Supply Chain Attacken und Softwareentwicklung

René Pfeiffer

DeepSec GmbH

DeepSec Conference Logo

IT-SECX 2023, 13. Oktober 2023, FH St. Pölten

whoami

  • 🆔 René Pfeiffer
  • ℹ Senior Systems Administrator
  • ℹ aktiv mit Freie Software seit 1988
  • ☢ Studium der theoretischen Physik
  • 🕸 „im Internet“ seit 1992 (14400 Baud aufwärts)
  • ⏳☠ 30+ Jahre Erfahrung mit Software Entwicklung, Computing und Systemadministration

Aurora

OpenSSL Heartbleed Bug

OpenSSL Heartbleed Bug

  • Schwachstelle - 1./7. April 2014 - CVE-2014-0160
  • Auslesen von Serverspeicher via Netzwerk
  • Status der Versionen
    • OpenSSL 1.0.1 bis 1.0.1f (inklusive) sind betroffen
    • OpenSSL 1.0.1g ist nicht betroffen
    • OpenSSL 1.0.0 Zweig ist nicht betroffen
    • OpenSSL 0.9.8 Zweig ist nicht betroffen

OpenSSL Heartbleed Bug

Welche Systeme benötigen kritische Updates?

Data centre with server isles. Source: https://www.wired.it/economia/business/2017/09/19/microsoft-centrale-elettrica/

Komponenten



C/C++

#include <boost/algorithm/string.hpp>
#include <cerrno>
#include <chrono>
#include <exception>
#include <filesystem>
#include <fstream>
#include <iomanip>
#include <iostream>
#include <locale>
#include <random>
#include <string>

#ifdef JMALLOC_ON
#include <jemalloc/jemalloc.h>
#endif

#include "parser.h"
#include "simdjson.h"

Bibliotheken

user@host ~ $ ldd $(which mutt)
	linux-vdso.so.1 (0x00007fffe51cc000)
	libsqlite3.so.0 => /usr/lib/x86_64-linux-gnu/libsqlite3.so.0 (0x00007f4b99e6a000)
	libncursesw.so.6 => /lib/x86_64-linux-gnu/libncursesw.so.6 (0x00007f4b99e2f000)
	libtinfo.so.6 => /lib/x86_64-linux-gnu/libtinfo.so.6 (0x00007f4b99e00000)
	libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f4b99de3000)
	libssl.so.1.1 => /usr/lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007f4b99d50000)
	libcrypto.so.1.1 => /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007f4b99a00000)
	libkyotocabinet.so.16 => /usr/lib/x86_64-linux-gnu/libkyotocabinet.so.16 (0x00007f4b99600000)
	libidn.so.11 => /lib/x86_64-linux-gnu/libidn.so.11 (0x00007f4b99d19000)
	libgpgme.so.11 => /usr/lib/x86_64-linux-gnu/libgpgme.so.11 (0x00007f4b999af000)
	libassuan.so.0 => /usr/lib/x86_64-linux-gnu/libassuan.so.0 (0x00007f4b99d03000)
	libgpg-error.so.0 => /lib/x86_64-linux-gnu/libgpg-error.so.0 (0x00007f4b99989000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f4b9942b000)
	libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f4b992e7000)
	libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f4b99967000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f4b99cfb000)
	liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007f4b9993f000)
	liblzo2.so.2 => /lib/x86_64-linux-gnu/liblzo2.so.2 (0x00007f4b9991a000)
	libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007f4b9911a000)
	libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f4b99900000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f4b9a16400
user@host ~ $

Container

Applikationsumgebung

Applikationsumgebung

  • Komponenten versionsabhängig
  • verschiedene Programmiersprachen
  • unterschiedliche Quellen (Pakete, Manager, Skripte)
  • Schnittstellen zu anderen Systemen
  • Teile lassen sich zusammenstellen (Build Systeme)
  • Wie stellt man diese Informationen zur Verfügung?

Software Bill of Materials

  • Oberbegriff Software Bill of Materials (SBOM)
  • Manifest analog zu Produktion oder Fracht
  • Format unterschiedlich (prinzipiell eine Aufzählung)
  • SBOM ist pro Version oder Umgebung notwendig
    • sollte Teil von Build Prozess sein
    • muss archiviert werden

SBOM Formate

  • Software Package Data Exchange (SPDX) (seit 2011)
    • Key/Value, JSON, XML, RDF, Microsoft® Excel
    • Linux Foundation Projekt
    • standardisiert als ISO/IEC 5962:2021
  • OWASP CycloneDX (seit 2017)
    • JSON, XML, Protocol Buffers Schema
    • OWASP Foundation Projekt
    • Software, Software-as-a-Service, Hardware, Operations
    • Vulnerability Management
  • Software Identification (SWID) Tags
    • standardisiert als ISO/IEC 19770-2:2015
    • geeignet für Software Lifecycle Management

SPDX Beispiel

                
SPDXVersion: SPDX-2.2
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: hello
DocumentNamespace: https://swinslow.net/spdx-examples/example1/hello-v3
Creator: Person: Steve Winslow (steve@swinslow.net)
Creator: Tool: github.com/spdx/tools-golang/builder
Creator: Tool: github.com/spdx/tools-golang/idsearcher
Created: 2021-08-26T01:46:00Z

##### Package: hello

PackageName: hello
SPDXID: SPDXRef-Package-hello
PackageDownloadLocation: git+https://github.com/swinslow/spdx-examples.git#example1/content
FilesAnalyzed: true
PackageVerificationCode: 9d20237bb72087e87069f96afb41c6ca2fa2a342
PackageLicenseConcluded: GPL-3.0-or-later
PackageLicenseInfoFromFiles: GPL-3.0-or-later
PackageLicenseDeclared: GPL-3.0-or-later
PackageCopyrightText: NOASSERTION

Relationship: SPDXRef-DOCUMENT DESCRIBES SPDXRef-Package-hello

FileName: /build/hello
SPDXID: SPDXRef-hello-binary
FileType: BINARY
FileChecksum: SHA1: 20291a81ef065ff891b537b64d4fdccaf6f5ac02
FileChecksum: SHA256: 83a33ff09648bb5fc5272baca88cf2b59fd81ac4cc6817b86998136af368708e
FileChecksum: MD5: 08a12c966d776864cc1eb41fd03c3c3d
LicenseConcluded: GPL-3.0-or-later
LicenseInfoInFile: NOASSERTION
FileCopyrightText: NOASSERTION

FileName: /src/Makefile
SPDXID: SPDXRef-Makefile
FileType: SOURCE
FileChecksum: SHA1: 69a2e85696fff1865c3f0686d6c3824b59915c80
FileChecksum: SHA256: 5da19033ba058e322e21c90e6d6d859c90b1b544e7840859c12cae5da005e79c
FileChecksum: MD5: 559424589a4f3f75fd542810473d8bc1
LicenseConcluded: GPL-3.0-or-later
LicenseInfoInFile: GPL-3.0-or-later
FileCopyrightText: NOASSERTION

FileName: /src/hello.c
SPDXID: SPDXRef-hello-src
FileType: SOURCE
FileChecksum: SHA1: 20862a6d08391d07d09344029533ec644fac6b21
FileChecksum: SHA256: b4e5ca56d1f9110ca94ed0bf4e6d9ac11c2186eb7cd95159c6fdb50e8db5a823
FileChecksum: MD5: 935054fe899ca782e11003bbae5e166c
LicenseConcluded: GPL-3.0-or-later
LicenseInfoInFile: GPL-3.0-or-later
FileCopyrightText: Copyright Contributors to the spdx-examples project.

Relationship: SPDXRef-hello-binary GENERATED_FROM SPDXRef-hello-src
Relationship: SPDXRef-hello-binary GENERATED_FROM SPDXRef-Makefile
Relationship: SPDXRef-Makefile BUILD_TOOL_OF SPDXRef-Package-hello

