formatExports.test.ts.snap

// Jest Snapshot v1, https://goo.gl/fbAQLP

exports[`CycloneDX JSON alpine 1`] = `
"{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "redacted",
  "version": 1,
  "metadata": {
    "timestamp": "redacted",
    "tools": {
      "components": [
        {
          "type": "application",
          "author": "anchore",
          "name": "syft",
          "version": "redacted"
        }
      ]
    },
    "component": {
      "bom-ref": "redacted",
      "type": "container",
      "name": "localhost:5000/match-coverage/alpine",
      "version": "redacted"
    }
  },
  "components": [
    {
      "bom-ref": "redacted",
      "type": "library",
      "publisher": "A. Wilcox <awilfox@adelielinux.org>",
      "name": "libvncserver",
      "version": "redacted",
      "description": "Library to make writing a vnc server easy",
      "licenses": [
        {
          "license": {
            "id": "GPL-2.0-or-later"
          }
        }
      ],
      "cpe": "cpe:2.3:a:libvncserver:libvncserver:0.9.9:*:*:*:*:*:*:*",
      "purl": "pkg:apk/alpine/libvncserver@0.9.9?arch=x86_64&distro=alpine-3.12.0",
      "externalReferences": [
        {
          "url": "http://libvncserver.sourceforge.net/",
          "type": "distribution"
        }
      ],
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:layerID",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:gitCommitOfApkPort",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:installedSize",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:originPackage",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:provides:0",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:provides:1",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:pullChecksum",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:pullDependencies:0",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:pullDependencies:1",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:pullDependencies:2",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:pullDependencies:3",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:pullDependencies:4",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:pullDependencies:5",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:size",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "operating-system",
      "name": "alpine",
      "version": "redacted",
      "description": "Alpine Linux v3.12",
      "swid": {
        "tagId": "alpine",
        "name": "alpine",
        "version": "redacted"
      },
      "externalReferences": [
        {
          "url": "https://bugs.alpinelinux.org/",
          "type": "issue-tracker"
        },
        {
          "url": "https://alpinelinux.org/",
          "type": "website"
        }
      ],
      "properties": [
        {
          "name": "syft:distro:id",
          "value": "redacted"
        },
        {
          "name": "syft:distro:prettyName",
          "value": "redacted"
        },
        {
          "name": "syft:distro:versionID",
          "value": "redacted"
        }
      ]
    }
  ]
}
"
`;

exports[`CycloneDX JSON debian 1`] = `
"{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "redacted",
  "version": 1,
  "metadata": {
    "timestamp": "redacted",
    "tools": {
      "components": [
        {
          "type": "application",
          "author": "anchore",
          "name": "syft",
          "version": "redacted"
        }
      ]
    },
    "component": {
      "bom-ref": "redacted",
      "type": "container",
      "name": "localhost:5000/match-coverage/debian",
      "version": "redacted"
    }
  },
  "components": [
    {
      "bom-ref": "redacted",
      "type": "library",
      "author": "Georg Brandl <georg@python.org>",
      "name": "Pygments",
      "version": "redacted",
      "licenses": [
        {
          "license": {
            "name": "BSD License"
          }
        }
      ],
      "cpe": "cpe:2.3:a:georg_brandl_project:python-Pygments:2.6.1:*:*:*:*:*:*:*",
      "purl": "pkg:pypi/Pygments@2.6.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:layerID",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        },
        {
          "name": "syft:location:1:layerID",
          "value": "redacted"
        },
        {
          "name": "syft:location:1:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "publisher": "APT Development Team <deity@lists.debian.org>",
      "name": "apt",
      "version": "redacted",
      "cpe": "cpe:2.3:a:apt:apt:1.8.2:*:*:*:*:*:*:*",
      "purl": "pkg:deb/debian/apt@1.8.2?arch=amd64&upstream=apt-dev&distro=debian-8",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:layerID",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:installedSize",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:source",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "author": "André Arko,Samuel Giddins,Colby Swandale,Hiroshi Shibata,David Rodríguez,Grey Baker,Stephanie Morillo,Chris Morris,James Wen,Tim Moore,André Medeiros,Jessica Lynn Suttles,Terence Lee,Carl Lerche,Yehuda Katz",
      "name": "bundler",
      "version": "redacted",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "cpe": "cpe:2.3:a:jessica-lynn-suttles:bundler:2.1.4:*:*:*:*:*:*:*",
      "purl": "pkg:gem/bundler@2.1.4",
      "externalReferences": [
        {
          "url": "https://bundler.io",
          "type": "website"
        }
      ],
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:layerID",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "group": "org.anchore",
      "name": "example-java-app-maven",
      "version": "redacted",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "cpe": "cpe:2.3:a:example-java-app-maven:example-java-app-maven:0.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:maven/org.anchore/example-java-app-maven@0.1.0",
      "externalReferences": [
        {
          "url": "",
          "hashes": [
            {
              "alg": "SHA-1",
              "content": "100b566a7dcdb187bf9f14ecd96427cadd535bfe"
            }
          ],
          "type": "build-meta"
        }
      ],
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:layerID",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:-:artifactID",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:-:groupID",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:virtualPath",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "group": "joda-time",
      "name": "joda-time",
      "version": "redacted",
      "licenses": [
        {
          "license": {
            "name": "Apache 2",
            "url": "http://www.apache.org/licenses/LICENSE-2.0.txt"
          }
        }
      ],
      "cpe": "cpe:2.3:a:joda-time:joda-time:2.9.2:*:*:*:*:*:*:*",
      "purl": "pkg:maven/joda-time/joda-time@2.9.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:layerID",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:-:artifactID",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:-:groupID",
          "value": "redacted"
        },
        {
          "name": "syft:metadata:virtualPath",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
      "name": "npm",
      "version": "redacted",
      "description": "a package manager for JavaScript",
      "licenses": [
        {
          "license": {
            "id": "Artistic-2.0"
          }
        }
      ],
      "cpe": "cpe:2.3:a:node_packaged_modules_project:node_packaged_modules:6.14.6:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/npm@6.14.6",
      "externalReferences": [
        {
          "url": "https://github.com/npm/cli",
          "type": "distribution"
        },
        {
          "url": "https://docs.npmjs.com/",
          "type": "website"
        }
      ],
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:layerID",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "operating-system",
      "name": "debian",
      "version": "redacted",
      "description": "Debian GNU/Linux 8 (jessie)",
      "swid": {
        "tagId": "debian",
        "name": "debian",
        "version": "redacted"
      },
      "externalReferences": [
        {
          "url": "https://bugs.debian.org/",
          "type": "issue-tracker"
        },
        {
          "url": "http://www.debian.org/",
          "type": "website"
        },
        {
          "url": "http://www.debian.org/support",
          "comment": "support",
          "type": "other"
        }
      ],
      "properties": [
        {
          "name": "syft:distro:id",
          "value": "redacted"
        },
        {
          "name": "syft:distro:prettyName",
          "value": "redacted"
        },
        {
          "name": "syft:distro:versionID",
          "value": "redacted"
        }
      ]
    }
  ]
}
"
`;

exports[`CycloneDX JSON npm 1`] = `
"{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "redacted",
  "version": 1,
  "metadata": {
    "timestamp": "redacted",
    "tools": {
      "components": [
        {
          "type": "application",
          "author": "anchore",
          "name": "syft",
          "version": "redacted"
        }
      ]
    },
    "component": {
      "bom-ref": "redacted",
      "type": "file",
      "name": "tests/fixtures/npm-project"
    }
  },
  "components": [
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "chownr",
      "version": "redacted",
      "cpe": "cpe:2.3:a:chownr:chownr:2.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/chownr@2.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "fs-minipass",
      "version": "redacted",
      "cpe": "cpe:2.3:a:fs-minipass:fs-minipass:2.1.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/fs-minipass@2.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "js-tokens",
      "version": "redacted",
      "cpe": "cpe:2.3:a:js-tokens:js-tokens:4.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/js-tokens@4.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "loose-envify",
      "version": "redacted",
      "cpe": "cpe:2.3:a:loose-envify:loose-envify:1.4.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/loose-envify@1.4.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "minipass",
      "version": "redacted",
      "cpe": "cpe:2.3:a:minipass:minipass:3.1.3:*:*:*:*:*:*:*",
      "purl": "pkg:npm/minipass@3.1.3",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "minizlib",
      "version": "redacted",
      "cpe": "cpe:2.3:a:minizlib:minizlib:2.1.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/minizlib@2.1.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "mkdirp",
      "version": "redacted",
      "cpe": "cpe:2.3:a:mkdirp:mkdirp:1.0.4:*:*:*:*:*:*:*",
      "purl": "pkg:npm/mkdirp@1.0.4",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "object-assign",
      "version": "redacted",
      "cpe": "cpe:2.3:a:object-assign:object-assign:4.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/object-assign@4.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "prop-types",
      "version": "redacted",
      "cpe": "cpe:2.3:a:prop-types:prop-types:15.7.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/prop-types@15.7.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "react",
      "version": "redacted",
      "cpe": "cpe:2.3:a:react:react:16.14.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/react@16.14.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "react-is",
      "version": "redacted",
      "cpe": "cpe:2.3:a:react-is:react-is:16.13.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/react-is@16.13.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "tar",
      "version": "redacted",
      "cpe": "cpe:2.3:a:tar_project:tar:6.1.0:*:*:*:*:node.js:*:*",
      "purl": "pkg:npm/tar@6.1.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "yallist",
      "version": "redacted",
      "cpe": "cpe:2.3:a:yallist:yallist:4.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/yallist@4.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    }
  ]
}
"
`;

