9548a6" + }, + { + "alg": "SHA3-256", + "content": "ff5b55f6cede8ab3471c1ebf013f9fdf9605c65b2bb198054ce201ded5e76e7b" + }, + { + "alg": "SHA3-512", + "content": "b64dfcd6d3d43e28b53d42e4e22ffb862e1b5faf3d5d172b27dcaa8a5557889a36eba33b8dbc4c1aad2698fd4e4ed3ef504ca5a5dace6cd5ca9ae75b18c7b436" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "purl": "pkg:maven/info.picocli/picocli@4.7.4?type=jar", + "type": "library", + "bom-ref": "pkg:maven/info.picocli/picocli@4.7.4?type=jar" + } + ], + "services": [], + "dependencies": [ + { + "ref": "pkg:maven/org.apache.pdfbox/pdfbox-tools@3.0.0?type=jar", + "dependsOn": [ + "pkg:maven/org.bouncycastle/bcmail-jdk18on@1.76?type=jar", + "pkg:maven/org.apache.pdfbox/pdfbox-debugger@3.0.0?type=jar", + "pkg:maven/commons-io/commons-io@2.13.0?type=jar", + "pkg:maven/info.picocli/picocli@4.7.4?type=jar" + ] + }, + { + "ref": "pkg:maven/org.bouncycastle/bcmail-jdk18on@1.76?type=jar", + "dependsOn": [ + "pkg:maven/org.bouncycastle/bcprov-jdk18on@1.76?type=jar", + "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.76?type=jar", + "pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.76?type=jar" + ] + }, + { + "ref": "pkg:maven/org.bouncycastle/bcprov-jdk18on@1.76?type=jar", + "dependsOn": [] + }, + { + "ref": "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.76?type=jar", + "dependsOn": [ + "pkg:maven/org.bouncycastle/bcprov-jdk18on@1.76?type=jar" + ] + }, + { + "ref": "pkg:maven/org.bouncycastle/bcpkix-jdk18on@1.76?type=jar", + "dependsOn": [ + "pkg:maven/org.bouncycastle/bcprov-jdk18on@1.76?type=jar", + "pkg:maven/org.bouncycastle/bcutil-jdk18on@1.76?type=jar" + ] + }, + { + "ref": "pkg:maven/org.apache.pdfbox/pdfbox-debugger@3.0.0?type=jar", + "dependsOn": [ + "pkg:maven/org.apache.pdfbox/pdfbox@3.0.0?type=jar", + "pkg:maven/info.picocli/picocli@4.7.4?type=jar" + ] + }, + { + "ref": "pkg:maven/org.apache.pdfbox/pdfbox@3.0.0?type=jar", + "dependsOn": [ + "pkg:maven/org.apache.pdfbox/pdfbox-io@3.0.0?type=jar", + "pkg:maven/org.apache.pdfbox/fontbox@3.0.0?type=jar", + "pkg:maven/commons-logging/commons-logging@1.2?type=jar" + ] + }, + { + "ref": "pkg:maven/org.apache.pdfbox/pdfbox-io@3.0.0?type=jar", + "dependsOn": [ + "pkg:maven/commons-logging/commons-logging@1.2?type=jar" + ] + }, + { + "ref": "pkg:maven/commons-logging/commons-logging@1.2?type=jar", + "dependsOn": [] + }, + { + "ref": "pkg:maven/org.apache.pdfbox/fontbox@3.0.0?type=jar", + "dependsOn": [ + "pkg:maven/org.apache.pdfbox/pdfbox-io@3.0.0?type=jar", + "pkg:maven/commons-logging/commons-logging@1.2?type=jar" + ] + }, + { + "ref": "pkg:maven/info.picocli/picocli@4.7.4?type=jar", + "dependsOn": [] + }, + { + "ref": "pkg:maven/commons-io/commons-io@2.13.0?type=jar", + "dependsOn": [] + } + ] +} \ No newline at end of file