CycloneDX Beispiel

                
<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.2" serialNumber="urn:uuid:74e6d3e0-8df7-4717-a567-3c9046fa719c" version="1">
  <metadata>
    <timestamp>2021-05-16T17:10:00+02:00</timestamp>
    <tools>
      <tool>
        <vendor>CycloneDX</vendor>
        <name>cyclonedx-gomod</name>
        <version>v0.6.1</version>
        <hashes>
          <hash alg="MD5">a92d9f6145a94c2c7ad8489d84301eb9</hash>
          <hash alg="SHA-1">a5af6c5ef3f21bf5425c680b64acf57cc6a90c69</hash>
          <hash alg="SHA-256">dc215a651772356eca763d6fe77169379c1cc25c2bb89c7d6df2e2170c3972ab</hash>
          <hash alg="SHA-512">387953ab509c31bf352693de9df617650c87494e607119bc284b91ba9a0a2d284a2e96946c272dc284c4370875412eea855bc30351faedd099dbdbed209e4636</hash>
        </hashes>
      </tool>
    </tools>
    <component bom-ref="pkg:golang/github.com/ProtonMail/proton-bridge@v1.8.0" type="application">
      <name>github.com/ProtonMail/proton-bridge</name>
      <version>v1.8.0</version>
      <purl>pkg:golang/github.com/ProtonMail/proton-bridge@v1.8.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/proton-bridge</url>
        </reference>
      </externalReferences>
    </component>
  </metadata>
  <components>
    <component bom-ref="pkg:golang/github.com/0xAX/notificator@v0.0.0-20191016112426-3962a5ea8da1" type="library">
      <name>github.com/0xAX/notificator</name>
      <version>v0.0.0-20191016112426-3962a5ea8da1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">8fd1da69f6a90db3db1910e4bba7bf1d1b3a28131c287896726d7ff526f19e5e</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/0xAX/notificator@v0.0.0-20191016112426-3962a5ea8da1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/0xAX/notificator</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/AndreasBriese/bbloom@v0.0.0-20190306092124-e2d15f34fcf9" type="library">
      <name>github.com/AndreasBriese/bbloom</name>
      <version>v0.0.0-20190306092124-e2d15f34fcf9</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1c3f20036b6407284c03061a1405fdc3697bbf1bc143934ca310eb921aa1b67e</hash>
      </hashes>
      <licenses>
        <license>
          <id>CC0-1.0</id>
          <url>https://spdx.org/licenses/CC0-1.0.html</url>
        </license>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/AndreasBriese/bbloom@v0.0.0-20190306092124-e2d15f34fcf9</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/AndreasBriese/bbloom</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/BurntSushi/toml@v0.3.1" type="library">
      <name>github.com/BurntSushi/toml</name>
      <version>v0.3.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">597918625e98af7a817f52bbf440672f899a9343a29817c1d1751ff55976f0e4</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/BurntSushi/toml@v0.3.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/BurntSushi/toml</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/BurntSushi/xgb@v0.0.0-20160522181843-27f122750802" type="library">
      <name>github.com/BurntSushi/xgb</name>
      <version>v0.0.0-20160522181843-27f122750802</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">d410d3cf4bbd9c2dfffe938231d347f828972556098795103423811bb8db10b7</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
        <license>
          <name>GooglePatentClause</name>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/BurntSushi/xgb@v0.0.0-20160522181843-27f122750802</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/BurntSushi/xgb</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/CloudyKit/fastprinter@v0.0.0-20200109182630-33d98a066a53" type="library">
      <name>github.com/CloudyKit/fastprinter</name>
      <version>v0.0.0-20200109182630-33d98a066a53</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b11fbff186f8b25b6d078bc3f9bf5bb551275a02f7434d0e053cd54fc07d0b47</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/CloudyKit/fastprinter@v0.0.0-20200109182630-33d98a066a53</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/CloudyKit/fastprinter</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/CloudyKit/jet/v3@v3.0.0" type="library">
      <name>github.com/CloudyKit/jet/v3</name>
      <version>v3.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">d4fc0ee70e550ad954525f8a4ce06c4c66658635a47326ec19a01abb9dad3b2f</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/CloudyKit/jet/v3@v3.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/CloudyKit/jet/v3</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/Joker/hpp@v1.0.0" type="library">
      <name>github.com/Joker/hpp</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">eb9fa2b8961d457bff5f237ad82d6e12698ec77e37dab346feb2a55fa57b2a47</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/Joker/hpp@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/Joker/hpp</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/Masterminds/semver/v3@v3.1.0" type="library">
      <name>github.com/Masterminds/semver/v3</name>
      <version>v3.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">6369540ec14a5514981a88cb275c8bc525dd3263184d896cd2b0afa2a98c5109</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/Masterminds/semver/v3@v3.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/Masterminds/semver/v3</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/go-autostart@v0.0.0-20181114175602-c5272053443a" type="library">
      <name>github.com/ProtonMail/go-autostart</name>
      <version>v0.0.0-20181114175602-c5272053443a</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">7d72b62ac7e790157d361fbd48acc7721623b84f6cd2f236d091b599bb4401c7</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ProtonMail/go-autostart@v0.0.0-20181114175602-c5272053443a</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/go-autostart</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/go-crypto@v0.0.0-20201208171014-cdb7591792e2" type="library">
      <name>github.com/ProtonMail/go-crypto</name>
      <version>v0.0.0-20201208171014-cdb7591792e2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">a509232442c76b25b9f63a7baf81b90e59a789caf931c7a30dfc2c8dcc08d525</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ProtonMail/go-crypto@v0.0.0-20201208171014-cdb7591792e2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/go-crypto</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/go-imap-id@v0.0.0-20190926060100-f94a56b9ecde" type="library">
      <name>github.com/ProtonMail/go-imap-id</name>
      <version>v0.0.0-20190926060100-f94a56b9ecde</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e64a10a334c310bca660ec856d0fd54ae6dec40117cc347ca8633998ef0645dc</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ProtonMail/go-imap-id@v0.0.0-20190926060100-f94a56b9ecde</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/go-imap-id</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/go-mime@v0.0.0-20190923161245-9b5a4261663a" type="library">
      <name>github.com/ProtonMail/go-mime</name>
      <version>v0.0.0-20190923161245-9b5a4261663a</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">5ba46b80dfec4f18359acab31456fe1bcd0c166a63330eb5214fac966fb0967e</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ProtonMail/go-mime@v0.0.0-20190923161245-9b5a4261663a</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/go-mime</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/go-rfc5322@v0.5.0" type="library">
      <name>github.com/ProtonMail/go-rfc5322</name>
      <version>v0.5.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">2db2968e07efba66190abf01806c93524dc44c69052c08d0764b9252967909c1</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ProtonMail/go-rfc5322@v0.5.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/go-rfc5322</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/go-vcard@v0.0.0-20180326232728-33aaa0a0c8a5" type="library">
      <name>github.com/ProtonMail/go-vcard</name>
      <version>v0.0.0-20180326232728-33aaa0a0c8a5</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">5206b50c714de06531b8342bd05ef5b698bc23d1ea3c8959a1d640235951e954</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ProtonMail/go-vcard@v0.0.0-20180326232728-33aaa0a0c8a5</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/go-vcard</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/gopenpgp/v2@v2.1.3" type="library">
      <name>github.com/ProtonMail/gopenpgp/v2</name>
      <version>v2.1.3</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e3e9c50c9f56b5c5104e2a7f8ded8b9773f6d57840525e1ab16b1a7cbaf0f7b7</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ProtonMail/gopenpgp/v2@v2.1.3</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/gopenpgp/v2</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/PuerkitoBio/goquery@v1.5.1" type="library">
      <name>github.com/PuerkitoBio/goquery</name>
      <version>v1.5.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">3d23c11a77bc348516c3effbbc5055fa41b627fe4c3a36f373bd79e0e68a0921</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/PuerkitoBio/goquery@v1.5.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/PuerkitoBio/goquery</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/Shopify/goreferrer@v0.0.0-20181106222321-ec9c9a553398" type="library">
      <name>github.com/Shopify/goreferrer</name>
      <version>v0.0.0-20181106222321-ec9c9a553398</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">5830bac92a49cdbc4658587868cc45142dbcc301a9e6912ea13b6f038abfa90e</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/Shopify/goreferrer@v0.0.0-20181106222321-ec9c9a553398</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/Shopify/goreferrer</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/abiosoft/ishell@v2.0.0" type="library">
      <name>github.com/abiosoft/ishell</name>
      <version>v2.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">8d07f1eba8739e5600b70cc656d8505a7d052643c1f03240f3d56c500f47b876</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/abiosoft/ishell@v2.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/abiosoft/ishell</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/abiosoft/readline@v0.0.0-20180607040430-155bce2042db" type="library">
      <name>github.com/abiosoft/readline</name>
      <version>v0.0.0-20180607040430-155bce2042db</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">0a33d44973a2629b4b6d376bd5171eb9981214343b535e484c44541ab50e471f</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/abiosoft/readline@v0.0.0-20180607040430-155bce2042db</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/abiosoft/readline</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ajg/form@v1.5.1" type="library">
      <name>github.com/ajg/form</name>
      <version>v1.5.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b7d73bbfc2542aefd7c4e181534ca336968c968c4610985492a151ab489b19e5</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ajg/form@v1.5.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ajg/form</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/allan-simon/go-singleinstance@v0.0.0-20160830203053-79edcfdc2dfc" type="library">
      <name>github.com/allan-simon/go-singleinstance</name>
      <version>v0.0.0-20160830203053-79edcfdc2dfc</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">99971ad3f1d9fd75973fdb7191f765d861fa994cc1a80972273deee4b83c7ee0</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/allan-simon/go-singleinstance@v0.0.0-20160830203053-79edcfdc2dfc</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/allan-simon/go-singleinstance</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/andybalholm/cascadia@v1.1.0" type="library">
      <name>github.com/andybalholm/cascadia</name>
      <version>v1.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">06eb8eeac49f40d151bb52e9a606c3db91ebdaf2d85b6e49bf11ece73cec2d3a</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/andybalholm/cascadia@v1.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/andybalholm/cascadia</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/antlr/antlr4@v0.0.0-20201029161626-9a95f0cc3d7c" type="library">
      <name>github.com/antlr/antlr4</name>
      <version>v0.0.0-20201029161626-9a95f0cc3d7c</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">8ff0b69313dfc84d1df3bfe08008c8b0257909d92a9a36fe3b45bc5bed49f886</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/antlr/antlr4@v0.0.0-20201029161626-9a95f0cc3d7c</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/antlr/antlr4</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/armon/consul-api@v0.0.0-20180202201655-eb2c6b5be1b6" type="library">
      <name>github.com/armon/consul-api</name>
      <version>v0.0.0-20180202201655-eb2c6b5be1b6</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1b56cfbdc8b037217b21498a5cdb7d024de6eaef43135ac5f919ad22406955d0</hash>
      </hashes>
      <licenses>
        <license>
          <id>MPL-2.0</id>
          <url>https://spdx.org/licenses/MPL-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/armon/consul-api@v0.0.0-20180202201655-eb2c6b5be1b6</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/armon/consul-api</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/aymerick/raymond@v2.0.3-0.20180322193309-b565731e1464" type="library">
      <name>github.com/aymerick/raymond</name>
      <version>v2.0.3-0.20180322193309-b565731e1464</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">901a7783930a0426984323b3db44d35643a9cadacc01a92f2fb43fcf530b35cf</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/aymerick/raymond@v2.0.3-0.20180322193309-b565731e1464</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/aymerick/raymond</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/chzyer/logex@v1.1.10" type="library">
      <name>github.com/chzyer/logex</name>
      <version>v1.1.10</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">4b0a5ad4ae90bd0ce7c0945c7d37d02664c4ef60ea49c01ae3413e7db1c45c41</hash>
      </hashes>
      <purl>pkg:golang/github.com/chzyer/logex@v1.1.10</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/chzyer/logex</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/chzyer/test@v0.0.0-20180213035817-a1ea475d72b1" type="library">
      <name>github.com/chzyer/test</name>
      <version>v0.0.0-20180213035817-a1ea475d72b1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">abbeb7a9ff61b8dd7590341abd6b2865724d5b7c44138249c876b9436e7fb1df</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/chzyer/test@v0.0.0-20180213035817-a1ea475d72b1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/chzyer/test</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/codegangsta/inject@v0.0.0-20150114235600-33e0aa1cb7c0" type="library">
      <name>github.com/codegangsta/inject</name>
      <version>v0.0.0-20150114235600-33e0aa1cb7c0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b033269beabfdfe06e91d229c703b7eb9bff45bb29a7636de579ed810457abc4</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/codegangsta/inject@v0.0.0-20150114235600-33e0aa1cb7c0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/codegangsta/inject</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/coreos/etcd@v3.3.10" type="library">
      <name>github.com/coreos/etcd</name>
      <version>v3.3.10</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">a1d778f324614e5305c1bc3b560cea519671ae74a7f543baf8f691436c8a04d6</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/coreos/etcd@v3.3.10</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/coreos/etcd</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/coreos/go-etcd@v2.0.0" type="library">
      <name>github.com/coreos/go-etcd</name>
      <version>v2.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">59a79e10ff2bd1332fc3a102b612acc787b325fc00354abbba215db513c291c5</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/coreos/go-etcd@v2.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/coreos/go-etcd</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/coreos/go-semver@v0.2.0" type="library">
      <name>github.com/coreos/go-semver</name>
      <version>v0.2.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">dc99b7b4b9ac80061c8c2fb8529ee126b1413ebfa7eeb02a61e4b0fd265acee6</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/coreos/go-semver@v0.2.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/coreos/go-semver</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/cpuguy83/go-md2man@v1.0.10" type="library">
      <name>github.com/cpuguy83/go-md2man</name>
      <version>v1.0.10</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">05228c3656310ef9ee9e54f29aab6038d8cd9da455d6c4e9728bf0c23176da39</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/cpuguy83/go-md2man@v1.0.10</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/cpuguy83/go-md2man</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.0-20190314233015-f79a8a8ca69d" type="library">
      <name>github.com/cpuguy83/go-md2man/v2</name>
      <version>v2.0.0-20190314233015-f79a8a8ca69d</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">53eb3dd144d2620a6d64cc10876691af72ee6b32c921af8f83729cd729526156</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.0-20190314233015-f79a8a8ca69d</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/cpuguy83/go-md2man/v2</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/creack/pty@v1.1.9" type="library">
      <name>github.com/creack/pty</name>
      <version>v1.1.9</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b8399a1b371d8e11788bfa65823984b2b887d75634a3b44a6a911ffcb0da337c</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/creack/pty@v1.1.9</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/creack/pty</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/cucumber/godog@v0.8.1" type="library">
      <name>github.com/cucumber/godog</name>
      <version>v0.8.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">9556fe5f8d48e180eb784fa26d9e746dd5e6c92c6046f898160298e80c385c4f</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/cucumber/godog@v0.8.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/cucumber/godog</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/danieljoos/wincred@v1.1.0" type="library">
      <name>github.com/danieljoos/wincred</name>
      <version>v1.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">dd135c129060e088480a165d15149d950b754230a9d6c3003c8ace9e6ed87fc8</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/danieljoos/wincred@v1.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/danieljoos/wincred</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/davecgh/go-spew@v1.1.1" type="library">
      <name>github.com/davecgh/go-spew</name>
      <version>v1.1.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">be3f63feed5baa7bc211f24ec1486d94e011aacdfeae41d8635de36164d4f7b7</hash>
      </hashes>
      <licenses>
        <license>
          <id>ISC</id>
          <url>https://spdx.org/licenses/ISC.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/davecgh/go-spew@v1.1.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/davecgh/go-spew</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/dgraph-io/badger@v1.6.0" type="library">
      <name>github.com/dgraph-io/badger</name>
      <version>v1.6.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">0ec8711716565d470ed315f8efa5490b4ed7b2be990815511ca67ddce87b12fa</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/dgraph-io/badger@v1.6.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/dgraph-io/badger</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/dgrijalva/jwt-go@v3.2.0" type="library">
      <name>github.com/dgrijalva/jwt-go</name>
      <version>v3.2.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">d2b9d7df363078b7430fbcdb250dd4d9ee4e0d47558a64736ba797e38e8829dc</hash>
      </hashes>
      <purl>pkg:golang/github.com/dgrijalva/jwt-go@v3.2.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/dgrijalva/jwt-go</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/dgryski/go-farm@v0.0.0-20190423205320-6a90982ecee2" type="library">
      <name>github.com/dgryski/go-farm</name>
      <version>v0.0.0-20190423205320-6a90982ecee2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b5d9590a967f3fd0e17330934a2c6020a9b03efebec0fe431a3a8b630e525220</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/dgryski/go-farm@v0.0.0-20190423205320-6a90982ecee2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/dgryski/go-farm</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/docker-credential-helpers@v1.1.0" type="library">
      <name>github.com/ProtonMail/docker-credential-helpers</name>
      <version>v1.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">fa4bd4229c1671bb4fdd616fe6c4af9059ff5cbcd2a8f381e4002d86e93dc4f9</hash>
      </hashes>
      <purl>pkg:golang/github.com/ProtonMail/docker-credential-helpers@v1.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/docker-credential-helpers</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/dustin/go-humanize@v1.0.0" type="library">
      <name>github.com/dustin/go-humanize</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">5529d3b180a79451da336fe280ed61e97dc703bd637286d0bb17a6824ab8cd8a</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/dustin/go-humanize@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/dustin/go-humanize</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/eknkc/amber@v0.0.0-20171010120322-cdade1c07385" type="library">
      <name>github.com/eknkc/amber</name>
      <version>v0.0.0-20171010120322-cdade1c07385</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">7250b59570697b69138f654775a22ef5a8d941ee2470463d8f436c9c30c1677a</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/eknkc/amber@v0.0.0-20171010120322-cdade1c07385</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/eknkc/amber</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/go-imap@v0.0.0-20201228133358-4db68cea0cac" type="library">