exports[`CycloneDX JSON yarn 1`] = `
"{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "serialNumber": "redacted",
  "version": 1,
  "metadata": {
    "timestamp": "redacted",
    "tools": {
      "components": [
        {
          "type": "application",
          "author": "anchore",
          "name": "syft",
          "version": "redacted"
        }
      ]
    },
    "component": {
      "bom-ref": "redacted",
      "type": "file",
      "name": "tests/fixtures/yarn-project"
    }
  },
  "components": [
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "js-tokens",
      "version": "redacted",
      "cpe": "cpe:2.3:a:js-tokens:js-tokens:4.0.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/js-tokens@4.0.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "loose-envify",
      "version": "redacted",
      "cpe": "cpe:2.3:a:loose-envify:loose-envify:1.4.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/loose-envify@1.4.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "object-assign",
      "version": "redacted",
      "cpe": "cpe:2.3:a:object-assign:object-assign:4.1.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/object-assign@4.1.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "prop-types",
      "version": "redacted",
      "cpe": "cpe:2.3:a:prop-types:prop-types:15.7.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/prop-types@15.7.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "react",
      "version": "redacted",
      "cpe": "cpe:2.3:a:react:react:16.14.0:*:*:*:*:*:*:*",
      "purl": "pkg:npm/react@16.14.0",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "react-is",
      "version": "redacted",
      "cpe": "cpe:2.3:a:react-is:react-is:16.13.1:*:*:*:*:*:*:*",
      "purl": "pkg:npm/react-is@16.13.1",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:cpe23",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    },
    {
      "bom-ref": "redacted",
      "type": "library",
      "name": "trim",
      "version": "redacted",
      "cpe": "cpe:2.3:a:trim:trim:0.0.2:*:*:*:*:*:*:*",
      "purl": "pkg:npm/trim@0.0.2",
      "properties": [
        {
          "name": "syft:package:foundBy",
          "value": "redacted"
        },
        {
          "name": "syft:package:language",
          "value": "redacted"
        },
        {
          "name": "syft:package:type",
          "value": "redacted"
        },
        {
          "name": "syft:package:metadataType",
          "value": "redacted"
        },
        {
          "name": "syft:location:0:path",
          "value": "redacted"
        }
      ]
    }
  ]
}
"
`;

exports[`CycloneDX XML alpine 1`] = `
"<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.5" " version="1">
  <metadata>
    
    <tools>
      <components>
        <component type="application">
          <author>anchore</author>
          <name>syft</name>
          
        </component>
      </components>
    </tools>
    <component  type="container">
      <name>localhost:5000/match-coverage/alpine</name>
      
    </component>
  </metadata>
  <components>
    <component  type="library">
      <publisher>A. Wilcox &lt;awilfox@adelielinux.org&gt;</publisher>
      <name>libvncserver</name>
      
      <description>Library to make writing a vnc server easy</description>
      <licenses>
        <license>
          <id>GPL-2.0-or-later</id>
        </license>
      </licenses>
      <cpe>cpe:2.3:a:libvncserver:libvncserver:0.9.9:*:*:*:*:*:*:*</cpe>
      <purl>pkg:apk/alpine/libvncserver@0.9.9?arch=x86_64&amp;distro=alpine-3.12.0</purl>
      <externalReferences>
        <reference type="distribution">
          <url>http://libvncserver.sourceforge.net/</url>
        </reference>
      </externalReferences>
      <properties>
        <property name="syft:package:foundBy">apk-db-cataloger</property>
        <property name="syft:package:type">apk</property>
        <property name="syft:package:metadataType">apk-db-entry</property>
        
        
        <property name="syft:metadata:gitCommitOfApkPort">bf1ec813f662f128fc6b70f37ef1c0474bb24488</property>
        <property name="syft:metadata:installedSize">389120</property>
        <property name="syft:metadata:originPackage">libvncserver</property>
        <property name="syft:metadata:provides:0">so:libvncclient.so.1=1.0.0</property>
        <property name="syft:metadata:provides:1">so:libvncserver.so.1=1.0.0</property>
        <property name="syft:metadata:pullChecksum">Q1z0MwWQKfva+S+q7XmOBYFfQgW/k=</property>
        <property name="syft:metadata:pullDependencies:0">so:libc.musl-x86_64.so.1</property>
        <property name="syft:metadata:pullDependencies:1">so:libgcrypt.so.20</property>
        <property name="syft:metadata:pullDependencies:2">so:libgnutls.so.30</property>
        <property name="syft:metadata:pullDependencies:3">so:libjpeg.so.8</property>
        <property name="syft:metadata:pullDependencies:4">so:libpng16.so.16</property>
        <property name="syft:metadata:pullDependencies:5">so:libz.so.1</property>
        <property name="syft:metadata:size">166239</property>
      </properties>
    </component>
    <component  type="operating-system">
      <name>alpine</name>
      
      <description>Alpine Linux v3.12</description>
      <swid tagId="alpine" name="alpine" version="3.12.0"></swid>
      <externalReferences>
        <reference type="issue-tracker">
          <url>https://bugs.alpinelinux.org/</url>
        </reference>
        <reference type="website">
          <url>https://alpinelinux.org/</url>
        </reference>
      </externalReferences>
      <properties>
        <property name="syft:distro:id">alpine</property>
        <property name="syft:distro:prettyName">Alpine Linux v3.12</property>
        <property name="syft:distro:versionID">3.12.0</property>
      </properties>
    </component>
  </components>
</bom>
"
`;

exports[`CycloneDX XML debian 1`] = `
"<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.5" " version="1">
  <metadata>
    
    <tools>
      <components>
        <component type="application">
          <author>anchore</author>
          <name>syft</name>
          
        </component>
      </components>
    </tools>
    <component  type="container">
      <name>localhost:5000/match-coverage/debian</name>
      
    </component>
  </metadata>
  <components>
    <component  type="library">
      <author>Georg Brandl &lt;georg@python.org&gt;</author>
      <name>Pygments</name>
      
      <licenses>
        <license>
          <name>BSD License</name>
        </license>
      </licenses>
      <cpe>cpe:2.3:a:georg_brandl_project:python-Pygments:2.6.1:*:*:*:*:*:*:*</cpe>
      <purl>pkg:pypi/Pygments@2.6.1</purl>
      <properties>
        <property name="syft:package:foundBy">python-installed-package-cataloger</property>
        <property name="syft:package:language">python</property>
        <property name="syft:package:type">python</property>
        <property name="syft:package:metadataType">python-package</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_brandl_project:python_Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_brandlproject:python-Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_brandlproject:python_Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:python-Pygments:python-Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:python-Pygments:python_Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:python_Pygments:python-Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:python_Pygments:python_Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_brandl_project:Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_project:python-Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_project:python_Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_brandl:python-Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_brandl:python_Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_brandlproject:Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georgproject:python-Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georgproject:python_Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:Pygments:python-Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:Pygments:python_Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:python-Pygments:Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:python_Pygments:Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_project:Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:python:python-Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:python:python_Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg:python-Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg:python_Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg_brandl:Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georgproject:Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:Pygments:Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:python:Pygments:2.6.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:georg:Pygments:2.6.1:*:*:*:*:*:*:*</property>
        
        
        
        
      </properties>
    </component>
    <component  type="library">
      <publisher>APT Development Team &lt;deity@lists.debian.org&gt;</publisher>
      <name>apt</name>
      
      <cpe>cpe:2.3:a:apt:apt:1.8.2:*:*:*:*:*:*:*</cpe>
      <purl>pkg:deb/debian/apt@1.8.2?arch=amd64&amp;upstream=apt-dev&amp;distro=debian-8</purl>
      <properties>
        <property name="syft:package:foundBy">dpkg-db-cataloger</property>
        <property name="syft:package:type">deb</property>
        <property name="syft:package:metadataType">dpkg-db-entry</property>
        
        
        <property name="syft:metadata:installedSize">4064</property>
        <property name="syft:metadata:source">apt-dev</property>
      </properties>
    </component>
    <component  type="library">
      <author>André Arko,Samuel Giddins,Colby Swandale,Hiroshi Shibata,David Rodríguez,Grey Baker,Stephanie Morillo,Chris Morris,James Wen,Tim Moore,André Medeiros,Jessica Lynn Suttles,Terence Lee,Carl Lerche,Yehuda Katz</author>
      <name>bundler</name>
      
      <licenses>
        <license>
          <id>MIT</id>
        </license>
      </licenses>
      <cpe>cpe:2.3:a:jessica-lynn-suttles:bundler:2.1.4:*:*:*:*:*:*:*</cpe>
      <purl>pkg:gem/bundler@2.1.4</purl>
      <externalReferences>
        <reference type="website">
          <url>https://bundler.io</url>
        </reference>
      </externalReferences>
      <properties>
        <property name="syft:package:foundBy">ruby-installed-gemspec-cataloger</property>
        <property name="syft:package:language">ruby</property>
        <property name="syft:package:type">gem</property>
        <property name="syft:package:metadataType">ruby-gemspec</property>
        <property name="syft:cpe23">cpe:2.3:a:jessica_lynn_suttles:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:stephanie-morillo:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:stephanie_morillo:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:hiroshi-shibata:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:hiroshi_shibata:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:colby-swandale:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:colby_swandale:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:samuel-giddins:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:samuel_giddins:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:chris-morris:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:chris_morris:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:carl-lerche:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:carl_lerche:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:terence-lee:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:terence_lee:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:yehuda-katz:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:yehuda_katz:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:grey-baker:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:grey_baker:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:james-wen:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:james_wen:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:ruby-lang:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:ruby_lang:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:tim-moore:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:tim_moore:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:bundler:bundler:2.1.4:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:ruby:bundler:2.1.4:*:*:*:*:*:*:*</property>
        
        
      </properties>
    </component>
    <component  type="library">
      <group>org.anchore</group>
      <name>example-java-app-maven</name>
      
      <licenses>
        <license>
          <id>Apache-2.0</id>
        </license>
      </licenses>
      <cpe>cpe:2.3:a:example-java-app-maven:example-java-app-maven:0.1.0:*:*:*:*:*:*:*</cpe>
      <purl>pkg:maven/org.anchore/example-java-app-maven@0.1.0</purl>
      <externalReferences>
        <reference type="build-meta">
          <url></url>
          <hashes>
            <hash alg="SHA-1">100b566a7dcdb187bf9f14ecd96427cadd535bfe</hash>
          </hashes>
        </reference>
      </externalReferences>
      <properties>
        <property name="syft:package:foundBy">java-archive-cataloger</property>
        <property name="syft:package:language">java</property>
        <property name="syft:package:type">java-archive</property>
        <property name="syft:package:metadataType">java-archive</property>
        <property name="syft:cpe23">cpe:2.3:a:example-java-app-maven:example_java_app_maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example_java_app_maven:example-java-app-maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example_java_app_maven:example_java_app_maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example-java-app:example-java-app-maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example-java-app:example_java_app_maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example_java_app:example-java-app-maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example_java_app:example_java_app_maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example-java:example-java-app-maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example-java:example_java_app_maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example_java:example-java-app-maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example_java:example_java_app_maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:anchore:example-java-app-maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:anchore:example_java_app_maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example:example-java-app-maven:0.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:example:example_java_app_maven:0.1.0:*:*:*:*:*:*:*</property>
        
        
        <property name="syft:metadata:-:artifactID">example-java-app-maven</property>
        <property name="syft:metadata:-:groupID">org.anchore</property>
        <property name="syft:metadata:virtualPath">/java/example-java-app-maven-0.1.0.jar</property>
      </properties>
    </component>
    <component  type="library">
      <group>joda-time</group>
      <name>joda-time</name>
      
      <licenses>
        <license>
          <name>Apache 2</name>
          <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
        </license>
      </licenses>
      <cpe>cpe:2.3:a:joda-time:joda-time:2.9.2:*:*:*:*:*:*:*</cpe>
      <purl>pkg:maven/joda-time/joda-time@2.9.2</purl>
      <properties>
        <property name="syft:package:foundBy">java-archive-cataloger</property>
        <property name="syft:package:language">java</property>
        <property name="syft:package:type">java-archive</property>
        <property name="syft:package:metadataType">java-archive</property>
        <property name="syft:cpe23">cpe:2.3:a:joda-time:joda_time:2.9.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:joda_time:joda-time:2.9.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:joda_time:joda_time:2.9.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:joda:joda-time:2.9.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:joda:joda_time:2.9.2:*:*:*:*:*:*:*</property>
        
        
        <property name="syft:metadata:-:artifactID">joda-time</property>
        <property name="syft:metadata:-:groupID">joda-time</property>
        <property name="syft:metadata:virtualPath">/java/example-java-app-maven-0.1.0.jar:joda-time:joda-time</property>
      </properties>
    </component>
    <component  type="library">
      <author>Isaac Z. Schlueter &lt;i@izs.me&gt; (http://blog.izs.me)</author>
      <name>npm</name>
      
      <description>a package manager for JavaScript</description>
      <licenses>
        <license>
          <id>Artistic-2.0</id>
        </license>
      </licenses>
      <cpe>cpe:2.3:a:node_packaged_modules_project:node_packaged_modules:6.14.6:*:*:*:*:node.js:*:*</cpe>
      <purl>pkg:npm/npm@6.14.6</purl>
      <externalReferences>
        <reference type="distribution">
          <url>https://github.com/npm/cli</url>
        </reference>
        <reference type="website">
          <url>https://docs.npmjs.com/</url>
        </reference>
      </externalReferences>
      <properties>
        <property name="syft:package:foundBy">javascript-package-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package</property>
        
        
      </properties>
    </component>
    <component  type="operating-system">
      <name>debian</name>
      
      <description>Debian GNU/Linux 8 (jessie)</description>
      <swid tagId="debian" name="debian" version="8"></swid>
      <externalReferences>
        <reference type="issue-tracker">
          <url>https://bugs.debian.org/</url>
        </reference>
        <reference type="website">
          <url>http://www.debian.org/</url>
        </reference>
        <reference type="other">
          <url>http://www.debian.org/support</url>
          <comment>support</comment>
        </reference>
      </externalReferences>
      <properties>
        <property name="syft:distro:id">debian</property>
        <property name="syft:distro:prettyName">Debian GNU/Linux 8 (jessie)</property>
        <property name="syft:distro:versionID">8</property>
      </properties>
    </component>
  </components>
</bom>
"
`;

exports[`CycloneDX XML npm 1`] = `
"<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.5" " version="1">
  <metadata>
    
    <tools>
      <components>
        <component type="application">
          <author>anchore</author>
          <name>syft</name>
          
        </component>
      </components>
    </tools>
    <component  type="file">
      <name>tests/fixtures/npm-project</name>
    </component>
  </metadata>
  <components>
    <component  type="library">
      <name>chownr</name>
      
      <cpe>cpe:2.3:a:chownr:chownr:2.0.0:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/chownr@2.0.0</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>fs-minipass</name>
      
      <cpe>cpe:2.3:a:fs-minipass:fs-minipass:2.1.0:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/fs-minipass@2.1.0</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:fs-minipass:fs_minipass:2.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:fs_minipass:fs-minipass:2.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:fs_minipass:fs_minipass:2.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:fs:fs-minipass:2.1.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:fs:fs_minipass:2.1.0:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>js-tokens</name>
      
      <cpe>cpe:2.3:a:js-tokens:js-tokens:4.0.0:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/js-tokens@4.0.0</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:js-tokens:js_tokens:4.0.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:js_tokens:js-tokens:4.0.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:js_tokens:js_tokens:4.0.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:js:js-tokens:4.0.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:js:js_tokens:4.0.0:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>loose-envify</name>
      