      <name>github.com/ProtonMail/go-imap</name>
      <version>v0.0.0-20201228133358-4db68cea0cac</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">db1537427700892fd6dd495665391b34a5b95a42f393a1209754f4c57fac6e3b</hash>
      </hashes>
      <purl>pkg:golang/github.com/ProtonMail/go-imap@v0.0.0-20201228133358-4db68cea0cac</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/go-imap</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-imap-appendlimit@v0.0.0-20190308131241-25671c986a6a" type="library">
      <name>github.com/emersion/go-imap-appendlimit</name>
      <version>v0.0.0-20190308131241-25671c986a6a</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">6cc7523e6eacb2cb8e16921abdebb75c60228cc4b74ead92dc4a8566667189d7</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-imap-appendlimit@v0.0.0-20190308131241-25671c986a6a</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-imap-appendlimit</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-imap-idle@v0.0.0-20200601154248-f05f54664cc4" type="library">
      <name>github.com/emersion/go-imap-idle</name>
      <version>v0.0.0-20200601154248-f05f54664cc4</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">fc92002f398276e7f9a3c4d625288e0734dbf7e47448287012552b24b969da9a</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-imap-idle@v0.0.0-20200601154248-f05f54664cc4</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-imap-idle</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-imap-move@v0.0.0-20190710073258-6e5a51a5b342" type="library">
      <name>github.com/emersion/go-imap-move</name>
      <version>v0.0.0-20190710073258-6e5a51a5b342</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e69d6ddded4fa266202d6c04c21c0453991507073201c56b3a97b1bfc01e671d</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-imap-move@v0.0.0-20190710073258-6e5a51a5b342</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-imap-move</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-imap-quota@v0.0.0-20210203125329-619074823f3c" type="library">
      <name>github.com/emersion/go-imap-quota</name>
      <version>v0.0.0-20210203125329-619074823f3c</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">92170476ed721626630608bb8069d088b8694a08212746139ca0f4978114aaa7</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-imap-quota@v0.0.0-20210203125329-619074823f3c</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-imap-quota</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-imap-unselect@v0.0.0-20171113212723-b985794e5f26" type="library">
      <name>github.com/emersion/go-imap-unselect</name>
      <version>v0.0.0-20171113212723-b985794e5f26</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">16249bf3e5c14104a4717dee6ebfb5b40b6544905868599166a380c1e67d5b2f</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-imap-unselect@v0.0.0-20171113212723-b985794e5f26</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-imap-unselect</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-mbox@v1.0.2" type="library">
      <name>github.com/emersion/go-mbox</name>
      <version>v1.0.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b44feb4fe944ba02bdcb49b21329820879f0959374e219573eb6ca9314410392</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-mbox@v1.0.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-mbox</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-message@v0.12.1-0.20201221184100-40c3f864532b" type="library">
      <name>github.com/emersion/go-message</name>
      <version>v0.12.1-0.20201221184100-40c3f864532b</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">c58ba15ba7a04da08ffb38db51c7e8cbf0ebdc049d54f47d5bb7e6907bd91cf1</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-message@v0.12.1-0.20201221184100-40c3f864532b</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-message</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-sasl@v0.0.0-20200509203442-7bfe0ed36a21" type="library">
      <name>github.com/emersion/go-sasl</name>
      <version>v0.0.0-20200509203442-7bfe0ed36a21</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">389c9418c253cc74ddd57429f7c4136877ab9f1318cd168e6ac462afd8549454</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-sasl@v0.0.0-20200509203442-7bfe0ed36a21</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-sasl</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-smtp@v0.14.0" type="library">
      <name>github.com/emersion/go-smtp</name>
      <version>v0.14.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">4585b6d37a7e11c3e32fc67f6694fd959ea239cf0c1b5310cc4c7550a1245e50</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-smtp@v0.14.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-smtp</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-textwrapper@v0.0.0-20200911093747-65d896831594" type="library">
      <name>github.com/emersion/go-textwrapper</name>
      <version>v0.0.0-20200911093747-65d896831594</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">21b141b70a13432c347c8339c6fd4717e63edd98a30d1f37f5632e960c427146</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-textwrapper@v0.0.0-20200911093747-65d896831594</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-textwrapper</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/emersion/go-vcard@v0.0.0-20190105225839-8856043f13c5" type="library">
      <name>github.com/emersion/go-vcard</name>
      <version>v0.0.0-20190105225839-8856043f13c5</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">9fdab1f7cc624b9578c76588a4f0b6aebf6650ce6b8bdaff62108429b8421eba</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/emersion/go-vcard@v0.0.0-20190105225839-8856043f13c5</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/emersion/go-vcard</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/etcd-io/bbolt@v1.3.3" type="library">
      <name>github.com/etcd-io/bbolt</name>
      <version>v1.3.3</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">812266c6bb37ecb813a91fe8c89056a24ea4e92bd71147ab1536e5b488579013</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/etcd-io/bbolt@v1.3.3</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/etcd-io/bbolt</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/fasthttp-contrib/websocket@v0.0.0-20160511215533-1f3b11f56072" type="library">
      <name>github.com/fasthttp-contrib/websocket</name>
      <version>v0.0.0-20160511215533-1f3b11f56072</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">0dd76a01a583a72c32b5c1bcc3faa8439b0037c5f5d9ddd9de4a01d02dd1c6c7</hash>
      </hashes>
      <purl>pkg:golang/github.com/fasthttp-contrib/websocket@v0.0.0-20160511215533-1f3b11f56072</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/fasthttp-contrib/websocket</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/fatih/color@v1.9.0" type="library">
      <name>github.com/fatih/color</name>
      <version>v1.9.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">f313c7978fead55caa1883e27f517ed55dd8de54a6aead3511a6d45b70a85b9b</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/fatih/color@v1.9.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/fatih/color</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/fatih/structs@v1.1.0" type="library">
      <name>github.com/fatih/structs</name>
      <version>v1.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">43b8ee0ccd10b5c9e10a97b22c640aca0e13388821b8d5eb90bdf6a47014331a</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/fatih/structs@v1.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/fatih/structs</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/flynn-archive/go-shlex@v0.0.0-20150515145356-3f9db97f8568" type="library">
      <name>github.com/flynn-archive/go-shlex</name>
      <version>v0.0.0-20150515145356-3f9db97f8568</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">04c5d86115932ce24a961fa5381b7a9d44205c07c1ee854842de5c36b7aa48b2</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/flynn-archive/go-shlex@v0.0.0-20150515145356-3f9db97f8568</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/flynn-archive/go-shlex</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/fsnotify/fsnotify@v1.4.7" type="library">
      <name>github.com/fsnotify/fsnotify</name>
      <version>v1.4.7</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">217b3e40b9a75d6d82717b98fbc333bff7d612c3c65b1a9e7cfb423f90a757d2</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/fsnotify/fsnotify@v1.4.7</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/fsnotify/fsnotify</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/gavv/httpexpect@v2.0.0" type="library">
      <name>github.com/gavv/httpexpect</name>
      <version>v2.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">d5a4f508239e746148054abbe0bc6698ac1c20fe4b3a3573988749e29b213db8</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/gavv/httpexpect@v2.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/gavv/httpexpect</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/getsentry/sentry-go@v0.8.0" type="library">
      <name>github.com/getsentry/sentry-go</name>
      <version>v0.8.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">179d9c8c154bba24df756ea9e0916ec65b77a4e8ca7d6613fda91aedc749eefd</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/getsentry/sentry-go@v0.8.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/getsentry/sentry-go</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/gin-contrib/sse@v0.0.0-20190301062529-5545eab6dad3" type="library">
      <name>github.com/gin-contrib/sse</name>
      <version>v0.0.0-20190301062529-5545eab6dad3</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b7c155930df72fec2295fd90896930d1457beea469707fc91cf286a4a6b613c8</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/gin-contrib/sse@v0.0.0-20190301062529-5545eab6dad3</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/gin-contrib/sse</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/gin-gonic/gin@v1.4.0" type="library">
      <name>github.com/gin-gonic/gin</name>
      <version>v1.4.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">ded3280827ccee9a6ab11d29b73ff08b58a6a4da53efff7042d319f25af59824</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/gin-gonic/gin@v1.4.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/gin-gonic/gin</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/go-check/check@v0.0.0-20180628173108-788fd7840127" type="library">
      <name>github.com/go-check/check</name>
      <version>v0.0.0-20180628173108-788fd7840127</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">d2090fea6cda32a926a5c25808538b90807023bc451311b4ddb6e43a40af50f2</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/go-check/check@v0.0.0-20180628173108-788fd7840127</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-check/check</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/go-errors/errors@v1.0.1" type="library">
      <name>github.com/go-errors/errors</name>
      <version>v1.0.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">2d41f39a42b7194294acbff581f054c401f371ebf76a94257b35fff8eee66bac</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/go-errors/errors@v1.0.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-errors/errors</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/go-martini/martini@v0.0.0-20170121215854-22fa46961aab" type="library">
      <name>github.com/go-martini/martini</name>
      <version>v0.0.0-20170121215854-22fa46961aab</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">c6f78a5b3da26ae79e4da52075eb737a5f94edec728a00d806bcb255f57fad99</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/go-martini/martini@v0.0.0-20170121215854-22fa46961aab</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-martini/martini</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/go-resty/resty/v2@v2.6.0" type="library">
      <name>github.com/go-resty/resty/v2</name>
      <version>v2.6.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">8e8211e4f34b336105aaa11252308c197ad6997347114f421222bcd77a0a612e</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/go-resty/resty/v2@v2.6.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-resty/resty/v2</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/gobwas/httphead@v0.0.0-20180130184737-2c6c146eadee" type="library">
      <name>github.com/gobwas/httphead</name>
      <version>v0.0.0-20180130184737-2c6c146eadee</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b3edb528daa5a5e3df91a87623e8301c5f319895918e8a18fb9db8f24ea6e00d</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/gobwas/httphead@v0.0.0-20180130184737-2c6c146eadee</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/gobwas/httphead</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/gobwas/pool@v0.2.0" type="library">
      <name>github.com/gobwas/pool</name>
      <version>v0.2.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">4049943a59d28d6b67a5118717749ab8488eb32f360aea7cdd57f62dc3259dcf</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/gobwas/pool@v0.2.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/gobwas/pool</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/gobwas/ws@v1.0.2" type="library">
      <name>github.com/gobwas/ws</name>
      <version>v1.0.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">0a801abd6ff077f92e95f66648806dea9db89f88fbb4780d5428ec7c754d51ba</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/gobwas/ws@v1.0.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/gobwas/ws</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/golang/mock@v1.4.4" type="library">
      <name>github.com/golang/mock</name>
      <version>v1.4.4</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">97be425c6452c1b69836997f6765f55c82003120aabaf5e0a5564387010826c7</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/golang/mock@v1.4.4</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/golang/mock</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/golang/protobuf@v1.3.1" type="library">
      <name>github.com/golang/protobuf</name>
      <version>v1.3.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">605f3e7e50574b978ef36e93e27cea3ebc5f8504e18579746337ee50fbb84818</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/golang/protobuf@v1.3.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/golang/protobuf</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/gomodule/redigo@v1.7.1-0.20190724094224-574c33c3df38" type="library">
      <name>github.com/gomodule/redigo</name>
      <version>v1.7.1-0.20190724094224-574c33c3df38</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">cb45a686f9a5edc1a7ccf6bd9e8727fdf32b68c1ff94c0dd786fab931e158186</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/gomodule/redigo@v1.7.1-0.20190724094224-574c33c3df38</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/gomodule/redigo</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/google/go-cmp@v0.5.1" type="library">
      <name>github.com/google/go-cmp</name>
      <version>v0.5.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">245ac51016f6c4ab9f83a5e426c26bf966ca6f8150954462e5151c06f798bbd9</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/google/go-cmp@v0.5.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/google/go-cmp</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/google/go-querystring@v1.0.0" type="library">
      <name>github.com/google/go-querystring</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">5e4c22fdad6b72f360d4f3d87b9bc8f066de058fe3ad5b835f9012b803564eb9</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/google/go-querystring@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/google/go-querystring</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/google/gofuzz@v1.0.0" type="library">
      <name>github.com/google/gofuzz</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">03c3de5b9f69c44f48a0546a069dfb53e99235a428678e85d5fd1ff3add7497c</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/google/gofuzz@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/google/gofuzz</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/google/uuid@v1.1.1" type="library">
      <name>github.com/google/uuid</name>
      <version>v1.1.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1a46dcb21fc66e95f3ee53dfb4b0373fa4d83308c22d89bcde388541917fde06</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/google/uuid@v1.1.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/google/uuid</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/gopherjs/gopherjs@v0.0.0-20190430165422-3e4dfb77656c" type="library">
      <name>github.com/gopherjs/gopherjs</name>
      <version>v0.0.0-20190430165422-3e4dfb77656c</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">ee517e573d0baa2462767cc2d4eabce9fa57d6afe212fd8a25dac2b6db588d3e</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/gopherjs/gopherjs@v0.0.0-20190430165422-3e4dfb77656c</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/gopherjs/gopherjs</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/gorilla/websocket@v1.4.1" type="library">
      <name>github.com/gorilla/websocket</name>
      <version>v1.4.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">abb01e0c1a67064f00a20703e0349a83f524c3f295f988732e3d9b3f91ef2823</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/gorilla/websocket@v1.4.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/gorilla/websocket</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/hashicorp/errwrap@v1.0.0" type="library">
      <name>github.com/hashicorp/errwrap</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">84baeab440e74727b7fac831eb3e2a54b36ebe21f7311e5a434ca43496bf5180</hash>
      </hashes>
      <licenses>
        <license>
          <id>MPL-2.0</id>
          <url>https://spdx.org/licenses/MPL-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/hashicorp/errwrap@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/hashicorp/errwrap</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/hashicorp/go-multierror@v1.1.0" type="library">
      <name>github.com/hashicorp/go-multierror</name>
      <version>v1.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">07d533c064097a19d4635c8dae7c111077377c66c2db179fa3c8384db12569c2</hash>
      </hashes>
      <licenses>
        <license>
          <id>MPL-2.0</id>
          <url>https://spdx.org/licenses/MPL-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/hashicorp/go-multierror@v1.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/hashicorp/go-multierror</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/hashicorp/go-version@v1.2.0" type="library">
      <name>github.com/hashicorp/go-version</name>
      <version>v1.2.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">def35efdf585e4206044882e75ad6679686c647cb79bc802279c31f9d2335ff1</hash>
      </hashes>
      <licenses>
        <license>
          <id>MPL-2.0</id>
          <url>https://spdx.org/licenses/MPL-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/hashicorp/go-version@v1.2.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/hashicorp/go-version</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/hashicorp/hcl@v1.0.0" type="library">
      <name>github.com/hashicorp/hcl</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">d009e5ce3a62e2f11ab1378d167da62c98134b0b74fbab1fb224c6f2a7161b1e</hash>
      </hashes>
      <licenses>
        <license>
          <id>MPL-2.0</id>
          <url>https://spdx.org/licenses/MPL-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/hashicorp/hcl@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/hashicorp/hcl</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/hpcloud/tail@v1.0.0" type="library">
      <name>github.com/hpcloud/tail</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">9df08ebca61f92060ff21922ae12687174f6fb3383f3250d8d76967d397214a2</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/hpcloud/tail@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/hpcloud/tail</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/imkira/go-interpol@v1.1.0" type="library">
      <name>github.com/imkira/go-interpol</name>
      <version>v1.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">28888aaf45521b60945b5865d63a62caecee25e2945290bc88cd40204ecdd559</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/imkira/go-interpol@v1.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/imkira/go-interpol</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/inconshreveable/mousetrap@v1.0.0" type="library">
      <name>github.com/inconshreveable/mousetrap</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">67cb6ee6cada2d709721c011c41a7ff1c6ef97055aed9d4d1e0f5710a86d4af3</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/inconshreveable/mousetrap@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/inconshreveable/mousetrap</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/iris-contrib/blackfriday@v2.0.0" type="library">
      <name>github.com/iris-contrib/blackfriday</name>
      <version>v2.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">c5559ad5703151c00b9cbdf6a4f9ddf9523f0237c1fe0be6e7ba85a99b401409</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/iris-contrib/blackfriday@v2.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/iris-contrib/blackfriday</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/iris-contrib/go.uuid@v2.0.0" type="library">
      <name>github.com/iris-contrib/go.uuid</name>
      <version>v2.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">9db9571d236874d6904bc950503b1018e05b5e904a360fc8e7e299ed6de635d1</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/iris-contrib/go.uuid@v2.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/iris-contrib/go.uuid</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/iris-contrib/jade@v1.1.3" type="library">
      <name>github.com/iris-contrib/jade</name>