      <cpe>cpe:2.3:a:loose-envify:loose-envify:1.4.0:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/loose-envify@1.4.0</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:loose-envify:loose_envify:1.4.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:loose_envify:loose-envify:1.4.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:loose_envify:loose_envify:1.4.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:loose:loose-envify:1.4.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:loose:loose_envify:1.4.0:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>minipass</name>
      
      <cpe>cpe:2.3:a:minipass:minipass:3.1.3:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/minipass@3.1.3</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>minizlib</name>
      
      <cpe>cpe:2.3:a:minizlib:minizlib:2.1.2:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/minizlib@2.1.2</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>mkdirp</name>
      
      <cpe>cpe:2.3:a:mkdirp:mkdirp:1.0.4:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/mkdirp@1.0.4</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>object-assign</name>
      
      <cpe>cpe:2.3:a:object-assign:object-assign:4.1.1:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/object-assign@4.1.1</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:object-assign:object_assign:4.1.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:object_assign:object-assign:4.1.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:object_assign:object_assign:4.1.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:object:object-assign:4.1.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:object:object_assign:4.1.1:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>prop-types</name>
      
      <cpe>cpe:2.3:a:prop-types:prop-types:15.7.2:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/prop-types@15.7.2</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:prop-types:prop_types:15.7.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:prop_types:prop-types:15.7.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:prop_types:prop_types:15.7.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:prop:prop-types:15.7.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:prop:prop_types:15.7.2:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>react</name>
      
      <cpe>cpe:2.3:a:react:react:16.14.0:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/react@16.14.0</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>react-is</name>
      
      <cpe>cpe:2.3:a:react-is:react-is:16.13.1:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/react-is@16.13.1</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:react-is:react_is:16.13.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:react_is:react-is:16.13.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:react_is:react_is:16.13.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:react:react-is:16.13.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:react:react_is:16.13.1:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>tar</name>
      
      <cpe>cpe:2.3:a:tar_project:tar:6.1.0:*:*:*:*:node.js:*:*</cpe>
      <purl>pkg:npm/tar@6.1.0</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>yallist</name>
      
      <cpe>cpe:2.3:a:yallist:yallist:4.0.0:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/yallist@4.0.0</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-npm-package-lock-entry</property>
        
      </properties>
    </component>
  </components>
</bom>
"
`;

exports[`CycloneDX XML yarn 1`] = `
"<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.5" " version="1">
  <metadata>
    
    <tools>
      <components>
        <component type="application">
          <author>anchore</author>
          <name>syft</name>
          
        </component>
      </components>
    </tools>
    <component  type="file">
      <name>tests/fixtures/yarn-project</name>
    </component>
  </metadata>
  <components>
    <component  type="library">
      <name>js-tokens</name>
      
      <cpe>cpe:2.3:a:js-tokens:js-tokens:4.0.0:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/js-tokens@4.0.0</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-yarn-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:js-tokens:js_tokens:4.0.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:js_tokens:js-tokens:4.0.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:js_tokens:js_tokens:4.0.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:js:js-tokens:4.0.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:js:js_tokens:4.0.0:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>loose-envify</name>
      
      <cpe>cpe:2.3:a:loose-envify:loose-envify:1.4.0:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/loose-envify@1.4.0</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-yarn-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:loose-envify:loose_envify:1.4.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:loose_envify:loose-envify:1.4.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:loose_envify:loose_envify:1.4.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:loose:loose-envify:1.4.0:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:loose:loose_envify:1.4.0:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>object-assign</name>
      
      <cpe>cpe:2.3:a:object-assign:object-assign:4.1.1:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/object-assign@4.1.1</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-yarn-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:object-assign:object_assign:4.1.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:object_assign:object-assign:4.1.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:object_assign:object_assign:4.1.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:object:object-assign:4.1.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:object:object_assign:4.1.1:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>prop-types</name>
      
      <cpe>cpe:2.3:a:prop-types:prop-types:15.7.2:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/prop-types@15.7.2</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-yarn-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:prop-types:prop_types:15.7.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:prop_types:prop-types:15.7.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:prop_types:prop_types:15.7.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:prop:prop-types:15.7.2:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:prop:prop_types:15.7.2:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>react</name>
      
      <cpe>cpe:2.3:a:react:react:16.14.0:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/react@16.14.0</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-yarn-lock-entry</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>react-is</name>
      
      <cpe>cpe:2.3:a:react-is:react-is:16.13.1:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/react-is@16.13.1</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-yarn-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:react-is:react_is:16.13.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:react_is:react-is:16.13.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:react_is:react_is:16.13.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:react:react-is:16.13.1:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:react:react_is:16.13.1:*:*:*:*:*:*:*</property>
        
      </properties>
    </component>
    <component  type="library">
      <name>trim</name>
      
      <cpe>cpe:2.3:a:trim:trim:0.0.2:*:*:*:*:*:*:*</cpe>
      <purl>pkg:npm/trim@0.0.2</purl>
      <properties>
        <property name="syft:package:foundBy">javascript-lock-cataloger</property>
        <property name="syft:package:language">javascript</property>
        <property name="syft:package:type">npm</property>
        <property name="syft:package:metadataType">javascript-yarn-lock-entry</property>
        
      </properties>
    </component>
  </components>
</bom>
"
`;

exports[`SPDX JSON alpine 1`] = `
"{
 "spdxVersion": "SPDX-2.3",
 "dataLicense": "CC0-1.0",
 "SPDXID": "redacted",
 "name": "localhost:5000/match-coverage/alpine",
 "documentNamespace": "redacted",
 "creationInfo": {
  "licenseListVersion": "redacted",
  "creators": [
   "Organization: Anchore, Inc",
   
  ],
  "created": "redacted"
 },
 "packages": [
  {
   "name": "libvncserver",
   "SPDXID": "redacted",
   "versionInfo": "0.9.9",
   "supplier": "Person: A. Wilcox <awilfox@adelielinux.org>",
   "originator": "Person: A. Wilcox <awilfox@adelielinux.org>",
   "downloadLocation": "http://libvncserver.sourceforge.net/",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "GPL-2.0-or-later",
   "copyrightText": "NOASSERTION",
   "description": "Library to make writing a vnc server easy",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:libvncserver:libvncserver:0.9.9:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:apk/alpine/libvncserver@0.9.9?arch=x86_64&distro=alpine-3.12.0"
    }
   ]
  },
  {
   "name": "localhost:5000/match-coverage/alpine",
   "SPDXID": "redacted",
   "versionInfo": "sha256:redacted",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "checksums": [
    {
     "algorithm": "SHA256",
     "checksumValue": "shas256:redacted"
    }
   ],
   "externalRefs": [
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:oci/localhost:5000/match-coverage/alpine@sha256:redacted?arch=amd64&tag=latest"
    }
   ],
   "primaryPackagePurpose": "CONTAINER"
  }
 ],
 "files": [
  {
   "fileName": "/lib/apk/db/installed",
   "SPDXID": "redacted",
   "checksums": [
    {
     "algorithm": "SHA1",
     "checksumValue": "0000000000000000000000000000000000000000"
    }
   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": "",
   "comment": "layerID: sha256:redacted"
  }
 ],
 "relationships": [
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "DESCRIBES"
  }
 ]
}
"
`;

exports[`SPDX JSON debian 1`] = `
"{
 "spdxVersion": "SPDX-2.3",
 "dataLicense": "CC0-1.0",
 "SPDXID": "redacted",
 "name": "localhost:5000/match-coverage/debian",
 "documentNamespace": "redacted",
 "creationInfo": {
  "licenseListVersion": "redacted",
  "creators": [
   "Organization: Anchore, Inc",
   