      <version>v1.1.3</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">a7b27fe74234723a34c2afd559508315df2d68f25bb850be6eadb74a7891157d</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/iris-contrib/jade@v1.1.3</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/iris-contrib/jade</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/iris-contrib/pongo2@v0.0.1" type="library">
      <name>github.com/iris-contrib/pongo2</name>
      <version>v0.0.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">cc63fba56e75a22e5e41930894603723e14763dfc739058307ee7bdb28a7d2da</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/iris-contrib/pongo2@v0.0.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/iris-contrib/pongo2</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/iris-contrib/schema@v0.0.1" type="library">
      <name>github.com/iris-contrib/schema</name>
      <version>v0.0.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">d7483f5a7a1147e53e5d71d62811de372ffeb5998cda47005462ceb33fb26830</hash>
      </hashes>
      <purl>pkg:golang/github.com/iris-contrib/schema@v0.0.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/iris-contrib/schema</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/bcrypt@v0.0.0-20170924085257-7509ea014998" type="library">
      <name>github.com/ProtonMail/bcrypt</name>
      <version>v0.0.0-20170924085257-7509ea014998</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">613dae57042245067109a69a8707dc813ab68f78faeb0d349ffdbb81bff3b9bb</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ProtonMail/bcrypt@v0.0.0-20170924085257-7509ea014998</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/bcrypt</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/jaytaylor/html2text@v0.0.0-20200412013138-3577fbdbcff7" type="library">
      <name>github.com/jaytaylor/html2text</name>
      <version>v0.0.0-20200412013138-3577fbdbcff7</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">8347c01818ac1da110d1346ad6206f7a61517fef0011612604449289607756c7</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/jaytaylor/html2text@v0.0.0-20200412013138-3577fbdbcff7</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/jaytaylor/html2text</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/json-iterator/go@v1.1.9" type="library">
      <name>github.com/json-iterator/go</name>
      <version>v1.1.9</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">f72cee77f1eddfaca0c1ab46c79e95c0266d948ff6003d794f55f6b234ae1a7b</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/json-iterator/go@v1.1.9</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/json-iterator/go</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/jtolds/gls@v4.20.0" type="library">
      <name>github.com/jtolds/gls</name>
      <version>v4.20.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">0d61bff8c2de500d8311984d8f3cce613ec6aa4e2b4ecc63d11948dd914bf59f</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/jtolds/gls@v4.20.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/jtolds/gls</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/k0kubun/colorstring@v0.0.0-20150214042306-9440f1994b88" type="library">
      <name>github.com/k0kubun/colorstring</name>
      <version>v0.0.0-20150214042306-9440f1994b88</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b82d507d29489e9405f8cd1aa3ae629a1c2a2a7cf7436cff77c3d6651310bc33</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/k0kubun/colorstring@v0.0.0-20150214042306-9440f1994b88</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/k0kubun/colorstring</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/kataras/golog@v0.0.10" type="library">
      <name>github.com/kataras/golog</name>
      <version>v0.0.10</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">bd10d1526c1a71ca3fa660409bc81e2e7f2b1c475cfbd678340af94a1ed31bfe</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/kataras/golog@v0.0.10</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/kataras/golog</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/kataras/iris/v12@v12.1.8" type="library">
      <name>github.com/kataras/iris/v12</name>
      <version>v12.1.8</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">3b78096ac8e6ed9c69c704c7f2d02966cbdfdbbe2c712190014a4d7b8edcdfb5</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/kataras/iris/v12@v12.1.8</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/kataras/iris/v12</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/kataras/neffos@v0.0.14" type="library">
      <name>github.com/kataras/neffos</name>
      <version>v0.0.14</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">a5d25a4ef506dcd41f78c6db54223c253d93e60a0f95dcb27d40763c97e1d41b</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/kataras/neffos@v0.0.14</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/kataras/neffos</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/kataras/pio@v0.0.2" type="library">
      <name>github.com/kataras/pio</name>
      <version>v0.0.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e8d022fae3c9fd9ba277a9ab00a960a5b235d7fccafe5578076af159a24df7c6</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/kataras/pio@v0.0.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/kataras/pio</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/kataras/sitemap@v0.0.5" type="library">
      <name>github.com/kataras/sitemap</name>
      <version>v0.0.5</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e0708e357e512e0572e86e11918395def28d7266bda76dfa2dd18e8a926c6851</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/kataras/sitemap@v0.0.5</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/kataras/sitemap</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/keybase/go-keychain@v0.0.0-20200502122510-cda31fe0c86d" type="library">
      <name>github.com/keybase/go-keychain</name>
      <version>v0.0.0-20200502122510-cda31fe0c86d</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">8158e10427d51a5df6448068a0e00dcdfc3ed14a97f0753ec8f94cbfcbf2a5c8</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/keybase/go-keychain@v0.0.0-20200502122510-cda31fe0c86d</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/keybase/go-keychain</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/keybase/go.dbus@v0.0.0-20200324223359-a94be52c0b03" type="library">
      <name>github.com/keybase/go.dbus</name>
      <version>v0.0.0-20200324223359-a94be52c0b03</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">93dac2aae702b0fa4128387d803c24dd4e3a4dc35dee3a4a6a179df491880866</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/keybase/go.dbus@v0.0.0-20200324223359-a94be52c0b03</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/keybase/go.dbus</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/klauspost/compress@v1.9.7" type="library">
      <name>github.com/klauspost/compress</name>
      <version>v1.9.7</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">8585b580ff78254980841b49f8b373e4ccbe801a1b0f13d1d6256e2ae836e9a0</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/klauspost/compress@v1.9.7</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/klauspost/compress</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/klauspost/cpuid@v1.2.1" type="library">
      <name>github.com/klauspost/cpuid</name>
      <version>v1.2.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">bc98be3bf9cc745b74bea9bc359048eb0cc02d6740d97f9e822d2880dcab0bfc</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/klauspost/cpuid@v1.2.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/klauspost/cpuid</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/konsorten/go-windows-terminal-sequences@v1.0.2" type="library">
      <name>github.com/konsorten/go-windows-terminal-sequences</name>
      <version>v1.0.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">0c1d7b6a0d7d92bc7d085b33e28dde9d3acf5f22170a5fb68825c7fda300a7db</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/konsorten/go-windows-terminal-sequences@v1.0.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/konsorten/go-windows-terminal-sequences</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/kr/pretty@v0.1.0" type="library">
      <name>github.com/kr/pretty</name>
      <version>v0.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">2ff0b0374cdead90e644551aa523e2b64e9ff90dfed336b5ad093356e3223052</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/kr/pretty@v0.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/kr/pretty</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/kr/pty@v1.1.1" type="library">
      <name>github.com/kr/pty</name>
      <version>v1.1.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">564a1723049ba01a6793df4efca15ab801082ee347bf90d514a64c04dfe0520c</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/kr/pty@v1.1.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/kr/pty</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/kr/text@v0.2.0" type="library">
      <name>github.com/kr/text</name>
      <version>v0.2.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e4dc7461ad19a98db2815dfae90cedbab1c8d7726af79029715689061a52f806</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/kr/text@v0.2.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/kr/text</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/labstack/echo/v4@v4.1.11" type="library">
      <name>github.com/labstack/echo/v4</name>
      <version>v4.1.11</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">cf4059a00ad8e05a9da54125fb0947a78867affa1247a3139909aff0e1d2a30c</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/labstack/echo/v4@v4.1.11</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/labstack/echo/v4</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/labstack/gommon@v0.3.0" type="library">
      <name>github.com/labstack/gommon</name>
      <version>v0.3.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">24478ed1bbdcefc3ca7721f19684ca885f010f9886ac7f13e8c49e1af4a0a1bd</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/labstack/gommon@v0.3.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/labstack/gommon</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/logrusorgru/aurora@v2.0.3" type="library">
      <name>github.com/logrusorgru/aurora</name>
      <version>v2.0.3</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">2dff73b09ee12bc6bd7e6adc7f970c0337de1439857bdb82bb555526f0382c32</hash>
      </hashes>
      <licenses>
        <license>
          <id>Unlicense</id>
          <url>https://spdx.org/licenses/Unlicense.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/logrusorgru/aurora@v2.0.3</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/logrusorgru/aurora</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/magiconair/properties@v1.8.0" type="library">
      <name>github.com/magiconair/properties</name>
      <version>v1.8.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">2cb8179ac85e5de46850e04e8edc0f40258862a33f2d4d5ac83b4378f7ab45c6</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/magiconair/properties@v1.8.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/magiconair/properties</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/martinlindhe/base36@v1.1.0" type="library">
      <name>github.com/martinlindhe/base36</name>
      <version>v1.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">708c2fbf062c7bfd3ed429143d81f966f548606dc9ac82e640421b2ee6abd366</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/martinlindhe/base36@v1.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/martinlindhe/base36</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/mattn/go-colorable@v0.1.4" type="library">
      <name>github.com/mattn/go-colorable</name>
      <version>v0.1.4</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b276cf2c1f1f55f53d8b06dba37d133ed6cb473c16bba6894ba5e1e1e69abe20</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/mattn/go-colorable@v0.1.4</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/mattn/go-colorable</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/mattn/go-isatty@v0.0.11" type="library">
      <name>github.com/mattn/go-isatty</name>
      <version>v0.0.11</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1713ce4c536a1a4b835068b71ffaa451b40ee198816b66eb2aae6bd25f1319e3</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/mattn/go-isatty@v0.0.11</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/mattn/go-isatty</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/mattn/go-runewidth@v0.0.9" type="library">
      <name>github.com/mattn/go-runewidth</name>
      <version>v0.0.9</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">2e6f7de5fdeb7f176977a4d29ae5421d56ff421ba9b97958afcb0223f41d13ed</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/mattn/go-runewidth@v0.0.9</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/mattn/go-runewidth</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/mattn/goveralls@v0.0.2" type="library">
      <name>github.com/mattn/goveralls</name>
      <version>v0.0.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">ede241e84aac3e1455c6fc045c69ea74edac248d0f4ecad6a13317124f7f3907</hash>
      </hashes>
      <purl>pkg:golang/github.com/mattn/goveralls@v0.0.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/mattn/goveralls</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/mediocregopher/radix/v3@v3.4.2" type="library">
      <name>github.com/mediocregopher/radix/v3</name>
      <version>v3.4.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">81a95b3c18c8c26c91120c0609f4043785fc9716c99ca058bab833f957dc4ad0</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/mediocregopher/radix/v3@v3.4.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/mediocregopher/radix/v3</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/microcosm-cc/bluemonday@v1.0.2" type="library">
      <name>github.com/microcosm-cc/bluemonday</name>
      <version>v1.0.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e653df2d34c0bc06ed4b456a4fef78c8eb459c67d4598cb1d3e893a02dceb37b</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/microcosm-cc/bluemonday@v1.0.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/microcosm-cc/bluemonday</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/miekg/dns@v1.1.41" type="library">
      <name>github.com/miekg/dns</name>
      <version>v1.1.41</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">58cb33656246d179b36caf45126cc7d9355ca98cc57acbac488078d5bf0a1f16</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/miekg/dns@v1.1.41</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/miekg/dns</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/mitchellh/go-homedir@v1.1.0" type="library">
      <name>github.com/mitchellh/go-homedir</name>
      <version>v1.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">96e905f738971710c53e4035becaf9ce97355ee3c39ffc059edab9986fb81346</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/mitchellh/go-homedir@v1.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/mitchellh/go-homedir</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/mitchellh/mapstructure@v1.1.2" type="library">
      <name>github.com/mitchellh/mapstructure</name>
      <version>v1.1.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">7e6358570aa749f07d99953a392d8ee86b1733ec1cb24643b8a433bcdd440de1</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/mitchellh/mapstructure@v1.1.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/mitchellh/mapstructure</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd" type="library">
      <name>github.com/modern-go/concurrent</name>
      <version>v0.0.0-20180306012644-bacd9c7ef1dd</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">4d12da67d703ff0f0f561f779ec3d76b556b43a8e5c0be6837c975e1095c35f8</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/modern-go/concurrent</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/modern-go/reflect2@v1.0.1" type="library">
      <name>github.com/modern-go/reflect2</name>
      <version>v1.0.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">f5fe35dacfba4666172d665213355580f18aec2d8fa611e3e5126bbdfc7d0162</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/modern-go/reflect2@v1.0.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/modern-go/reflect2</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/moul/http2curl@v1.0.0" type="library">
      <name>github.com/moul/http2curl</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">751316a00b5bf9e3f13252e4ac26c0aa1e1394f1d7be8194490df6dfff596a1b</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/moul/http2curl@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/moul/http2curl</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/nats-io/jwt@v0.3.0" type="library">
      <name>github.com/nats-io/jwt</name>
      <version>v0.3.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">c5d9f3c0511357efa335ce16d66c3ffea1722466f60013a899b9992504b8f90a</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/nats-io/jwt@v0.3.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/nats-io/jwt</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/nats-io/nats.go@v1.9.1" type="library">
      <name>github.com/nats-io/nats.go</name>
      <version>v1.9.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">8a4dc76cb859d180012eda3b897f34a592cfc3fe9dc774fefbe3192702e732b4</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/nats-io/nats.go@v1.9.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/nats-io/nats.go</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/nats-io/nkeys@v0.1.0" type="library">
      <name>github.com/nats-io/nkeys</name>
      <version>v0.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">a8c778fa944781daf59c00a5bbeda1ff66b91764e629c0b38c20dacd5811a17e</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/nats-io/nkeys@v0.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/nats-io/nkeys</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/nats-io/nuid@v1.0.1" type="library">
      <name>github.com/nats-io/nuid</name>
      <version>v1.0.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e6203c0d3f15eeaf162b611272fda969d35afeb4c449cd4a7673f0e130b6a5ac</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/nats-io/nuid@v1.0.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/nats-io/nuid</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/niemeyer/pretty@v0.0.0-20200227124842-a10e7caefd8e" type="library">
      <name>github.com/niemeyer/pretty</name>
      <version>v0.0.0-20200227124842-a10e7caefd8e</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">7c3e7b11147826d12ab166df3e1bf80cc880a47ca58a22b9c424cd5523e2680b</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/niemeyer/pretty@v0.0.0-20200227124842-a10e7caefd8e</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/niemeyer/pretty</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/nsf/jsondiff@v0.0.0-20200515183724-f29ed568f4ce" type="library">
      <name>github.com/nsf/jsondiff</name>
      <version>v0.0.0-20200515183724-f29ed568f4ce</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">44f7257e06b648426680c9b3da4f8c83b728c19f32bf84ebab0f54b096f2ef9f</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/nsf/jsondiff@v0.0.0-20200515183724-f29ed568f4ce</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/nsf/jsondiff</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/olekukonko/tablewriter@v0.0.4" type="library">
      <name>github.com/olekukonko/tablewriter</name>
      <version>v0.0.4</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">bc70ff6187b55a8968efc9281b6f7d7fb57f5404b4f1ce88a422e7f848dfff0f</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/olekukonko/tablewriter@v0.0.4</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/olekukonko/tablewriter</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/onsi/ginkgo@v1.10.3" type="library">
      <name>github.com/onsi/ginkgo</name>
      <version>v1.10.3</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">3a8c5b8df5d5672a1dd5f99662123b484c9a0fc074d329cfdd3f83e468b21ce6</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/onsi/ginkgo@v1.10.3</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/onsi/ginkgo</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/onsi/gomega@v1.7.1" type="library">
      <name>github.com/onsi/gomega</name>
      <version>v1.7.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">2b48dc442c0d40cdef146875a6932d0e1ffeec0a49ae395d957f1f0348c34cb4</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/onsi/gomega@v1.7.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/onsi/gomega</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/pelletier/go-toml@v1.2.0" type="library">
      <name>github.com/pelletier/go-toml</name>
      <version>v1.2.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">4f9ccc18c2fad56a7e16571b5a34434fbc80c6124d0223cf2ce1440aad7cd737</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/pelletier/go-toml@v1.2.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/pelletier/go-toml</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/pingcap/errors@v0.11.4" type="library">
      <name>github.com/pingcap/errors</name>
      <version>v0.11.4</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">945b9057fa1a50c19c0f6b6ab7ed3544e4a626cef9546d53a043a46486789c4e</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/pingcap/errors@v0.11.4</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/pingcap/errors</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/pkg/errors@v0.9.1" type="library">
      <name>github.com/pkg/errors</name>
      <version>v0.9.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">14404bc75cd2db5e28c298f2eeab017a2c5b51192e850030acae54c0b193c2de</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/pkg/errors@v0.9.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/pkg/errors</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/pmezard/go-difflib@v1.0.0" type="library">
      <name>github.com/pmezard/go-difflib</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e030700c4d0d1b24280476cb4183f04943e808c591e41133224fdfd6565b0103</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/pmezard/go-difflib@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/pmezard/go-difflib</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/russross/blackfriday@v1.5.2" type="library">
      <name>github.com/russross/blackfriday</name>
      <version>v1.5.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1f2bc2d0045f9d906a9d7c00045792647a4abc91c925f3f3f3518db9e2e3d28a</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/russross/blackfriday@v1.5.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/russross/blackfriday</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/russross/blackfriday/v2@v2.0.1" type="library">
      <name>github.com/russross/blackfriday/v2</name>
      <version>v2.0.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">94fa9502d7be1ee1cd7e127fd0b0bdf04496473f1a7f2f6d33fd112bc9bda3e4</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/russross/blackfriday/v2@v2.0.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/russross/blackfriday/v2</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ryanuber/columnize@v2.1.0" type="library">
      <name>github.com/ryanuber/columnize</name>
      <version>v2.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">67857b6becfe4e5a74ee5af8b920af2a90025f5420b85484816ee0a21db5f62c</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ryanuber/columnize@v2.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ryanuber/columnize</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/schollz/closestmatch@v2.1.0" type="library">
      <name>github.com/schollz/closestmatch</name>
      <version>v2.1.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">d6b425d6e1e57fc2a49546fd9d947fef0b40c2f06cbeb01a05c45164bd84556a</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/schollz/closestmatch@v2.1.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/schollz/closestmatch</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/sergi/go-diff@v1.0.0" type="library">
      <name>github.com/sergi/go-diff</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">2a971adea44daddb8d9ce41e6b305dd32b1a2ab509888b88487c688244fd44f4</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/sergi/go-diff@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/sergi/go-diff</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/shurcooL/sanitized_anchor_name@v1.0.0" type="library">
      <name>github.com/shurcooL/sanitized_anchor_name</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">3dd9a808eeb0bdbb3eef2ac9c8c391b78fc1998e486322704bf90e896c7c987a</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/shurcooL/sanitized_anchor_name@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/shurcooL/sanitized_anchor_name</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/sirupsen/logrus@v1.7.0" type="library">
      <name>github.com/sirupsen/logrus</name>
      <version>v1.7.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">4a1ac3d54f69641d764d7d1c572d03b5e3e8087f7b2bc12d5fe9a0ed901152d3</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/sirupsen/logrus@v1.7.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/sirupsen/logrus</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/skratchdot/open-golang@v0.0.0-20200116055534-eef842397966" type="library">
      <name>github.com/skratchdot/open-golang</name>
      <version>v0.0.0-20200116055534-eef842397966</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">24802eab71047fd7206d4e80b463cae024c6dd97fa08a30da9fd0c1d38200140</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/skratchdot/open-golang@v0.0.0-20200116055534-eef842397966</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/skratchdot/open-golang</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/smartystreets/assertions@v0.0.0-20180927180507-b2de0cb4f26d" type="library">
      <name>github.com/smartystreets/assertions</name>
      <version>v0.0.0-20180927180507-b2de0cb4f26d</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">cc4f7290495643afcd6261dade3a66ff21e7238c52a1f3fe50fe92a631dc49e3</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/smartystreets/assertions@v0.0.0-20180927180507-b2de0cb4f26d</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/smartystreets/assertions</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/smartystreets/goconvey@v1.6.4" type="library">
      <name>github.com/smartystreets/goconvey</name>
      <version>v1.6.4</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">7efd14f0550830f35fd4bf659c72ef2e182272b2150a112477320a62a6cd0bdb</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/smartystreets/goconvey@v1.6.4</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/smartystreets/goconvey</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/spf13/afero@v1.1.2" type="library">
      <name>github.com/spf13/afero</name>
      <version>v1.1.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">9bcff3d6deff7f08f2b2341161b3f4443f9b50817ff2d2703dd119b08f370022</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/spf13/afero@v1.1.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/spf13/afero</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/spf13/cast@v1.3.0" type="library">
      <name>github.com/spf13/cast</name>
      <version>v1.3.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">a207adfff095384a057b0a90c70af4123e728f2827a8692f820484fe0077e50f</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/spf13/cast@v1.3.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/spf13/cast</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/spf13/cobra@v0.0.5" type="library">
      <name>github.com/spf13/cobra</name>
      <version>v0.0.5</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">7f407e2e42d7e83b66447d62b28340f554ed3542bd2bcc58776f0934d7cebffb</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/spf13/cobra@v0.0.5</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/spf13/cobra</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/spf13/jwalterweatherman@v1.0.0" type="library">
      <name>github.com/spf13/jwalterweatherman</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">5c711dc81f8472f96a65a99233864e30695cf77b7a01cb0112ef46735be7ef29</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/spf13/jwalterweatherman@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/spf13/jwalterweatherman</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/spf13/pflag@v1.0.3" type="library">
      <name>github.com/spf13/pflag</name>
      <version>v1.0.3</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">ccf013e821b2eb05de43b36d4e76937ab7ca3ac57a57a17c6a01d71626b30e48</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/spf13/pflag@v1.0.3</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/spf13/pflag</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/spf13/viper@v1.3.2" type="library">
      <name>github.com/spf13/viper</name>
      <version>v1.3.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">55416ac3929ca917fb8bbd063b35bb37e43bfa0c55064492aa25c1d76f894383</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/spf13/viper@v1.3.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/spf13/viper</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ssor/bom@v0.0.0-20170718123548-6386211fdfcf" type="library">
      <name>github.com/ssor/bom</name>
      <version>v0.0.0-20170718123548-6386211fdfcf</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">a6f6d9d253345d63c1a942aa154f1c99abeca6f225f67ba5398c1dcba205451a</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ssor/bom@v0.0.0-20170718123548-6386211fdfcf</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ssor/bom</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/stretchr/objx@v0.2.0" type="library">
      <name>github.com/stretchr/objx</name>
      <version>v0.2.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1db8363627692c4f2f7840641194cbdc2be5914215cee53d8c3a6564ee78738f</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/stretchr/objx@v0.2.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/stretchr/objx</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/stretchr/testify@v1.6.1" type="library">
      <name>github.com/stretchr/testify</name>
      <version>v1.6.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">8433ce1e6a4ea4fe3495250b72ac3b22b45bfeeef0e91a430bddfdf57ca835dd</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/stretchr/testify@v1.6.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/stretchr/testify</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/therecipe/qt@v0.0.0-20200701200531-7f61353ee73e" type="library">
      <name>github.com/therecipe/qt</name>
      <version>v0.0.0-20200701200531-7f61353ee73e</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1b40d0fd3450cab1198ed2e52f07af163691886f1e782325abd59743638ed9b9</hash>
      </hashes>
      <licenses>
        <license>
          <id>LGPL-3.0</id>
          <url>https://spdx.org/licenses/LGPL-3.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/therecipe/qt@v0.0.0-20200701200531-7f61353ee73e</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/therecipe/qt</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ugorji/go@v1.1.7" type="library">
      <name>github.com/ugorji/go</name>
      <version>v1.1.7</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">ffaf20cb687ed6658caf0645783d644226a5752cc06f8df676da5e278da8bdda</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ugorji/go@v1.1.7</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ugorji/go</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/ugorji/go/codec@v1.1.7" type="library">
      <name>github.com/ugorji/go/codec</name>
      <version>v1.1.7</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">d92bd0695675a2e62baca2b0a12936a7377803d7af94a25bf684cbf8e68b512b</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ugorji/go/codec@v1.1.7</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ugorji/go/codec</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/urfave/cli/v2@v2.2.0" type="library">
      <name>github.com/urfave/cli/v2</name>
      <version>v2.2.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">2534e733ac0acdd03426aa1d77deba3158f8bd66dbaae67291e5f5b0a6ded82e</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/urfave/cli/v2@v2.2.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/urfave/cli/v2</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/urfave/negroni@v1.0.0" type="library">
      <name>github.com/urfave/negroni</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">9088a63a2b68ca9ab7e0aed31bb0d4689f64abf37839fbb08b5b23cf42a2a577</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/urfave/negroni@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/urfave/negroni</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/valyala/bytebufferpool@v1.0.0" type="library">
      <name>github.com/valyala/bytebufferpool</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1aa0394c2ff4d36d58fdbf451b83a2f4caf7abb5d8c7a2a59736b014885c74fc</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/valyala/bytebufferpool@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/valyala/bytebufferpool</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/valyala/fasthttp@v1.6.0" type="library">
      <name>github.com/valyala/fasthttp</name>
      <version>v1.6.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b9617c9602a679a21ec1654fc22e0646ad8febe478e8881865dc56b4cf86b446</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/valyala/fasthttp@v1.6.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/valyala/fasthttp</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/valyala/fasttemplate@v1.0.1" type="library">
      <name>github.com/valyala/fasttemplate</name>
      <version>v1.0.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b58f422623e73177f5111986d84c8aee035477e73a44a183d087d4f167544b3f</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/valyala/fasttemplate@v1.0.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/valyala/fasttemplate</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/valyala/tcplisten@v0.0.0-20161114210144-ceec8f93295a" type="library">
      <name>github.com/valyala/tcplisten</name>
      <version>v0.0.0-20161114210144-ceec8f93295a</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">d11e0d2c3443657e897268498178b91386fc5a0f388a16e650aa7f1af48f1337</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/valyala/tcplisten@v0.0.0-20161114210144-ceec8f93295a</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/valyala/tcplisten</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/vmihailenco/msgpack/v5@v5.1.3" type="library">
      <name>github.com/vmihailenco/msgpack/v5</name>
      <version>v5.1.3</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1700bd28f8f25bc3aa4d4a8cb7aad0c3dcb9d2f0367132d73ca09c04245b4208</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/vmihailenco/msgpack/v5@v5.1.3</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/vmihailenco/msgpack/v5</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/vmihailenco/tagparser@v0.1.2" type="library">
      <name>github.com/vmihailenco/tagparser</name>
      <version>v0.1.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">8278e856e07f9258c9e702021043a9c7df285cc58f2e3db61baed56ddd6a3ea7</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/vmihailenco/tagparser@v0.1.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/vmihailenco/tagparser</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20180127040702-4e3ac2762d5f" type="library">
      <name>github.com/xeipuuv/gojsonpointer</name>
      <version>v0.0.0-20180127040702-4e3ac2762d5f</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">27d106a5c66d3f413fadaa2b08cc6514649306bb1295a0c67f78d4feabc01367</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20180127040702-4e3ac2762d5f</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/xeipuuv/gojsonpointer</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415" type="library">
      <name>github.com/xeipuuv/gojsonreference</name>
      <version>v0.0.0-20180127040603-bd5ef7bd5415</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">133256807a2fa27b7b36c723a40c57b0303c4bc04c62f7bc639fbb72e444ed1d</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/xeipuuv/gojsonreference</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/xeipuuv/gojsonschema@v1.2.0" type="library">
      <name>github.com/xeipuuv/gojsonschema</name>
      <version>v1.2.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">2e160946cf8be1f06d8d951fb92648286795bb4411cbc7b95e2ec3d7b53167be</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/xeipuuv/gojsonschema@v1.2.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/xeipuuv/gojsonschema</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/xordataexchange/crypt@v0.0.3-0.20170626215501-b2862e3d0a77" type="library">
      <name>github.com/xordataexchange/crypt</name>
      <version>v0.0.3-0.20170626215501-b2862e3d0a77</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">112152770619be47abbb746d76b62e7b3b4a84e0424800334b819ffa4d2d128c</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/xordataexchange/crypt@v0.0.3-0.20170626215501-b2862e3d0a77</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/xordataexchange/crypt</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/yalp/jsonpath@v0.0.0-20180802001716-5cc68e5049a0" type="library">
      <name>github.com/yalp/jsonpath</name>
      <version>v0.0.0-20180802001716-5cc68e5049a0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e9f4614a380b0a44c3dc99c9c6f689e128fe4d86e5c3be7b6ea62065a3aae596</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/yalp/jsonpath@v0.0.0-20180802001716-5cc68e5049a0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/yalp/jsonpath</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/yudai/gojsondiff@v1.0.0" type="library">
      <name>github.com/yudai/gojsondiff</name>
      <version>v1.0.0</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">dbb71b7ea5cb544275a3c23abf7cbd960f18766e7710aa875c038cc441a508e0</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/yudai/gojsondiff@v1.0.0</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/yudai/gojsondiff</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/yudai/golcs@v0.0.0-20170316035057-ecda9a501e82" type="library">
      <name>github.com/yudai/golcs</name>
      <version>v0.0.0-20170316035057-ecda9a501e82</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">047c9f2a5432a9bb05379a7721f9c451db96bdbf62b38dbcfe735be4bdd4d353</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/yudai/golcs@v0.0.0-20170316035057-ecda9a501e82</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/yudai/golcs</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/github.com/yudai/pp@v2.0.1" type="library">
      <name>github.com/yudai/pp</name>
      <version>v2.0.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1299f78b400318def5807e58bf26b725c8d0ac5fcab8b1c798ffc31b0f73d730</hash>
      </hashes>
      <purl>pkg:golang/github.com/yudai/pp@v2.0.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/yudai/pp</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/go.etcd.io/bbolt@v1.3.5" type="library">
      <name>go.etcd.io/bbolt</name>
      <version>v1.3.5</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">5c0cf1f608c26f44718fb128a9c0a53c3d5de590716499348dbba83c77a706dd</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/go.etcd.io/bbolt@v1.3.5</purl>
    </component>
    <component bom-ref="pkg:golang/github.com/ProtonMail/crypto@v0.0.0-20201112115411-41db4ea0dd1c" type="library">
      <name>github.com/ProtonMail/crypto</name>
      <version>v0.0.0-20201112115411-41db4ea0dd1c</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">89a55b10e9ec9121a0707ed74161c6e953e2ac70d1a187be21d774fdd9789bc0</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/github.com/ProtonMail/crypto@v0.0.0-20201112115411-41db4ea0dd1c</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/ProtonMail/crypto</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/exp@v0.0.0-20190731235908-ec7cb31e5a56" type="library">
      <name>golang.org/x/exp</name>
      <version>v0.0.0-20190731235908-ec7cb31e5a56</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">7acb64d6094e9d255e27db5d11965ce6600c0d993994d24dc89e83beb0644c45</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/exp@v0.0.0-20190731235908-ec7cb31e5a56</purl>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/image@v0.0.0-20190802002840-cff245a6509b" type="library">
      <name>golang.org/x/image</name>
      <version>v0.0.0-20190802002840-cff245a6509b</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">faa1291003e10d9d68d31ded1f365340302b9ce8b13b3183f475097dc83499be</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/image@v0.0.0-20190802002840-cff245a6509b</purl>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/mobile@v0.0.0-20200801112145-973feb4309de" type="library">
      <name>golang.org/x/mobile</name>
      <version>v0.0.0-20200801112145-973feb4309de</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">39527a41050101eb01f026628ca0d2b175fbc5856d521ae463483031f6e2e29e</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/mobile@v0.0.0-20200801112145-973feb4309de</purl>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/mod@v0.1.1-0.20191209134235-331c550502dd" type="library">
      <name>golang.org/x/mod</name>
      <version>v0.1.1-0.20191209134235-331c550502dd</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">78fb8d0bb3d9e8ee41ce03e7f5b65ac8445705d7d98d46285c47f90537c37e1f</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/mod@v0.1.1-0.20191209134235-331c550502dd</purl>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4" type="library">
      <name>golang.org/x/net</name>
      <version>v0.0.0-20210405180319-a5a99cb37ef4</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e2719a56ed10adb8d3fc02b63d12ee41f42e87a0c9bdefa910b86a4dd023df1d</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4</purl>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/sync@v0.0.0-20210220032951-036812b2e83c" type="library">
      <name>golang.org/x/sync</name>
      <version>v0.0.0-20210220032951-036812b2e83c</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">e4ab25198c05a6484687e435e9bc0c3f770ea27b47f0539ea7bb4657ce98ed24</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/sync@v0.0.0-20210220032951-036812b2e83c</purl>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/sys@v0.0.0-20210330210617-4fbd30eecc44" type="library">
      <name>golang.org/x/sys</name>
      <version>v0.0.0-20210330210617-4fbd30eecc44</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">0658b8d69225cd3cdfdca118d3a9fec67ccafc1112220db37b83e07e1fda23c7</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/sys@v0.0.0-20210330210617-4fbd30eecc44</purl>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/term@v0.0.0-20201126162022-7de9c90e9dd1" type="library">
      <name>golang.org/x/term</name>
      <version>v0.0.0-20201126162022-7de9c90e9dd1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">bfe3acb16417fa14c7126381830c5d6712b8cc7ab7c8eb3c17d27b9a4d0f63c1</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/term@v0.0.0-20201126162022-7de9c90e9dd1</purl>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/text@v0.3.5-0.20201125200606-c27b9fd57aec" type="library">
      <name>golang.org/x/text</name>
      <version>v0.3.5-0.20201125200606-c27b9fd57aec</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">035a988e7789bb305967680807caddeb3adfaba97b4a810c27c12c4a294d2bf5</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/text@v0.3.5-0.20201125200606-c27b9fd57aec</purl>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/tools@v0.0.0-20200117012304-6edc0a871e69" type="library">