  ],
  "created": "redacted"
 },
 "packages": [
  {
   "name": "Pygments",
   "SPDXID": "redacted",
   "versionInfo": "2.6.1",
   "supplier": "Person: Georg Brandl (georg@python.org)",
   "originator": "Person: Georg Brandl (georg@python.org)",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed python package manifest file: /python/dist-info/METADATA, /python/dist-info/top_level.txt",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "LicenseRef-BSD-License",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_brandl_project:python-Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_brandl_project:python_Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_brandlproject:python-Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_brandlproject:python_Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:python-Pygments:python-Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:python-Pygments:python_Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:python_Pygments:python-Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:python_Pygments:python_Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_brandl_project:Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_project:python-Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_project:python_Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_brandl:python-Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_brandl:python_Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_brandlproject:Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georgproject:python-Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georgproject:python_Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:Pygments:python-Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:Pygments:python_Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:python-Pygments:Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:python_Pygments:Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_project:Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:python:python-Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:python:python_Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg:python-Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg:python_Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg_brandl:Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georgproject:Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:Pygments:Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:python:Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:georg:Pygments:2.6.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:pypi/Pygments@2.6.1"
    }
   ]
  },
  {
   "name": "apt",
   "SPDXID": "redacted",
   "versionInfo": "1.8.2",
   "supplier": "Person: APT Development Team <deity@lists.debian.org>",
   "originator": "Person: APT Development Team <deity@lists.debian.org>",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from DPKG DB: /var/lib/dpkg/status",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:apt:apt:1.8.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:deb/debian/apt@1.8.2?arch=amd64&upstream=apt-dev&distro=debian-8"
    }
   ]
  },
  {
   "name": "bundler",
   "SPDXID": "redacted",
   "versionInfo": "2.1.4",
   "supplier": "Person: André Arko",
   "originator": "Person: André Arko",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "homepage": "https://bundler.io",
   "sourceInfo": "acquired package info from installed gem metadata file: /ruby/specifications/bundler.gemspec",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "MIT",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:jessica-lynn-suttles:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:jessica_lynn_suttles:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:stephanie-morillo:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:stephanie_morillo:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:hiroshi-shibata:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:hiroshi_shibata:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:colby-swandale:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:colby_swandale:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:samuel-giddins:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:samuel_giddins:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:chris-morris:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:chris_morris:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:carl-lerche:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:carl_lerche:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:terence-lee:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:terence_lee:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:yehuda-katz:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:yehuda_katz:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:grey-baker:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:grey_baker:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:james-wen:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:james_wen:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:ruby-lang:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:ruby_lang:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:tim-moore:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:tim_moore:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:bundler:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:ruby:bundler:2.1.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:gem/bundler@2.1.4"
    }
   ]
  },
  {
   "name": "example-java-app-maven",
   "SPDXID": "redacted",
   "versionInfo": "0.1.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "checksums": [
    {
     "algorithm": "SHA1",
     "checksumValue": "100b566a7dcdb187bf9f14ecd96427cadd535bfe"
    }
   ],
   "sourceInfo": "acquired package info from installed java archive: /java/example-java-app-maven-0.1.0.jar",
   "licenseConcluded": "Apache-2.0",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example-java-app-maven:example-java-app-maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example-java-app-maven:example_java_app_maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example_java_app_maven:example-java-app-maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example_java_app_maven:example_java_app_maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example-java-app:example-java-app-maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example-java-app:example_java_app_maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example_java_app:example-java-app-maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example_java_app:example_java_app_maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example-java:example-java-app-maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example-java:example_java_app_maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example_java:example-java-app-maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example_java:example_java_app_maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:anchore:example-java-app-maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:anchore:example_java_app_maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example:example-java-app-maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:example:example_java_app_maven:0.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:maven/org.anchore/example-java-app-maven@0.1.0"
    }
   ]
  },
  {
   "name": "joda-time",
   "SPDXID": "redacted",
   "versionInfo": "2.9.2",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed java archive: /java/example-java-app-maven-0.1.0.jar",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "LicenseRef-Apache-2",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:joda-time:joda-time:2.9.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:joda-time:joda_time:2.9.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:joda_time:joda-time:2.9.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:joda_time:joda_time:2.9.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:joda:joda-time:2.9.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:joda:joda_time:2.9.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:maven/joda-time/joda-time@2.9.2"
    }
   ]
  },
  {
   "name": "npm",
   "SPDXID": "redacted",
   "versionInfo": "6.14.6",
   "supplier": "Person: Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
   "originator": "Person: Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
   "downloadLocation": "https://github.com/npm/cli",
   "filesAnalyzed": false,
   "homepage": "https://docs.npmjs.com/",
   "sourceInfo": "acquired package info from installed node module manifest file: /javascript/pkg-json/package.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "Artistic-2.0",
   "copyrightText": "NOASSERTION",
   "description": "a package manager for JavaScript",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:node_packaged_modules_project:node_packaged_modules:6.14.6:*:*:*:*:node.js:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/npm@6.14.6"
    }
   ]
  },
  {
   "name": "localhost:5000/match-coverage/debian",
   "SPDXID": "redacted",
   "versionInfo": "sha256:redacted",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "checksums": [
    {
     "algorithm": "SHA256",
     "checksumValue": "shas256:redacted"
    }
   ],
   "externalRefs": [
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:oci/localhost:5000/match-coverage/debian@sha256:redacted?arch=amd64&tag=latest"
    }
   ],
   "primaryPackagePurpose": "CONTAINER"
  }
 ],
 "files": [
  {
   "fileName": "/java/example-java-app-maven-0.1.0.jar",
   "SPDXID": "redacted",
   "checksums": [
    {
     "algorithm": "SHA1",
     "checksumValue": "0000000000000000000000000000000000000000"
    }
   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": "",
   "comment": "layerID: sha256:redacted"
  },
  {
   "fileName": "/javascript/pkg-json/package.json",
   "SPDXID": "redacted",
   "checksums": [
    {
     "algorithm": "SHA1",
     "checksumValue": "0000000000000000000000000000000000000000"
    }
   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": "",
   "comment": "layerID: sha256:redacted"
  },
  {
   "fileName": "/python/dist-info/METADATA",
   "SPDXID": "redacted",
   "checksums": [
    {
     "algorithm": "SHA1",
     "checksumValue": "0000000000000000000000000000000000000000"
    }
   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": "",
   "comment": "layerID: sha256:redacted"
  },
  {
   "fileName": "/ruby/specifications/bundler.gemspec",
   "SPDXID": "redacted",
   "checksums": [
    {
     "algorithm": "SHA1",
     "checksumValue": "0000000000000000000000000000000000000000"
    }
   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": "",
   "comment": "layerID: sha256:redacted"
  },
  {
   "fileName": "/var/lib/dpkg/status",
   "SPDXID": "redacted",
   "checksums": [
    {
     "algorithm": "SHA1",
     "checksumValue": "0000000000000000000000000000000000000000"
    }
   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": "",
   "comment": "layerID: sha256:redacted"
  }
 ],
 "hasExtractedLicensingInfos": [
  {
   "licenseId": "LicenseRef-Apache-2",
   "extractedText": "Apache 2"
  },
  {
   "licenseId": "LicenseRef-BSD-License",
   "extractedText": "BSD License"
  }
 ],
 "relationships": [
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "DESCRIBES"
  }
 ]
}
"
`;

exports[`SPDX JSON npm 1`] = `
"{
 "spdxVersion": "SPDX-2.3",
 "dataLicense": "CC0-1.0",
 "SPDXID": "redacted",
 "name": "tests/fixtures/npm-project",
 "documentNamespace": "redacted",
 "creationInfo": {
  "licenseListVersion": "redacted",
  "creators": [
   "Organization: Anchore, Inc",
   