      <name>golang.org/x/tools</name>
      <version>v0.0.0-20200117012304-6edc0a871e69</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">c811c7c7e5d9a972419ba13191edcded5f609e5b325f1a023c46f5c957a78df9</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/tools@v0.0.0-20200117012304-6edc0a871e69</purl>
    </component>
    <component bom-ref="pkg:golang/golang.org/x/xerrors@v0.0.0-20191204190536-9bdfabe68543" type="library">
      <name>golang.org/x/xerrors</name>
      <version>v0.0.0-20191204190536-9bdfabe68543</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">13b83ef46213ab4ee1a5fad1bbae885437b131a91fbf9d9e2d9d825c15a22abe</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/golang.org/x/xerrors@v0.0.0-20191204190536-9bdfabe68543</purl>
    </component>
    <component bom-ref="pkg:golang/gopkg.in/check.v1@v1.0.0-20200227125254-8fa46927fb4f" type="library">
      <name>gopkg.in/check.v1</name>
      <version>v1.0.0-20200227125254-8fa46927fb4f</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">04bada1579e6adebf9953fb196296a707f172bdfe2d00b76c4a8d6938a7acec5</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/gopkg.in/check.v1@v1.0.0-20200227125254-8fa46927fb4f</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-check/check</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/gopkg.in/fsnotify.v1@v1.4.7" type="library">
      <name>gopkg.in/fsnotify.v1</name>
      <version>v1.4.7</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">c4e1cb5d9c15bc8f6186cf9c2caab9f88e689cebb040b850c22bbadf1c651ece</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/gopkg.in/fsnotify.v1@v1.4.7</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-fsnotify/fsnotify</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/gopkg.in/go-playground/assert.v1@v1.2.1" type="library">
      <name>gopkg.in/go-playground/assert.v1</name>
      <version>v1.2.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">c6862e25513b293f393d85ab37bdf4460b8840ed1e3f35517c531769d22b5d33</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/gopkg.in/go-playground/assert.v1@v1.2.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-playground/assert</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/gopkg.in/go-playground/validator.v8@v8.18.2" type="library">
      <name>gopkg.in/go-playground/validator.v8</name>
      <version>v8.18.2</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">9450780e8314e81eb6eb0f27cbbe8c57b557e96d951dcb76195388df182232b4</hash>
      </hashes>
      <licenses>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/gopkg.in/go-playground/validator.v8@v8.18.2</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-playground/validator</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/gopkg.in/ini.v1@v1.51.1" type="library">
      <name>gopkg.in/ini.v1</name>
      <version>v1.51.1</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">1b26e81ebe14a8c88b5326d88dddb6663408284244a60b4b5edb866d1db53a1a</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/gopkg.in/ini.v1@v1.51.1</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-ini/ini</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/gopkg.in/mgo.v2@v2.0.0-20180705113604-9856a29383ce" type="library">
      <name>gopkg.in/mgo.v2</name>
      <version>v2.0.0-20180705113604-9856a29383ce</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">c5c1168d586f6c3cbe9c73faee73c30e96d8ad8f882e57e7764e1b462a151da5</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-2-Clause</id>
          <url>https://spdx.org/licenses/BSD-2-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/gopkg.in/mgo.v2@v2.0.0-20180705113604-9856a29383ce</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-mgo/mgo</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/gopkg.in/tomb.v1@v1.0.0-20141024135613-dd632973f1e7" type="library">
      <name>gopkg.in/tomb.v1</name>
      <version>v1.0.0-20141024135613-dd632973f1e7</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">b9118975c88e1da108af37b65bc43700a91ea4b4e1da13aba13edafbb7337dd4</hash>
      </hashes>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
          <url>https://spdx.org/licenses/BSD-3-Clause.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/gopkg.in/tomb.v1@v1.0.0-20141024135613-dd632973f1e7</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-tomb/tomb</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/gopkg.in/yaml.v2@v2.2.8" type="library">
      <name>gopkg.in/yaml.v2</name>
      <version>v2.2.8</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">a1b37565a809494188d0493f2c19ae8f848d2cf7c89f2dcab0a168a7145d8f5d</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/gopkg.in/yaml.v2@v2.2.8</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-yaml/yaml</url>
        </reference>
      </externalReferences>
    </component>
    <component bom-ref="pkg:golang/gopkg.in/yaml.v3@v3.0.0-20200313102051-9f266ea9e77c" type="library">
      <name>gopkg.in/yaml.v3</name>
      <version>v3.0.0-20200313102051-9f266ea9e77c</version>
      <scope>required</scope>
      <hashes>
        <hash alg="SHA-256">7545301e4d90102a3feafa80e38aed859f227b641730d78a4531c2358da75efa</hash>
      </hashes>
      <licenses>
        <license>
          <id>Apache-2.0</id>
          <url>https://spdx.org/licenses/Apache-2.0.html</url>
        </license>
        <license>
          <id>MIT</id>
          <url>https://spdx.org/licenses/MIT.html</url>
        </license>
      </licenses>
      <purl>pkg:golang/gopkg.in/yaml.v3@v3.0.0-20200313102051-9f266ea9e77c</purl>
      <externalReferences>
        <reference type="vcs">
          <url>https://github.com/go-yaml/yaml</url>
        </reference>
      </externalReferences>
    </component>
  </components>
  <dependencies>
    <dependency ref="pkg:golang/github.com/0xAX/notificator@v0.0.0-20191016112426-3962a5ea8da1"></dependency>
    <dependency ref="pkg:golang/github.com/AndreasBriese/bbloom@v0.0.0-20190306092124-e2d15f34fcf9"></dependency>
    <dependency ref="pkg:golang/github.com/BurntSushi/toml@v0.3.1"></dependency>
    <dependency ref="pkg:golang/github.com/BurntSushi/xgb@v0.0.0-20160522181843-27f122750802"></dependency>
    <dependency ref="pkg:golang/github.com/CloudyKit/fastprinter@v0.0.0-20200109182630-33d98a066a53"></dependency>
    <dependency ref="pkg:golang/github.com/CloudyKit/jet/v3@v3.0.0">
      <dependency ref="pkg:golang/github.com/CloudyKit/fastprinter@v0.0.0-20200109182630-33d98a066a53"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/Joker/hpp@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/Masterminds/semver/v3@v3.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/go-autostart@v0.0.0-20181114175602-c5272053443a"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/go-crypto@v0.0.0-20201208171014-cdb7591792e2"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/go-imap-id@v0.0.0-20190926060100-f94a56b9ecde"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/go-mime@v0.0.0-20190923161245-9b5a4261663a"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/go-rfc5322@v0.5.0">
      <dependency ref="pkg:golang/github.com/antlr/antlr4@v0.0.0-20201029161626-9a95f0cc3d7c"></dependency>
      <dependency ref="pkg:golang/github.com/sirupsen/logrus@v1.7.0"></dependency>
      <dependency ref="pkg:golang/github.com/stretchr/testify@v1.6.1"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/go-vcard@v0.0.0-20180326232728-33aaa0a0c8a5"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/gopenpgp/v2@v2.1.3">
      <dependency ref="pkg:golang/github.com/ProtonMail/go-crypto@v0.0.0-20201208171014-cdb7591792e2"></dependency>
      <dependency ref="pkg:golang/github.com/ProtonMail/go-mime@v0.0.0-20190923161245-9b5a4261663a"></dependency>
      <dependency ref="pkg:golang/golang.org/x/mobile@v0.0.0-20200801112145-973feb4309de"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/PuerkitoBio/goquery@v1.5.1">
      <dependency ref="pkg:golang/github.com/andybalholm/cascadia@v1.1.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/Shopify/goreferrer@v0.0.0-20181106222321-ec9c9a553398"></dependency>
    <dependency ref="pkg:golang/github.com/abiosoft/ishell@v2.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/abiosoft/readline@v0.0.0-20180607040430-155bce2042db"></dependency>
    <dependency ref="pkg:golang/github.com/ajg/form@v1.5.1"></dependency>
    <dependency ref="pkg:golang/github.com/allan-simon/go-singleinstance@v0.0.0-20160830203053-79edcfdc2dfc"></dependency>
    <dependency ref="pkg:golang/github.com/andybalholm/cascadia@v1.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/antlr/antlr4@v0.0.0-20201029161626-9a95f0cc3d7c"></dependency>
    <dependency ref="pkg:golang/github.com/armon/consul-api@v0.0.0-20180202201655-eb2c6b5be1b6"></dependency>
    <dependency ref="pkg:golang/github.com/aymerick/raymond@v2.0.3-0.20180322193309-b565731e1464"></dependency>
    <dependency ref="pkg:golang/github.com/chzyer/logex@v1.1.10"></dependency>
    <dependency ref="pkg:golang/github.com/chzyer/test@v0.0.0-20180213035817-a1ea475d72b1"></dependency>
    <dependency ref="pkg:golang/github.com/codegangsta/inject@v0.0.0-20150114235600-33e0aa1cb7c0"></dependency>
    <dependency ref="pkg:golang/github.com/coreos/etcd@v3.3.10"></dependency>
    <dependency ref="pkg:golang/github.com/coreos/go-etcd@v2.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/coreos/go-semver@v0.2.0"></dependency>
    <dependency ref="pkg:golang/github.com/cpuguy83/go-md2man@v1.0.10">
      <dependency ref="pkg:golang/github.com/russross/blackfriday@v1.5.2"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.0-20190314233015-f79a8a8ca69d">
      <dependency ref="pkg:golang/github.com/pmezard/go-difflib@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/russross/blackfriday/v2@v2.0.1"></dependency>
      <dependency ref="pkg:golang/github.com/shurcooL/sanitized_anchor_name@v1.0.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/creack/pty@v1.1.9"></dependency>
    <dependency ref="pkg:golang/github.com/cucumber/godog@v0.8.1"></dependency>
    <dependency ref="pkg:golang/github.com/danieljoos/wincred@v1.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/davecgh/go-spew@v1.1.1"></dependency>
    <dependency ref="pkg:golang/github.com/dgraph-io/badger@v1.6.0">
      <dependency ref="pkg:golang/github.com/AndreasBriese/bbloom@v0.0.0-20190306092124-e2d15f34fcf9"></dependency>
      <dependency ref="pkg:golang/github.com/dgryski/go-farm@v0.0.0-20190423205320-6a90982ecee2"></dependency>
      <dependency ref="pkg:golang/github.com/dustin/go-humanize@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/golang/protobuf@v1.3.1"></dependency>
      <dependency ref="pkg:golang/github.com/spf13/cobra@v0.0.5"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/dgrijalva/jwt-go@v3.2.0"></dependency>
    <dependency ref="pkg:golang/github.com/dgryski/go-farm@v0.0.0-20190423205320-6a90982ecee2"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/docker-credential-helpers@v1.1.0">
      <dependency ref="pkg:golang/github.com/danieljoos/wincred@v1.1.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/dustin/go-humanize@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/eknkc/amber@v0.0.0-20171010120322-cdade1c07385"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/go-imap@v0.0.0-20201228133358-4db68cea0cac"></dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-imap-appendlimit@v0.0.0-20190308131241-25671c986a6a"></dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-imap-idle@v0.0.0-20200601154248-f05f54664cc4"></dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-imap-move@v0.0.0-20190710073258-6e5a51a5b342"></dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-imap-quota@v0.0.0-20210203125329-619074823f3c"></dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-imap-unselect@v0.0.0-20171113212723-b985794e5f26"></dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-mbox@v1.0.2"></dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-message@v0.12.1-0.20201221184100-40c3f864532b">
      <dependency ref="pkg:golang/github.com/davecgh/go-spew@v1.1.1"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-textwrapper@v0.0.0-20200911093747-65d896831594"></dependency>
      <dependency ref="pkg:golang/github.com/martinlindhe/base36@v1.1.0"></dependency>
      <dependency ref="pkg:golang/golang.org/x/text@v0.3.5-0.20201125200606-c27b9fd57aec"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-sasl@v0.0.0-20200509203442-7bfe0ed36a21"></dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-smtp@v0.14.0">
      <dependency ref="pkg:golang/github.com/emersion/go-sasl@v0.0.0-20200509203442-7bfe0ed36a21"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-textwrapper@v0.0.0-20200911093747-65d896831594"></dependency>
    <dependency ref="pkg:golang/github.com/emersion/go-vcard@v0.0.0-20190105225839-8856043f13c5"></dependency>
    <dependency ref="pkg:golang/github.com/etcd-io/bbolt@v1.3.3"></dependency>
    <dependency ref="pkg:golang/github.com/fasthttp-contrib/websocket@v0.0.0-20160511215533-1f3b11f56072"></dependency>
    <dependency ref="pkg:golang/github.com/fatih/color@v1.9.0">
      <dependency ref="pkg:golang/github.com/mattn/go-colorable@v0.1.4"></dependency>
      <dependency ref="pkg:golang/github.com/mattn/go-isatty@v0.0.11"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/fatih/structs@v1.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/flynn-archive/go-shlex@v0.0.0-20150515145356-3f9db97f8568"></dependency>
    <dependency ref="pkg:golang/github.com/fsnotify/fsnotify@v1.4.7"></dependency>
    <dependency ref="pkg:golang/github.com/gavv/httpexpect@v2.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/getsentry/sentry-go@v0.8.0">
      <dependency ref="pkg:golang/github.com/ajg/form@v1.5.1"></dependency>
      <dependency ref="pkg:golang/github.com/codegangsta/inject@v0.0.0-20150114235600-33e0aa1cb7c0"></dependency>
      <dependency ref="pkg:golang/github.com/fasthttp-contrib/websocket@v0.0.0-20160511215533-1f3b11f56072"></dependency>
      <dependency ref="pkg:golang/github.com/gin-gonic/gin@v1.4.0"></dependency>
      <dependency ref="pkg:golang/github.com/go-errors/errors@v1.0.1"></dependency>
      <dependency ref="pkg:golang/github.com/go-martini/martini@v0.0.0-20170121215854-22fa46961aab"></dependency>
      <dependency ref="pkg:golang/github.com/google/go-querystring@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/imkira/go-interpol@v1.1.0"></dependency>
      <dependency ref="pkg:golang/github.com/k0kubun/colorstring@v0.0.0-20150214042306-9440f1994b88"></dependency>
      <dependency ref="pkg:golang/github.com/kataras/iris/v12@v12.1.8"></dependency>
      <dependency ref="pkg:golang/github.com/labstack/echo/v4@v4.1.11"></dependency>
      <dependency ref="pkg:golang/github.com/moul/http2curl@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/onsi/ginkgo@v1.10.3"></dependency>
      <dependency ref="pkg:golang/github.com/onsi/gomega@v1.7.1"></dependency>
      <dependency ref="pkg:golang/github.com/pingcap/errors@v0.11.4"></dependency>
      <dependency ref="pkg:golang/github.com/sergi/go-diff@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/shurcooL/sanitized_anchor_name@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/smartystreets/goconvey@v1.6.4"></dependency>
      <dependency ref="pkg:golang/github.com/ugorji/go@v1.1.7"></dependency>
      <dependency ref="pkg:golang/github.com/urfave/negroni@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/valyala/fasthttp@v1.6.0"></dependency>
      <dependency ref="pkg:golang/github.com/xeipuuv/gojsonschema@v1.2.0"></dependency>
      <dependency ref="pkg:golang/github.com/yalp/jsonpath@v0.0.0-20180802001716-5cc68e5049a0"></dependency>
      <dependency ref="pkg:golang/github.com/yudai/gojsondiff@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/yudai/golcs@v0.0.0-20170316035057-ecda9a501e82"></dependency>
      <dependency ref="pkg:golang/github.com/yudai/pp@v2.0.1"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/gin-contrib/sse@v0.0.0-20190301062529-5545eab6dad3"></dependency>
    <dependency ref="pkg:golang/github.com/gin-gonic/gin@v1.4.0">
      <dependency ref="pkg:golang/github.com/gin-contrib/sse@v0.0.0-20190301062529-5545eab6dad3"></dependency>
      <dependency ref="pkg:golang/github.com/golang/protobuf@v1.3.1"></dependency>
      <dependency ref="pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd"></dependency>
      <dependency ref="pkg:golang/github.com/modern-go/reflect2@v1.0.1"></dependency>
      <dependency ref="pkg:golang/gopkg.in/go-playground/assert.v1@v1.2.1"></dependency>
      <dependency ref="pkg:golang/gopkg.in/go-playground/validator.v8@v8.18.2"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/go-check/check@v0.0.0-20180628173108-788fd7840127"></dependency>
    <dependency ref="pkg:golang/github.com/go-errors/errors@v1.0.1"></dependency>
    <dependency ref="pkg:golang/github.com/go-martini/martini@v0.0.0-20170121215854-22fa46961aab"></dependency>
    <dependency ref="pkg:golang/github.com/go-resty/resty/v2@v2.6.0">
      <dependency ref="pkg:golang/golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/gobwas/httphead@v0.0.0-20180130184737-2c6c146eadee"></dependency>
    <dependency ref="pkg:golang/github.com/gobwas/pool@v0.2.0"></dependency>
    <dependency ref="pkg:golang/github.com/gobwas/ws@v1.0.2"></dependency>
    <dependency ref="pkg:golang/github.com/golang/mock@v1.4.4"></dependency>
    <dependency ref="pkg:golang/github.com/golang/protobuf@v1.3.1"></dependency>
    <dependency ref="pkg:golang/github.com/gomodule/redigo@v1.7.1-0.20190724094224-574c33c3df38"></dependency>
    <dependency ref="pkg:golang/github.com/google/go-cmp@v0.5.1">
      <dependency ref="pkg:golang/golang.org/x/xerrors@v0.0.0-20191204190536-9bdfabe68543"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/google/go-querystring@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/google/gofuzz@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/google/uuid@v1.1.1"></dependency>
    <dependency ref="pkg:golang/github.com/gopherjs/gopherjs@v0.0.0-20190430165422-3e4dfb77656c"></dependency>
    <dependency ref="pkg:golang/github.com/gorilla/websocket@v1.4.1"></dependency>
    <dependency ref="pkg:golang/github.com/hashicorp/errwrap@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/hashicorp/go-multierror@v1.1.0">
      <dependency ref="pkg:golang/github.com/hashicorp/errwrap@v1.0.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/hashicorp/go-version@v1.2.0"></dependency>
    <dependency ref="pkg:golang/github.com/hashicorp/hcl@v1.0.0">
      <dependency ref="pkg:golang/github.com/davecgh/go-spew@v1.1.1"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/hpcloud/tail@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/imkira/go-interpol@v1.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/inconshreveable/mousetrap@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/iris-contrib/blackfriday@v2.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/iris-contrib/go.uuid@v2.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/iris-contrib/jade@v1.1.3">
      <dependency ref="pkg:golang/github.com/Joker/hpp@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/valyala/bytebufferpool@v1.0.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/iris-contrib/pongo2@v0.0.1">
      <dependency ref="pkg:golang/github.com/go-check/check@v0.0.0-20180628173108-788fd7840127"></dependency>
      <dependency ref="pkg:golang/github.com/kr/pretty@v0.1.0"></dependency>
      <dependency ref="pkg:golang/github.com/mattn/goveralls@v0.0.2"></dependency>
      <dependency ref="pkg:golang/gopkg.in/mgo.v2@v2.0.0-20180705113604-9856a29383ce"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/iris-contrib/schema@v0.0.1"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/bcrypt@v0.0.0-20170924085257-7509ea014998"></dependency>
    <dependency ref="pkg:golang/github.com/jaytaylor/html2text@v0.0.0-20200412013138-3577fbdbcff7"></dependency>
    <dependency ref="pkg:golang/github.com/json-iterator/go@v1.1.9">
      <dependency ref="pkg:golang/github.com/davecgh/go-spew@v1.1.1"></dependency>
      <dependency ref="pkg:golang/github.com/google/gofuzz@v1.0.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/jtolds/gls@v4.20.0"></dependency>
    <dependency ref="pkg:golang/github.com/k0kubun/colorstring@v0.0.0-20150214042306-9440f1994b88"></dependency>
    <dependency ref="pkg:golang/github.com/kataras/golog@v0.0.10">
      <dependency ref="pkg:golang/github.com/kataras/pio@v0.0.2"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/kataras/iris/v12@v12.1.8">
      <dependency ref="pkg:golang/github.com/BurntSushi/toml@v0.3.1"></dependency>
      <dependency ref="pkg:golang/github.com/CloudyKit/jet/v3@v3.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/Shopify/goreferrer@v0.0.0-20181106222321-ec9c9a553398"></dependency>
      <dependency ref="pkg:golang/github.com/aymerick/raymond@v2.0.3-0.20180322193309-b565731e1464"></dependency>
      <dependency ref="pkg:golang/github.com/dgraph-io/badger@v1.6.0"></dependency>
      <dependency ref="pkg:golang/github.com/eknkc/amber@v0.0.0-20171010120322-cdade1c07385"></dependency>
      <dependency ref="pkg:golang/github.com/etcd-io/bbolt@v1.3.3"></dependency>
      <dependency ref="pkg:golang/github.com/fatih/structs@v1.1.0"></dependency>
      <dependency ref="pkg:golang/github.com/gavv/httpexpect@v2.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/gomodule/redigo@v1.7.1-0.20190724094224-574c33c3df38"></dependency>
      <dependency ref="pkg:golang/github.com/hashicorp/go-version@v1.2.0"></dependency>
      <dependency ref="pkg:golang/github.com/iris-contrib/blackfriday@v2.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/iris-contrib/go.uuid@v2.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/iris-contrib/pongo2@v0.0.1"></dependency>
      <dependency ref="pkg:golang/github.com/iris-contrib/schema@v0.0.1"></dependency>
      <dependency ref="pkg:golang/github.com/iris-contrib/jade@v1.1.3"></dependency>
      <dependency ref="pkg:golang/github.com/json-iterator/go@v1.1.9"></dependency>
      <dependency ref="pkg:golang/github.com/kataras/golog@v0.0.10"></dependency>
      <dependency ref="pkg:golang/github.com/kataras/neffos@v0.0.14"></dependency>
      <dependency ref="pkg:golang/github.com/kataras/sitemap@v0.0.5"></dependency>
      <dependency ref="pkg:golang/github.com/klauspost/compress@v1.9.7"></dependency>
      <dependency ref="pkg:golang/github.com/mediocregopher/radix/v3@v3.4.2"></dependency>
      <dependency ref="pkg:golang/github.com/microcosm-cc/bluemonday@v1.0.2"></dependency>
      <dependency ref="pkg:golang/github.com/ryanuber/columnize@v2.1.0"></dependency>
      <dependency ref="pkg:golang/github.com/schollz/closestmatch@v2.1.0"></dependency>
      <dependency ref="pkg:golang/gopkg.in/ini.v1@v1.51.1"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/kataras/neffos@v0.0.14">
      <dependency ref="pkg:golang/github.com/gobwas/httphead@v0.0.0-20180130184737-2c6c146eadee"></dependency>
      <dependency ref="pkg:golang/github.com/gobwas/pool@v0.2.0"></dependency>
      <dependency ref="pkg:golang/github.com/gobwas/ws@v1.0.2"></dependency>
      <dependency ref="pkg:golang/github.com/gorilla/websocket@v1.4.1"></dependency>
      <dependency ref="pkg:golang/github.com/iris-contrib/go.uuid@v2.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/mediocregopher/radix/v3@v3.4.2"></dependency>
      <dependency ref="pkg:golang/github.com/nats-io/nats.go@v1.9.1"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/kataras/pio@v0.0.2"></dependency>
    <dependency ref="pkg:golang/github.com/kataras/sitemap@v0.0.5"></dependency>
    <dependency ref="pkg:golang/github.com/keybase/go-keychain@v0.0.0-20200502122510-cda31fe0c86d">
      <dependency ref="pkg:golang/github.com/davecgh/go-spew@v1.1.1"></dependency>
      <dependency ref="pkg:golang/github.com/keybase/go.dbus@v0.0.0-20200324223359-a94be52c0b03"></dependency>
      <dependency ref="pkg:golang/github.com/kr/text@v0.2.0"></dependency>
      <dependency ref="pkg:golang/github.com/niemeyer/pretty@v0.0.0-20200227124842-a10e7caefd8e"></dependency>
      <dependency ref="pkg:golang/github.com/pkg/errors@v0.9.1"></dependency>
      <dependency ref="pkg:golang/gopkg.in/check.v1@v1.0.0-20200227125254-8fa46927fb4f"></dependency>
      <dependency ref="pkg:golang/gopkg.in/yaml.v2@v2.2.8"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/keybase/go.dbus@v0.0.0-20200324223359-a94be52c0b03"></dependency>
    <dependency ref="pkg:golang/github.com/klauspost/compress@v1.9.7"></dependency>
    <dependency ref="pkg:golang/github.com/klauspost/cpuid@v1.2.1"></dependency>
    <dependency ref="pkg:golang/github.com/konsorten/go-windows-terminal-sequences@v1.0.2"></dependency>
    <dependency ref="pkg:golang/github.com/kr/pretty@v0.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/kr/pty@v1.1.1"></dependency>
    <dependency ref="pkg:golang/github.com/kr/text@v0.2.0">
      <dependency ref="pkg:golang/github.com/creack/pty@v1.1.9"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/labstack/echo/v4@v4.1.11">
      <dependency ref="pkg:golang/github.com/dgrijalva/jwt-go@v3.2.0"></dependency>
      <dependency ref="pkg:golang/github.com/labstack/gommon@v0.3.0"></dependency>
      <dependency ref="pkg:golang/github.com/valyala/fasttemplate@v1.0.1"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/labstack/gommon@v0.3.0">
      <dependency ref="pkg:golang/github.com/valyala/fasttemplate@v1.0.1"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/logrusorgru/aurora@v2.0.3"></dependency>
    <dependency ref="pkg:golang/github.com/magiconair/properties@v1.8.0"></dependency>
    <dependency ref="pkg:golang/github.com/martinlindhe/base36@v1.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/mattn/go-colorable@v0.1.4"></dependency>
    <dependency ref="pkg:golang/github.com/mattn/go-isatty@v0.0.11"></dependency>
    <dependency ref="pkg:golang/github.com/mattn/go-runewidth@v0.0.9"></dependency>
    <dependency ref="pkg:golang/github.com/mattn/goveralls@v0.0.2"></dependency>
    <dependency ref="pkg:golang/github.com/mediocregopher/radix/v3@v3.4.2">
      <dependency ref="pkg:golang/github.com/davecgh/go-spew@v1.1.1"></dependency>
      <dependency ref="pkg:golang/github.com/pmezard/go-difflib@v1.0.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/microcosm-cc/bluemonday@v1.0.2"></dependency>
    <dependency ref="pkg:golang/github.com/miekg/dns@v1.1.41">
      <dependency ref="pkg:golang/golang.org/x/sync@v0.0.0-20210220032951-036812b2e83c"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/mitchellh/go-homedir@v1.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/mitchellh/mapstructure@v1.1.2"></dependency>
    <dependency ref="pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd"></dependency>
    <dependency ref="pkg:golang/github.com/modern-go/reflect2@v1.0.1"></dependency>
    <dependency ref="pkg:golang/github.com/moul/http2curl@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/nats-io/jwt@v0.3.0">
      <dependency ref="pkg:golang/github.com/nats-io/nkeys@v0.1.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/nats-io/nats.go@v1.9.1">
      <dependency ref="pkg:golang/github.com/nats-io/jwt@v0.3.0"></dependency>
      <dependency ref="pkg:golang/github.com/nats-io/nkeys@v0.1.0"></dependency>
      <dependency ref="pkg:golang/github.com/nats-io/nuid@v1.0.1"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/nats-io/nkeys@v0.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/nats-io/nuid@v1.0.1"></dependency>
    <dependency ref="pkg:golang/github.com/niemeyer/pretty@v0.0.0-20200227124842-a10e7caefd8e"></dependency>
    <dependency ref="pkg:golang/github.com/nsf/jsondiff@v0.0.0-20200515183724-f29ed568f4ce"></dependency>
    <dependency ref="pkg:golang/github.com/olekukonko/tablewriter@v0.0.4"></dependency>
    <dependency ref="pkg:golang/github.com/onsi/ginkgo@v1.10.3"></dependency>
    <dependency ref="pkg:golang/github.com/onsi/gomega@v1.7.1">
      <dependency ref="pkg:golang/github.com/fsnotify/fsnotify@v1.4.7"></dependency>
      <dependency ref="pkg:golang/github.com/hpcloud/tail@v1.0.0"></dependency>
      <dependency ref="pkg:golang/gopkg.in/fsnotify.v1@v1.4.7"></dependency>
      <dependency ref="pkg:golang/gopkg.in/tomb.v1@v1.0.0-20141024135613-dd632973f1e7"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/pelletier/go-toml@v1.2.0"></dependency>
    <dependency ref="pkg:golang/github.com/pingcap/errors@v0.11.4"></dependency>
    <dependency ref="pkg:golang/github.com/pkg/errors@v0.9.1"></dependency>
    <dependency ref="pkg:golang/github.com/pmezard/go-difflib@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/russross/blackfriday@v1.5.2"></dependency>
    <dependency ref="pkg:golang/github.com/russross/blackfriday/v2@v2.0.1"></dependency>
    <dependency ref="pkg:golang/github.com/ryanuber/columnize@v2.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/schollz/closestmatch@v2.1.0"></dependency>
    <dependency ref="pkg:golang/github.com/sergi/go-diff@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/shurcooL/sanitized_anchor_name@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/sirupsen/logrus@v1.7.0">
      <dependency ref="pkg:golang/github.com/davecgh/go-spew@v1.1.1"></dependency>
      <dependency ref="pkg:golang/github.com/pmezard/go-difflib@v1.0.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/skratchdot/open-golang@v0.0.0-20200116055534-eef842397966"></dependency>
    <dependency ref="pkg:golang/github.com/smartystreets/assertions@v0.0.0-20180927180507-b2de0cb4f26d"></dependency>
    <dependency ref="pkg:golang/github.com/smartystreets/goconvey@v1.6.4">
      <dependency ref="pkg:golang/github.com/jtolds/gls@v4.20.0"></dependency>
      <dependency ref="pkg:golang/github.com/smartystreets/assertions@v0.0.0-20180927180507-b2de0cb4f26d"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/spf13/afero@v1.1.2"></dependency>
    <dependency ref="pkg:golang/github.com/spf13/cast@v1.3.0">
      <dependency ref="pkg:golang/github.com/davecgh/go-spew@v1.1.1"></dependency>
      <dependency ref="pkg:golang/github.com/pmezard/go-difflib@v1.0.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/spf13/cobra@v0.0.5">
      <dependency ref="pkg:golang/github.com/BurntSushi/toml@v0.3.1"></dependency>
      <dependency ref="pkg:golang/github.com/cpuguy83/go-md2man@v1.0.10"></dependency>
      <dependency ref="pkg:golang/github.com/inconshreveable/mousetrap@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/mitchellh/go-homedir@v1.1.0"></dependency>
      <dependency ref="pkg:golang/github.com/spf13/pflag@v1.0.3"></dependency>
      <dependency ref="pkg:golang/github.com/spf13/viper@v1.3.2"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/spf13/jwalterweatherman@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/spf13/pflag@v1.0.3"></dependency>
    <dependency ref="pkg:golang/github.com/spf13/viper@v1.3.2">
      <dependency ref="pkg:golang/github.com/armon/consul-api@v0.0.0-20180202201655-eb2c6b5be1b6"></dependency>
      <dependency ref="pkg:golang/github.com/coreos/etcd@v3.3.10"></dependency>
      <dependency ref="pkg:golang/github.com/coreos/go-etcd@v2.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/coreos/go-semver@v0.2.0"></dependency>
      <dependency ref="pkg:golang/github.com/fsnotify/fsnotify@v1.4.7"></dependency>
      <dependency ref="pkg:golang/github.com/hashicorp/hcl@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/magiconair/properties@v1.8.0"></dependency>
      <dependency ref="pkg:golang/github.com/mitchellh/mapstructure@v1.1.2"></dependency>
      <dependency ref="pkg:golang/github.com/pelletier/go-toml@v1.2.0"></dependency>
      <dependency ref="pkg:golang/github.com/spf13/afero@v1.1.2"></dependency>
      <dependency ref="pkg:golang/github.com/spf13/cast@v1.3.0"></dependency>
      <dependency ref="pkg:golang/github.com/spf13/jwalterweatherman@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/spf13/pflag@v1.0.3"></dependency>
      <dependency ref="pkg:golang/github.com/xordataexchange/crypt@v0.0.3-0.20170626215501-b2862e3d0a77"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/ssor/bom@v0.0.0-20170718123548-6386211fdfcf"></dependency>
    <dependency ref="pkg:golang/github.com/stretchr/objx@v0.2.0">
      <dependency ref="pkg:golang/github.com/davecgh/go-spew@v1.1.1"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/stretchr/testify@v1.6.1">
      <dependency ref="pkg:golang/github.com/pmezard/go-difflib@v1.0.0"></dependency>
      <dependency ref="pkg:golang/gopkg.in/yaml.v3@v3.0.0-20200313102051-9f266ea9e77c"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/therecipe/qt@v0.0.0-20200701200531-7f61353ee73e">
      <dependency ref="pkg:golang/github.com/konsorten/go-windows-terminal-sequences@v1.0.2"></dependency>
      <dependency ref="pkg:golang/github.com/stretchr/objx@v0.2.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/ugorji/go@v1.1.7">
      <dependency ref="pkg:golang/github.com/ugorji/go/codec@v1.1.7"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/ugorji/go/codec@v1.1.7">
      <dependency ref="pkg:golang/github.com/ugorji/go@v1.1.7"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/urfave/cli/v2@v2.2.0">
      <dependency ref="pkg:golang/github.com/BurntSushi/toml@v0.3.1"></dependency>
      <dependency ref="pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.0-20190314233015-f79a8a8ca69d"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/urfave/negroni@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/valyala/bytebufferpool@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/valyala/fasthttp@v1.6.0">
      <dependency ref="pkg:golang/github.com/klauspost/cpuid@v1.2.1"></dependency>
      <dependency ref="pkg:golang/github.com/valyala/bytebufferpool@v1.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/valyala/tcplisten@v0.0.0-20161114210144-ceec8f93295a"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/valyala/fasttemplate@v1.0.1">
      <dependency ref="pkg:golang/github.com/valyala/bytebufferpool@v1.0.0"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/valyala/tcplisten@v0.0.0-20161114210144-ceec8f93295a"></dependency>
    <dependency ref="pkg:golang/github.com/vmihailenco/msgpack/v5@v5.1.3">
      <dependency ref="pkg:golang/github.com/stretchr/testify@v1.6.1"></dependency>
      <dependency ref="pkg:golang/github.com/vmihailenco/tagparser@v0.1.2"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/vmihailenco/tagparser@v0.1.2"></dependency>
    <dependency ref="pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20180127040702-4e3ac2762d5f"></dependency>
    <dependency ref="pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415"></dependency>
    <dependency ref="pkg:golang/github.com/xeipuuv/gojsonschema@v1.2.0">
      <dependency ref="pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20180127040702-4e3ac2762d5f"></dependency>
      <dependency ref="pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415"></dependency>
    </dependency>
    <dependency ref="pkg:golang/github.com/xordataexchange/crypt@v0.0.3-0.20170626215501-b2862e3d0a77"></dependency>
    <dependency ref="pkg:golang/github.com/yalp/jsonpath@v0.0.0-20180802001716-5cc68e5049a0"></dependency>
    <dependency ref="pkg:golang/github.com/yudai/gojsondiff@v1.0.0"></dependency>
    <dependency ref="pkg:golang/github.com/yudai/golcs@v0.0.0-20170316035057-ecda9a501e82"></dependency>
    <dependency ref="pkg:golang/github.com/yudai/pp@v2.0.1"></dependency>
    <dependency ref="pkg:golang/go.etcd.io/bbolt@v1.3.5"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/crypto@v0.0.0-20201112115411-41db4ea0dd1c"></dependency>
    <dependency ref="pkg:golang/golang.org/x/exp@v0.0.0-20190731235908-ec7cb31e5a56">
      <dependency ref="pkg:golang/github.com/BurntSushi/xgb@v0.0.0-20160522181843-27f122750802"></dependency>
    </dependency>
    <dependency ref="pkg:golang/golang.org/x/image@v0.0.0-20190802002840-cff245a6509b"></dependency>
    <dependency ref="pkg:golang/golang.org/x/mobile@v0.0.0-20200801112145-973feb4309de">
      <dependency ref="pkg:golang/golang.org/x/exp@v0.0.0-20190731235908-ec7cb31e5a56"></dependency>
      <dependency ref="pkg:golang/golang.org/x/image@v0.0.0-20190802002840-cff245a6509b"></dependency>
      <dependency ref="pkg:golang/golang.org/x/mod@v0.1.1-0.20191209134235-331c550502dd"></dependency>
      <dependency ref="pkg:golang/golang.org/x/tools@v0.0.0-20200117012304-6edc0a871e69"></dependency>
    </dependency>
    <dependency ref="pkg:golang/golang.org/x/mod@v0.1.1-0.20191209134235-331c550502dd"></dependency>
    <dependency ref="pkg:golang/golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4">
      <dependency ref="pkg:golang/golang.org/x/sys@v0.0.0-20210330210617-4fbd30eecc44"></dependency>
      <dependency ref="pkg:golang/golang.org/x/term@v0.0.0-20201126162022-7de9c90e9dd1"></dependency>
    </dependency>
    <dependency ref="pkg:golang/golang.org/x/sync@v0.0.0-20210220032951-036812b2e83c"></dependency>
    <dependency ref="pkg:golang/golang.org/x/sys@v0.0.0-20210330210617-4fbd30eecc44"></dependency>
    <dependency ref="pkg:golang/golang.org/x/term@v0.0.0-20201126162022-7de9c90e9dd1"></dependency>
    <dependency ref="pkg:golang/golang.org/x/text@v0.3.5-0.20201125200606-c27b9fd57aec"></dependency>
    <dependency ref="pkg:golang/golang.org/x/tools@v0.0.0-20200117012304-6edc0a871e69"></dependency>
    <dependency ref="pkg:golang/golang.org/x/xerrors@v0.0.0-20191204190536-9bdfabe68543"></dependency>
    <dependency ref="pkg:golang/gopkg.in/check.v1@v1.0.0-20200227125254-8fa46927fb4f"></dependency>
    <dependency ref="pkg:golang/gopkg.in/fsnotify.v1@v1.4.7"></dependency>
    <dependency ref="pkg:golang/gopkg.in/go-playground/assert.v1@v1.2.1"></dependency>
    <dependency ref="pkg:golang/gopkg.in/go-playground/validator.v8@v8.18.2"></dependency>
    <dependency ref="pkg:golang/gopkg.in/ini.v1@v1.51.1"></dependency>
    <dependency ref="pkg:golang/gopkg.in/mgo.v2@v2.0.0-20180705113604-9856a29383ce"></dependency>
    <dependency ref="pkg:golang/gopkg.in/tomb.v1@v1.0.0-20141024135613-dd632973f1e7"></dependency>
    <dependency ref="pkg:golang/gopkg.in/yaml.v2@v2.2.8"></dependency>
    <dependency ref="pkg:golang/gopkg.in/yaml.v3@v3.0.0-20200313102051-9f266ea9e77c"></dependency>
    <dependency ref="pkg:golang/github.com/ProtonMail/proton-bridge@v1.8.0">
      <dependency ref="pkg:golang/github.com/0xAX/notificator@v0.0.0-20191016112426-3962a5ea8da1"></dependency>
      <dependency ref="pkg:golang/github.com/Masterminds/semver/v3@v3.1.0"></dependency>
      <dependency ref="pkg:golang/github.com/ProtonMail/go-autostart@v0.0.0-20181114175602-c5272053443a"></dependency>
      <dependency ref="pkg:golang/github.com/ProtonMail/go-imap-id@v0.0.0-20190926060100-f94a56b9ecde"></dependency>
      <dependency ref="pkg:golang/github.com/ProtonMail/go-rfc5322@v0.5.0"></dependency>
      <dependency ref="pkg:golang/github.com/ProtonMail/go-vcard@v0.0.0-20180326232728-33aaa0a0c8a5"></dependency>
      <dependency ref="pkg:golang/github.com/ProtonMail/gopenpgp/v2@v2.1.3"></dependency>
      <dependency ref="pkg:golang/github.com/PuerkitoBio/goquery@v1.5.1"></dependency>
      <dependency ref="pkg:golang/github.com/abiosoft/ishell@v2.0.0"></dependency>
      <dependency ref="pkg:golang/github.com/abiosoft/readline@v0.0.0-20180607040430-155bce2042db"></dependency>
      <dependency ref="pkg:golang/github.com/allan-simon/go-singleinstance@v0.0.0-20160830203053-79edcfdc2dfc"></dependency>
      <dependency ref="pkg:golang/github.com/chzyer/logex@v1.1.10"></dependency>
      <dependency ref="pkg:golang/github.com/chzyer/test@v0.0.0-20180213035817-a1ea475d72b1"></dependency>
      <dependency ref="pkg:golang/github.com/cucumber/godog@v0.8.1"></dependency>
      <dependency ref="pkg:golang/github.com/ProtonMail/docker-credential-helpers@v1.1.0"></dependency>
      <dependency ref="pkg:golang/github.com/ProtonMail/go-imap@v0.0.0-20201228133358-4db68cea0cac"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-imap-appendlimit@v0.0.0-20190308131241-25671c986a6a"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-imap-idle@v0.0.0-20200601154248-f05f54664cc4"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-imap-move@v0.0.0-20190710073258-6e5a51a5b342"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-imap-quota@v0.0.0-20210203125329-619074823f3c"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-imap-unselect@v0.0.0-20171113212723-b985794e5f26"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-mbox@v1.0.2"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-message@v0.12.1-0.20201221184100-40c3f864532b"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-sasl@v0.0.0-20200509203442-7bfe0ed36a21"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-smtp@v0.14.0"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-textwrapper@v0.0.0-20200911093747-65d896831594"></dependency>
      <dependency ref="pkg:golang/github.com/emersion/go-vcard@v0.0.0-20190105225839-8856043f13c5"></dependency>
      <dependency ref="pkg:golang/github.com/fatih/color@v1.9.0"></dependency>
      <dependency ref="pkg:golang/github.com/flynn-archive/go-shlex@v0.0.0-20150515145356-3f9db97f8568"></dependency>
      <dependency ref="pkg:golang/github.com/getsentry/sentry-go@v0.8.0"></dependency>
      <dependency ref="pkg:golang/github.com/go-resty/resty/v2@v2.6.0"></dependency>
      <dependency ref="pkg:golang/github.com/golang/mock@v1.4.4"></dependency>
      <dependency ref="pkg:golang/github.com/google/go-cmp@v0.5.1"></dependency>
      <dependency ref="pkg:golang/github.com/google/uuid@v1.1.1"></dependency>
      <dependency ref="pkg:golang/github.com/gopherjs/gopherjs@v0.0.0-20190430165422-3e4dfb77656c"></dependency>
      <dependency ref="pkg:golang/github.com/hashicorp/go-multierror@v1.1.0"></dependency>
      <dependency ref="pkg:golang/github.com/ProtonMail/bcrypt@v0.0.0-20170924085257-7509ea014998"></dependency>
      <dependency ref="pkg:golang/github.com/jaytaylor/html2text@v0.0.0-20200412013138-3577fbdbcff7"></dependency>
      <dependency ref="pkg:golang/github.com/keybase/go-keychain@v0.0.0-20200502122510-cda31fe0c86d"></dependency>
      <dependency ref="pkg:golang/github.com/logrusorgru/aurora@v2.0.3"></dependency>
      <dependency ref="pkg:golang/github.com/mattn/go-runewidth@v0.0.9"></dependency>
      <dependency ref="pkg:golang/github.com/miekg/dns@v1.1.41"></dependency>
      <dependency ref="pkg:golang/github.com/nsf/jsondiff@v0.0.0-20200515183724-f29ed568f4ce"></dependency>
      <dependency ref="pkg:golang/github.com/olekukonko/tablewriter@v0.0.4"></dependency>
      <dependency ref="pkg:golang/github.com/pkg/errors@v0.9.1"></dependency>
      <dependency ref="pkg:golang/github.com/sirupsen/logrus@v1.7.0"></dependency>
      <dependency ref="pkg:golang/github.com/skratchdot/open-golang@v0.0.0-20200116055534-eef842397966"></dependency>
      <dependency ref="pkg:golang/github.com/ssor/bom@v0.0.0-20170718123548-6386211fdfcf"></dependency>
      <dependency ref="pkg:golang/github.com/stretchr/testify@v1.6.1"></dependency>
      <dependency ref="pkg:golang/github.com/therecipe/qt@v0.0.0-20200701200531-7f61353ee73e"></dependency>
      <dependency ref="pkg:golang/github.com/urfave/cli/v2@v2.2.0"></dependency>
      <dependency ref="pkg:golang/github.com/vmihailenco/msgpack/v5@v5.1.3"></dependency>
      <dependency ref="pkg:golang/go.etcd.io/bbolt@v1.3.5"></dependency>
      <dependency ref="pkg:golang/github.com/ProtonMail/crypto@v0.0.0-20201112115411-41db4ea0dd1c"></dependency>
      <dependency ref="pkg:golang/golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4"></dependency>
      <dependency ref="pkg:golang/golang.org/x/text@v0.3.5-0.20201125200606-c27b9fd57aec"></dependency>
    </dependency>
  </dependencies>
</bom>