  ],
  "created": "redacted"
 },
 "packages": [
  {
   "name": "chownr",
   "SPDXID": "redacted",
   "versionInfo": "2.0.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:chownr:chownr:2.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/chownr@2.0.0"
    }
   ]
  },
  {
   "name": "fs-minipass",
   "SPDXID": "redacted",
   "versionInfo": "2.1.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:fs-minipass:fs-minipass:2.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:fs-minipass:fs_minipass:2.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:fs_minipass:fs-minipass:2.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:fs_minipass:fs_minipass:2.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:fs:fs-minipass:2.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:fs:fs_minipass:2.1.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/fs-minipass@2.1.0"
    }
   ]
  },
  {
   "name": "js-tokens",
   "SPDXID": "redacted",
   "versionInfo": "4.0.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js-tokens:js-tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js-tokens:js_tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js_tokens:js-tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js_tokens:js_tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js:js-tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js:js_tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/js-tokens@4.0.0"
    }
   ]
  },
  {
   "name": "loose-envify",
   "SPDXID": "redacted",
   "versionInfo": "1.4.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose-envify:loose-envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose-envify:loose_envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose_envify:loose-envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose_envify:loose_envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose:loose-envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose:loose_envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/loose-envify@1.4.0"
    }
   ]
  },
  {
   "name": "minipass",
   "SPDXID": "redacted",
   "versionInfo": "3.1.3",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/minipass/-/minipass-3.1.3.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:minipass:minipass:3.1.3:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/minipass@3.1.3"
    }
   ]
  },
  {
   "name": "minizlib",
   "SPDXID": "redacted",
   "versionInfo": "2.1.2",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:minizlib:minizlib:2.1.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/minizlib@2.1.2"
    }
   ]
  },
  {
   "name": "mkdirp",
   "SPDXID": "redacted",
   "versionInfo": "1.0.4",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:mkdirp:mkdirp:1.0.4:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/mkdirp@1.0.4"
    }
   ]
  },
  {
   "name": "object-assign",
   "SPDXID": "redacted",
   "versionInfo": "4.1.1",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object-assign:object-assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object-assign:object_assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object_assign:object-assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object_assign:object_assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object:object-assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object:object_assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/object-assign@4.1.1"
    }
   ]
  },
  {
   "name": "prop-types",
   "SPDXID": "redacted",
   "versionInfo": "15.7.2",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/prop-types/-/prop-types-15.7.2.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop-types:prop-types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop-types:prop_types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop_types:prop-types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop_types:prop_types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop:prop-types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop:prop_types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/prop-types@15.7.2"
    }
   ]
  },
  {
   "name": "react",
   "SPDXID": "redacted",
   "versionInfo": "16.14.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/react/-/react-16.14.0.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react:react:16.14.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/react@16.14.0"
    }
   ]
  },
  {
   "name": "react-is",
   "SPDXID": "redacted",
   "versionInfo": "16.13.1",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react-is:react-is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react-is:react_is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react_is:react-is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react_is:react_is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react:react-is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react:react_is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/react-is@16.13.1"
    }
   ]
  },
  {
   "name": "tar",
   "SPDXID": "redacted",
   "versionInfo": "6.1.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/tar/-/tar-6.1.0.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:tar_project:tar:6.1.0:*:*:*:*:node.js:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/tar@6.1.0"
    }
   ]
  },
  {
   "name": "yallist",
   "SPDXID": "redacted",
   "versionInfo": "4.0.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /package-lock.json",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:yallist:yallist:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/yallist@4.0.0"
    }
   ]
  },
  {
   "name": "tests/fixtures/npm-project",
   "SPDXID": "redacted",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "primaryPackagePurpose": "FILE"
  }
 ],
 "files": [
  {
   "fileName": "/package-lock.json",
   "SPDXID": "redacted",
   "checksums": [
    {
     "algorithm": "SHA1",
     "checksumValue": "0000000000000000000000000000000000000000"
    }
   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": ""
  }
 ],
 "relationships": [
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "DESCRIBES"
  }
 ]
}
"
`;

exports[`SPDX JSON yarn 1`] = `
"{
 "spdxVersion": "SPDX-2.3",
 "dataLicense": "CC0-1.0",
 "SPDXID": "redacted",
 "name": "tests/fixtures/yarn-project",
 "documentNamespace": "redacted",
 "creationInfo": {
  "licenseListVersion": "redacted",
  "creators": [
   "Organization: Anchore, Inc",
   
  ],
  "created": "redacted"
 },
 "packages": [
  {
   "name": "js-tokens",
   "SPDXID": "redacted",
   "versionInfo": "4.0.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /yarn.lock",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js-tokens:js-tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js-tokens:js_tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js_tokens:js-tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js_tokens:js_tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js:js-tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:js:js_tokens:4.0.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/js-tokens@4.0.0"
    }
   ]
  },
  {
   "name": "loose-envify",
   "SPDXID": "redacted",
   "versionInfo": "1.4.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /yarn.lock",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose-envify:loose-envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose-envify:loose_envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose_envify:loose-envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose_envify:loose_envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose:loose-envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:loose:loose_envify:1.4.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/loose-envify@1.4.0"
    }
   ]
  },
  {
   "name": "object-assign",
   "SPDXID": "redacted",
   "versionInfo": "4.1.1",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /yarn.lock",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object-assign:object-assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object-assign:object_assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object_assign:object-assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object_assign:object_assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object:object-assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:object:object_assign:4.1.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/object-assign@4.1.1"
    }
   ]
  },
  {
   "name": "prop-types",
   "SPDXID": "redacted",
   "versionInfo": "15.7.2",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /yarn.lock",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop-types:prop-types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop-types:prop_types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop_types:prop-types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop_types:prop_types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop:prop-types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:prop:prop_types:15.7.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/prop-types@15.7.2"
    }
   ]
  },
  {
   "name": "react",
   "SPDXID": "redacted",
   "versionInfo": "16.14.0",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /yarn.lock",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react:react:16.14.0:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/react@16.14.0"
    }
   ]
  },
  {
   "name": "react-is",
   "SPDXID": "redacted",
   "versionInfo": "16.13.1",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /yarn.lock",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react-is:react-is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react-is:react_is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react_is:react-is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react_is:react_is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react:react-is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:react:react_is:16.13.1:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/react-is@16.13.1"
    }
   ]
  },
  {
   "name": "trim",
   "SPDXID": "redacted",
   "versionInfo": "0.0.2",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "sourceInfo": "acquired package info from installed node module manifest file: /yarn.lock",
   "licenseConcluded": "NOASSERTION",
   "licenseDeclared": "NOASSERTION",
   "copyrightText": "NOASSERTION",
   "externalRefs": [
    {
     "referenceCategory": "SECURITY",
     "referenceType": "cpe23Type",
     "referenceLocator": "cpe:2.3:a:trim:trim:0.0.2:*:*:*:*:*:*:*"
    },
    {
     "referenceCategory": "PACKAGE-MANAGER",
     "referenceType": "purl",
     "referenceLocator": "pkg:npm/trim@0.0.2"
    }
   ]
  },
  {
   "name": "tests/fixtures/yarn-project",
   "SPDXID": "redacted",
   "supplier": "NOASSERTION",
   "downloadLocation": "NOASSERTION",
   "filesAnalyzed": false,
   "primaryPackagePurpose": "FILE"
  }
 ],
 "files": [
  {
   "fileName": "/yarn.lock",
   "SPDXID": "redacted",
   "checksums": [
    {
     "algorithm": "SHA1",
     "checksumValue": "0000000000000000000000000000000000000000"
    }
   ],
   "licenseConcluded": "NOASSERTION",
   "copyrightText": ""
  }
 ],
 "relationships": [
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "OTHER",
   "comment": "evident-by: indicates the package's existence is evident by the given file"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "CONTAINS"
  },
  {
   "spdxElementId": "redacted",
   "relatedSpdxElement": "redacted",
   "relationshipType": "DESCRIBES"
  }
 ]
}
"
`;

exports[`SPDX Tag Value alpine 1`] = `
"SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0

DocumentName: localhost:5000/match-coverage/alpine






##### Unpackaged files

FileName: /lib/apk/db/installed

FileChecksum: SHA1: 0000000000000000000000000000000000000000
LicenseConcluded: NOASSERTION
FileComment: layerID: sha256:redacted

##### Package: localhost:5000/match-coverage/alpine

PackageName: localhost:5000/match-coverage/alpine

PackageVersion: sha256:redacted
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
PrimaryPackagePurpose: CONTAINER
FilesAnalyzed: false
PackageChecksum: SHA256: shas256:redacted
ExternalRef: PACKAGE-MANAGER purl pkg:oci/localhost:5000/match-coverage/alpine@sha256:redacted?arch=amd64&tag=latest

##### Package: libvncserver

PackageName: libvncserver

PackageVersion: 0.9.9
PackageSupplier: Person: A. Wilcox <awilfox@adelielinux.org>
PackageOriginator: Person: A. Wilcox <awilfox@adelielinux.org>
PackageDownloadLocation: http://libvncserver.sourceforge.net/
FilesAnalyzed: false
PackageSourceInfo: acquired package info from APK DB: /lib/apk/db/installed
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: GPL-2.0-or-later
PackageCopyrightText: NOASSERTION
PackageDescription: Library to make writing a vnc server easy
ExternalRef: SECURITY cpe23Type cpe:2.3:a:libvncserver:libvncserver:0.9.9:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:apk/alpine/libvncserver@0.9.9?arch=x86_64&distro=alpine-3.12.0

##### Relationships

Relationship: SPDXRef-Package-apk-libvncserver-hash:redacted OTHER SPDXRef-File-lib-apk-db-installed-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-DocumentRoot-Image-localhost-5000-match-coverage-alpine CONTAINS SPDXRef-Package-apk-libvncserver-hash:redacted
Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DocumentRoot-Image-localhost-5000-match-coverage-alpine
"
`;

exports[`SPDX Tag Value debian 1`] = `
"SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0

DocumentName: localhost:5000/match-coverage/debian






##### Unpackaged files

FileName: /java/example-java-app-maven-0.1.0.jar

FileChecksum: SHA1: 0000000000000000000000000000000000000000
LicenseConcluded: NOASSERTION
FileComment: layerID: sha256:redacted

FileName: /javascript/pkg-json/package.json

FileChecksum: SHA1: 0000000000000000000000000000000000000000
LicenseConcluded: NOASSERTION
FileComment: layerID: sha256:redacted

FileName: /python/dist-info/METADATA

FileChecksum: SHA1: 0000000000000000000000000000000000000000
LicenseConcluded: NOASSERTION
FileComment: layerID: sha256:redacted

FileName: /ruby/specifications/bundler.gemspec

FileChecksum: SHA1: 0000000000000000000000000000000000000000
LicenseConcluded: NOASSERTION
FileComment: layerID: sha256:redacted

FileName: /var/lib/dpkg/status

FileChecksum: SHA1: 0000000000000000000000000000000000000000
LicenseConcluded: NOASSERTION
FileComment: layerID: sha256:redacted

##### Package: localhost:5000/match-coverage/debian

PackageName: localhost:5000/match-coverage/debian

PackageVersion: sha256:redacted
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
PrimaryPackagePurpose: CONTAINER
FilesAnalyzed: false
PackageChecksum: SHA256: shas256:redacted
ExternalRef: PACKAGE-MANAGER purl pkg:oci/localhost:5000/match-coverage/debian@sha256:redacted?arch=amd64&tag=latest

##### Package: apt

PackageName: apt

PackageVersion: 1.8.2
PackageSupplier: Person: APT Development Team <deity@lists.debian.org>
PackageOriginator: Person: APT Development Team <deity@lists.debian.org>
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageSourceInfo: acquired package info from DPKG DB: /var/lib/dpkg/status
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:apt:apt:1.8.2:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:deb/debian/apt@1.8.2?arch=amd64&upstream=apt-dev&distro=debian-8

##### Package: bundler

PackageName: bundler

PackageVersion: 2.1.4
PackageSupplier: Person: André Arko
PackageOriginator: Person: André Arko
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageHomePage: https://bundler.io
PackageSourceInfo: acquired package info from installed gem metadata file: /ruby/specifications/bundler.gemspec
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: MIT
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:jessica-lynn-suttles:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:jessica_lynn_suttles:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:stephanie-morillo:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:stephanie_morillo:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:hiroshi-shibata:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:hiroshi_shibata:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:colby-swandale:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:colby_swandale:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:samuel-giddins:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:samuel_giddins:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris-morris:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:chris_morris:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:carl-lerche:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:carl_lerche:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:terence-lee:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:terence_lee:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:yehuda-katz:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:yehuda_katz:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:grey-baker:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:grey_baker:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:james-wen:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:james_wen:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:ruby-lang:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:ruby_lang:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:tim-moore:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:tim_moore:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:bundler:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:ruby:bundler:2.1.4:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:gem/bundler@2.1.4

##### Package: example-java-app-maven

PackageName: example-java-app-maven

PackageVersion: 0.1.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageChecksum: SHA1: 100b566a7dcdb187bf9f14ecd96427cadd535bfe
PackageSourceInfo: acquired package info from installed java archive: /java/example-java-app-maven-0.1.0.jar
PackageLicenseConcluded: Apache-2.0
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example-java-app-maven:example-java-app-maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example-java-app-maven:example_java_app_maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example_java_app_maven:example-java-app-maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example_java_app_maven:example_java_app_maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example-java-app:example-java-app-maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example-java-app:example_java_app_maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example_java_app:example-java-app-maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example_java_app:example_java_app_maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example-java:example-java-app-maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example-java:example_java_app_maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example_java:example-java-app-maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example_java:example_java_app_maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:anchore:example-java-app-maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:anchore:example_java_app_maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example:example-java-app-maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:example:example_java_app_maven:0.1.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:maven/org.anchore/example-java-app-maven@0.1.0

##### Package: joda-time

PackageName: joda-time

PackageVersion: 2.9.2
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed java archive: /java/example-java-app-maven-0.1.0.jar
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: LicenseRef-Apache-2
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:joda-time:joda-time:2.9.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:joda-time:joda_time:2.9.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:joda_time:joda-time:2.9.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:joda_time:joda_time:2.9.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:joda:joda-time:2.9.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:joda:joda_time:2.9.2:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:maven/joda-time/joda-time@2.9.2

##### Package: npm

PackageName: npm

PackageVersion: 6.14.6
PackageSupplier: Person: Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)
PackageOriginator: Person: Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)
PackageDownloadLocation: https://github.com/npm/cli
FilesAnalyzed: false
PackageHomePage: https://docs.npmjs.com/
PackageSourceInfo: acquired package info from installed node module manifest file: /javascript/pkg-json/package.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: Artistic-2.0
PackageCopyrightText: NOASSERTION
PackageDescription: a package manager for JavaScript
ExternalRef: SECURITY cpe23Type cpe:2.3:a:node_packaged_modules_project:node_packaged_modules:6.14.6:*:*:*:*:node.js:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/npm@6.14.6

##### Package: Pygments

PackageName: Pygments

PackageVersion: 2.6.1
PackageSupplier: Person: Georg Brandl (georg@python.org)
PackageOriginator: Person: Georg Brandl (georg@python.org)
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed python package manifest file: /python/dist-info/METADATA, /python/dist-info/top_level.txt
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: LicenseRef-BSD-License
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandl_project:python-Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandl_project:python_Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandlproject:python-Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandlproject:python_Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python-Pygments:python-Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python-Pygments:python_Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python_Pygments:python-Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python_Pygments:python_Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandl_project:Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_project:python-Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_project:python_Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandl:python-Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandl:python_Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandlproject:Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georgproject:python-Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georgproject:python_Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:Pygments:python-Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:Pygments:python_Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python-Pygments:Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python_Pygments:Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_project:Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python:python-Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python:python_Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg:python-Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg:python_Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg_brandl:Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georgproject:Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:Pygments:Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:python:Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:georg:Pygments:2.6.1:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:pypi/Pygments@2.6.1

##### Other Licenses

LicenseID: LicenseRef-Apache-2
ExtractedText: Apache 2

LicenseID: LicenseRef-BSD-License
ExtractedText: BSD License

##### Relationships

Relationship: SPDXRef-Package-deb-apt-hash:redacted OTHER SPDXRef-File-var-lib-dpkg-status-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-java-archive-joda-time-hash:redacted OTHER SPDXRef-File-java-example-java-app-maven-0.1.0.jar-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-java-archive-example-java-app-maven-hash:redacted OTHER SPDXRef-File-java-example-java-app-maven-0.1.0.jar-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-python-Pygments-hash:redacted OTHER SPDXRef-File-python-dist-info-METADATA-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-gem-bundler-hash:redacted OTHER SPDXRef-File-ruby-specifications-bundler.gemspec-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-npm-hash:redacted OTHER SPDXRef-File-javascript-pkg-json-package.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-DocumentRoot-Image-localhost-5000-match-coverage-debian CONTAINS SPDXRef-Package-python-Pygments-hash:redacted
Relationship: SPDXRef-DocumentRoot-Image-localhost-5000-match-coverage-debian CONTAINS SPDXRef-Package-deb-apt-hash:redacted
Relationship: SPDXRef-DocumentRoot-Image-localhost-5000-match-coverage-debian CONTAINS SPDXRef-Package-gem-bundler-hash:redacted
Relationship: SPDXRef-DocumentRoot-Image-localhost-5000-match-coverage-debian CONTAINS SPDXRef-Package-java-archive-example-java-app-maven-hash:redacted
Relationship: SPDXRef-DocumentRoot-Image-localhost-5000-match-coverage-debian CONTAINS SPDXRef-Package-java-archive-joda-time-hash:redacted
Relationship: SPDXRef-DocumentRoot-Image-localhost-5000-match-coverage-debian CONTAINS SPDXRef-Package-npm-npm-hash:redacted
Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DocumentRoot-Image-localhost-5000-match-coverage-debian
"
`;

exports[`SPDX Tag Value npm 1`] = `
"SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0

DocumentName: tests/fixtures/npm-project






##### Unpackaged files

FileName: /package-lock.json

FileChecksum: SHA1: 0000000000000000000000000000000000000000
LicenseConcluded: NOASSERTION

##### Package: tests/fixtures/npm-project

PackageName: tests/fixtures/npm-project

PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
PrimaryPackagePurpose: FILE
FilesAnalyzed: false

##### Package: chownr

PackageName: chownr

PackageVersion: 2.0.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:chownr:chownr:2.0.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/chownr@2.0.0

##### Package: fs-minipass

PackageName: fs-minipass

PackageVersion: 2.1.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:fs-minipass:fs-minipass:2.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:fs-minipass:fs_minipass:2.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:fs_minipass:fs-minipass:2.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:fs_minipass:fs_minipass:2.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:fs:fs-minipass:2.1.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:fs:fs_minipass:2.1.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/fs-minipass@2.1.0

##### Package: js-tokens

PackageName: js-tokens

PackageVersion: 4.0.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js-tokens:js-tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js-tokens:js_tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js_tokens:js-tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js_tokens:js_tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js:js-tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js:js_tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/js-tokens@4.0.0

##### Package: loose-envify

PackageName: loose-envify

PackageVersion: 1.4.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose-envify:loose-envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose-envify:loose_envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose_envify:loose-envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose_envify:loose_envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose:loose-envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose:loose_envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/loose-envify@1.4.0

##### Package: minipass

PackageName: minipass

PackageVersion: 3.1.3
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/minipass/-/minipass-3.1.3.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:minipass:minipass:3.1.3:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/minipass@3.1.3

##### Package: minizlib

PackageName: minizlib

PackageVersion: 2.1.2
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:minizlib:minizlib:2.1.2:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/minizlib@2.1.2

##### Package: mkdirp

PackageName: mkdirp

PackageVersion: 1.0.4
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:mkdirp:mkdirp:1.0.4:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/mkdirp@1.0.4

##### Package: object-assign

PackageName: object-assign

PackageVersion: 4.1.1
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object-assign:object-assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object-assign:object_assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object_assign:object-assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object_assign:object_assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object:object-assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object:object_assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/object-assign@4.1.1

##### Package: prop-types

PackageName: prop-types

PackageVersion: 15.7.2
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/prop-types/-/prop-types-15.7.2.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop-types:prop-types:15.7.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop-types:prop_types:15.7.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop_types:prop-types:15.7.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop_types:prop_types:15.7.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop:prop-types:15.7.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop:prop_types:15.7.2:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/prop-types@15.7.2

##### Package: react

PackageName: react

PackageVersion: 16.14.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/react/-/react-16.14.0.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react:react:16.14.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/react@16.14.0

##### Package: react-is

PackageName: react-is

PackageVersion: 16.13.1
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react-is:react-is:16.13.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react-is:react_is:16.13.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react_is:react-is:16.13.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react_is:react_is:16.13.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react:react-is:16.13.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react:react_is:16.13.1:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/react-is@16.13.1

##### Package: tar

PackageName: tar

PackageVersion: 6.1.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/tar/-/tar-6.1.0.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:tar_project:tar:6.1.0:*:*:*:*:node.js:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/tar@6.1.0

##### Package: yallist

PackageName: yallist

PackageVersion: 4.0.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /package-lock.json
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:yallist:yallist:4.0.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/yallist@4.0.0

##### Relationships

Relationship: SPDXRef-Package-npm-js-tokens-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-minizlib-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-react-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-tar-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-react-is-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-fs-minipass-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-mkdirp-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-prop-types-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-loose-envify-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-object-assign-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-chownr-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-minipass-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-yallist-hash:redacted OTHER SPDXRef-File-package-lock.json-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-chownr-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-fs-minipass-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-js-tokens-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-loose-envify-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-minipass-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-minizlib-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-mkdirp-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-object-assign-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-prop-types-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-react-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-react-is-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-tar-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project CONTAINS SPDXRef-Package-npm-yallist-hash:redacted
Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DocumentRoot-Directory-tests-fixtures-npm-project
"
`;

exports[`SPDX Tag Value yarn 1`] = `
"SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0

DocumentName: tests/fixtures/yarn-project






##### Unpackaged files

FileName: /yarn.lock

FileChecksum: SHA1: 0000000000000000000000000000000000000000
LicenseConcluded: NOASSERTION

##### Package: tests/fixtures/yarn-project

PackageName: tests/fixtures/yarn-project

PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
PrimaryPackagePurpose: FILE
FilesAnalyzed: false

##### Package: js-tokens

PackageName: js-tokens

PackageVersion: 4.0.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /yarn.lock
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js-tokens:js-tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js-tokens:js_tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js_tokens:js-tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js_tokens:js_tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js:js-tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:js:js_tokens:4.0.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/js-tokens@4.0.0

##### Package: loose-envify

PackageName: loose-envify

PackageVersion: 1.4.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /yarn.lock
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose-envify:loose-envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose-envify:loose_envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose_envify:loose-envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose_envify:loose_envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose:loose-envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:loose:loose_envify:1.4.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/loose-envify@1.4.0

##### Package: object-assign

PackageName: object-assign

PackageVersion: 4.1.1
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /yarn.lock
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object-assign:object-assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object-assign:object_assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object_assign:object-assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object_assign:object_assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object:object-assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:object:object_assign:4.1.1:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/object-assign@4.1.1

##### Package: prop-types

PackageName: prop-types

PackageVersion: 15.7.2
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /yarn.lock
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop-types:prop-types:15.7.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop-types:prop_types:15.7.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop_types:prop-types:15.7.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop_types:prop_types:15.7.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop:prop-types:15.7.2:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:prop:prop_types:15.7.2:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/prop-types@15.7.2

##### Package: react

PackageName: react

PackageVersion: 16.14.0
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /yarn.lock
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react:react:16.14.0:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/react@16.14.0

##### Package: react-is

PackageName: react-is

PackageVersion: 16.13.1
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /yarn.lock
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react-is:react-is:16.13.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react-is:react_is:16.13.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react_is:react-is:16.13.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react_is:react_is:16.13.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react:react-is:16.13.1:*:*:*:*:*:*:*
ExternalRef: SECURITY cpe23Type cpe:2.3:a:react:react_is:16.13.1:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/react-is@16.13.1

##### Package: trim

PackageName: trim

PackageVersion: 0.0.2
PackageSupplier: NOASSERTION
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: false
PackageSourceInfo: acquired package info from installed node module manifest file: /yarn.lock
PackageLicenseConcluded: NOASSERTION
PackageLicenseDeclared: NOASSERTION
PackageCopyrightText: NOASSERTION
ExternalRef: SECURITY cpe23Type cpe:2.3:a:trim:trim:0.0.2:*:*:*:*:*:*:*
ExternalRef: PACKAGE-MANAGER purl pkg:npm/trim@0.0.2

##### Relationships

Relationship: SPDXRef-Package-npm-loose-envify-hash:redacted OTHER SPDXRef-File-yarn.lock-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-trim-hash:redacted OTHER SPDXRef-File-yarn.lock-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-react-is-hash:redacted OTHER SPDXRef-File-yarn.lock-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-prop-types-hash:redacted OTHER SPDXRef-File-yarn.lock-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-object-assign-hash:redacted OTHER SPDXRef-File-yarn.lock-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-js-tokens-hash:redacted OTHER SPDXRef-File-yarn.lock-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-Package-npm-react-hash:redacted OTHER SPDXRef-File-yarn.lock-hash:redacted
RelationshipComment: evident-by: indicates the package's existence is evident by the given file
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-yarn-project CONTAINS SPDXRef-Package-npm-js-tokens-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-yarn-project CONTAINS SPDXRef-Package-npm-loose-envify-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-yarn-project CONTAINS SPDXRef-Package-npm-object-assign-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-yarn-project CONTAINS SPDXRef-Package-npm-prop-types-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-yarn-project CONTAINS SPDXRef-Package-npm-react-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-yarn-project CONTAINS SPDXRef-Package-npm-react-is-hash:redacted
Relationship: SPDXRef-DocumentRoot-Directory-tests-fixtures-yarn-project CONTAINS SPDXRef-Package-npm-trim-hash:redacted
Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-DocumentRoot-Directory-tests-fixtures-yarn-project
"
`;