Wie fängt man an?

  • Kartografieren aller Programmiersprachen und Paketmanager
    • Betriebssystem (apt, yum, dnf, …)
    • C++ (CppCheck, Doxygen, Conan, C++20 Modules, …)
    • Java™ (Maven, …)
    • PHP (Composer, Packagist, …)
    • Python (pip)
  • Sammeln aller Metadaten (der Komponenten)
  • Erstellen des Manifests
  • Manifeste werden oft/anfangs unvollständig sein!

C++ Projekt CVE Importer

Code Umfang

  • 5 eigene Teile (jeweils Header und Code)
  • externer MariaDB C++ Connector (von Source installiert)
  • externe simdjson Bibliothek (direkt eingebaut, Update bei neuer Version)
  • Bibliotheken aus Debian Umgebung (Pakete)
  • ldd liefert 47 Bibliotheken (inklusive linux-vdso)
  • Clang Compiler liest in Summe 1225 Header Dateien
    • für Clean Build Target
    • Flags -MD -DF ermitteln alle Header
  • 5+5+47+1225 Abhängigkeiten (vollständig?)

Komponenten richtig zählen

  • Komponenten sind logische Blöcke
    • eigener Code (5+5 Dateien)
    • Bibliothek MariaDB C++ Connector
    • Bibliothek simdjson (nicht sichtbar mit ldd)
    • 45 Bibliotheken insgesamt (ldd)
    • 36 Debian Pakete
  • Komponenten können zu Gruppen gehören (Pakete)
  • Dateien mit Checksummen angeben!

CycloneDX SBOM für Projekt

                
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
	<metadata>
		<timestamp>2023-03-29T11:15:13</timestamp>
		<tools>
			<tool>
				<vendor>code.deepsec.net</vendor>
				<name>SBOM_Check</name>
				<version>V0.5</version>
			</tool>
		</tools>
	</metadata>
	<components>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libjemalloc.so.2</name>
			<group>libjemalloc2:amd64</group>
			<version>5.2.1-3</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libjemalloc2:amd64@5.2.1-3?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">be92467c3ebcec3ffedd9456e36d26102dee992f4bdf894b1caf91f29d7ae9fc</hash>
				<hash alg="SHA-512">e20365b28b2da6ed6725256582b5e2a930b33f03ea46172d02b15817d8a0d2ea2a75bb943ee1f7b0355b5561fb07ddf7cf523d005f347936c5e0ee11a7235acf</hash>
				<hash alg="SHA3-512">cc18a6e440ba9ae211bf8023676538dfcf2e0eb697ea07eaad017860ec06158e7ec0b686e742dd358f782a873b5a7a765b0d3e621424754ce9d6daaf46a585ac</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/local/lib/mariadb/libmariadbcpp.so</name>
			<group></group>
			<version></version>
			<scope>required</scope>
			<purl>pkg:deb/debian/@?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">571854a5a00ab28fb91082c1237fbeb22aa1a82b1fc54e148b08c85172be46e5</hash>
				<hash alg="SHA-512">b4e5f97333a606eb88619084e6bd200b8f1d581aa56a33c8656f4425b8c3e58c20885ef209e500ed6780f78fddf2c932729ac1da42fa2c7461c275252ea121dc</hash>
				<hash alg="SHA3-512">63664d7485b2ca3d7313bc77711501b47f6ba97dcce03d9a96a39c3cee96d77f2e8dad4b76d86d99034450aade08a3c0840e38f502fdba7709c64d53465952ed</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libboost_program_options.so.1.74.0</name>
			<group>libboost-program-options1.74.0:amd64</group>
			<version>1.74.0-9</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libboost-program-options1.74.0:amd64@1.74.0-9?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">37e6297d3bcc19fa96e5a29e29b5f425633e254f6d163038f0a68a61b1c5afe9</hash>
				<hash alg="SHA-512">c1603df5cb6b161ee04d78550aef9364801d3d636cd9f507a60d39ba90a05b0bfe476f30132e0b2227d11ee1678de1f03673a409af4470541a77a9bc6d97ff4d</hash>
				<hash alg="SHA3-512">dbcb8cc5c4f56ccf74b4b8827b8bd350e6e4218deac478611eadea09ff67f8d9f66cdca26442913a555ba3364930cbdf70cbe83c91efc351c2332c602e2523f0</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libcurl.so.4</name>
			<group>libcurl4:amd64</group>
			<version>7.88.1-7~bpo11+2</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libcurl4:amd64@7.88.1-7~bpo11+2?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">e2272651c672ff92435935878413dc3bd761bb2a36d0be8aff92662985236789</hash>
				<hash alg="SHA-512">82f9a9d88a95c3b5500a06638382b27a21a7141fb9478bede1ab80116881be75b39166b58d4a2cb1b44edd3d552255b964576c785668acc732ceabe9f3f7ed51</hash>
				<hash alg="SHA3-512">b1f9cc2b80b7523ee0b63d7ee42cf14ffeb4d6d6245891e9dff49a336c079bcd67bf3d16482b258a891560089352d53e778020a6748b885bcd31722148620a74</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libssl.so.1.1</name>
			<group>libssl1.1:amd64</group>
			<version>1.1.1n-0+deb11u4</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libssl1.1:amd64@1.1.1n-0+deb11u4?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">f8da170d6c1a91de1f9cd2d8e901c6f52d90026700f9f5a115ad33c5c902fa78</hash>
				<hash alg="SHA-512">e686e7069f50130b9b0eed0d7ac4e9a8ca4a88efc32d110d6756766b6481d591b7b7f7ab8b6b48d83436e5a2e83f4f809e029abede4ea47274db9aebe0fc0249</hash>
				<hash alg="SHA3-512">8f8035d6f1cf698bd909185fe08dbbec395d6eec814c4e610a52cde80a1f3fed5ae67eeff3a44d605778bf6245a5639eff83525b6183528832587b27ba05da3f</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libcrypto.so.1.1</name>
			<group>libssl1.1:amd64</group>
			<version>1.1.1n-0+deb11u4</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libssl1.1:amd64@1.1.1n-0+deb11u4?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">29c44de6fe43cf0c645f01319240b6109d715d2b2f7dc6df39e60191e45b6ce1</hash>
				<hash alg="SHA-512">4e94c4646068465f04634b2ecd90de732bc93e3c1601ef9608e6be23dd53890c9690f178fafbfc641a0c94bb63dd06e295fbd5fd79e43303908771c1933b6861</hash>
				<hash alg="SHA3-512">5ae780571e57e9bb8c4def5656ffabae24c656e78019402fffde79452bcc662c17d2d7e4f22afd1163dc55866d1fe3340a5ca635663f096b6bb35cf17a1d5241</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libtbb.so.2</name>
			<group>libtbb2:amd64</group>
			<version>2020.3-1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libtbb2:amd64@2020.3-1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">9a2870b5cc7ac279e570b98b7bd9ace2603d0f4e19757ba94086272666cc1004</hash>
				<hash alg="SHA-512">97ff7726c462fda218e8f1362df06184ae4b76718597cad8cebf0dd78f1e97bdc82dd0a4e692d3d6feda018c4d3b0bca6da79f2c70275b2a73493f87af8dbfcc</hash>
				<hash alg="SHA3-512">6c3c62485237b4e933c2b1245e3b5bc5aab9bfbf682530fa9569a0ec499b1e223f84930e7d372a79b0b0826edbc1dd8e65f6418c7379af80e0e275adae04e500</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libpugixml.so.1</name>
			<group>libpugixml1v5:amd64</group>
			<version>1.11.4-1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libpugixml1v5:amd64@1.11.4-1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">3ab1ffdfd447349373d2c3b8d39520e12e9772686d7fdcae0c573c12c0c87f80</hash>
				<hash alg="SHA-512">04ad628e90367332084ccad30094d4a728051c165f5deaa4a9826479aab43bb8615a46274156e56f2d7ff71273b6e0db32c46623b650f54f8026db3f309ec05f</hash>
				<hash alg="SHA3-512">a629c2f3a74f65eab83a1658afe099aa40aafdb878fa9f113f6dd936ae711eaed808d35f09b218ee207280d69489c435459ff019a31c85ea3d615aaaf5fcc00d</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libstdc++.so.6</name>
			<group>libstdc++6:amd64</group>
			<version>10.2.1-6</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libstdc++6:amd64@10.2.1-6?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">0e83d02a0144c726f05de850b71165691e380bd90205d22dd04bc8f788625507</hash>
				<hash alg="SHA-512">8ac657b5c1c3c85fccb8751021521aa3819c48ac39dc473dfb19e797c843c5ddbe25c800c43f65ee429b14040c9b4f333065b931f8ae80b812f4a02e4aa86432</hash>
				<hash alg="SHA3-512">cdcd7c2ee40cc387455ec05e30ccb5a167f62da1825facc8a043cd23440e9fa5afbc2b222ec3b046a2b3e8342b5a85b0f6fbcdf4701b8e6ca7db6e95b7cf9583</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/libm.so.6</name>
			<group>libc6:amd64</group>
			<version>2.31-13+deb11u5</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libc6:amd64@2.31-13+deb11u5?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">5461e535328078fb72f25f7ca2bf36bc71c415bbf573ccdfa289a7b796ddfdd3</hash>
				<hash alg="SHA-512">d8d3b493e8491d2a6d69c0aa624d87c459c8f94fe2bca61dda5729a62ce212ba68e31e6b61077ec05de5474e6e65e2c333f7c4d7e56c1ca426ede9ef4f7d05c9</hash>
				<hash alg="SHA3-512">9d2b1b30f07e2d18929ad1eaad60fe650222c0dc7c333da3c354185471e247388fb1ef9403707dc3a4f58c15a9a392ad088bf8b24986c98e8d47c93f3c8a9f93</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/libpthread.so.0</name>
			<group>libc6:amd64</group>
			<version>2.31-13+deb11u5</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libc6:amd64@2.31-13+deb11u5?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">9807a603f7e37097a442126303e0705a85f38ad4926db8eaf5db4befad118e11</hash>
				<hash alg="SHA-512">122f0d0dfa64eb51a171df3bdb36e4359ddde9a5fbcb02059a3b57c12c5af84b0e20d61cf4678892dafed3e7ce4a44969fc17c6961772e2fb1cce45851d5a423</hash>
				<hash alg="SHA3-512">11ce8512f2a6920afc17e9ad9a7791f8b671003acc825119d87202677b8b61cd13e227877fac9c0ff5709392c7217213bdf530da98a747e76d9682c3ec92dd71</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/librt.so.1</name>
			<group>libc6:amd64</group>
			<version>2.31-13+deb11u5</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libc6:amd64@2.31-13+deb11u5?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">a24ccd19ad1dc82d78d825553c4ad8332e25f879970fe602d230312d93b5ce23</hash>
				<hash alg="SHA-512">e17fa9f3da92642789d5e3528242b49f87a8f1910009194723b879c9b0cc4543c194580b47bf2531946547470290e8bff71260d9195f7a6df3e286a09ed03230</hash>
				<hash alg="SHA3-512">906198b552fe29e50e6091dc427ebfa667bd4d4e79baaaff02c59f31f5565cb3adfc2fe7f89c160d178722fee2f2c6ad69a426c69e017a88a672895a9f4427c0</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/libdl.so.2</name>
			<group>libc6:amd64</group>
			<version>2.31-13+deb11u5</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libc6:amd64@2.31-13+deb11u5?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">df5973c718b4ee540cdd4400e19e90182ab5f3bac2148c0c9f3bb92eb6af3121</hash>
				<hash alg="SHA-512">007f2ad157affe1cc5a44c3275a633e566123e1d56733514c9205566c3be991740e7ea08969bdbbd6492bf151664bbe944f3c5f8fc40052e6066357c8e380974</hash>
				<hash alg="SHA3-512">c99dfa1110e0cb16f79b3870e004f0380f1a4a8c14865f416225e4cf49f3c6dc8b863e0189ddc2d2231d1e74847592e4faa425b8d1473774ae46a9ab67574b87</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/libresolv.so.2</name>
			<group>libc6:amd64</group>
			<version>2.31-13+deb11u5</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libc6:amd64@2.31-13+deb11u5?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">86cd80f50c3001c44539588f8215f9037a6ed4ab9c4772f76519988dd087b2ad</hash>
				<hash alg="SHA-512">5eef874df1141429a8fb5e28ea49a7206854eca2bdc549d29801c249f1a9f6ca95a78f5540a735b7432215d0897c4f6fe16e24f211fe6f104b618b1d3890e585</hash>
				<hash alg="SHA3-512">0decd1f3b25cf8c54b4d25d6ba9f8c1f451d00ae20fe18921215252633f6c300e012d8b1fa27c932a6f5de62a54546e95f68d42878b802611ef4ef2ee4290b62</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/libgcc_s.so.1</name>
			<group>libgcc-s1:amd64</group>
			<version>10.2.1-6</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libgcc-s1:amd64@10.2.1-6?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">2d771c2e232fce107c7ec7f9a64b9a804e6d6737063088a2d8096b149a0af8cd</hash>
				<hash alg="SHA-512">654603c691e17e056471efcf4d49037eefc97df47640483bde557b77419d1b7c5d6a9523d92446d36ea250806d0adbfa49b3c25ce73a43186997fa4eefa98469</hash>
				<hash alg="SHA3-512">c7569f7302d1cf0a1fb8a5d0591d2e8586d068a44c6cb2b5537b55930cfd5cf9601f28575da7b6bce7f51f228139252bcc408656e46a5e588b577a64891b385f</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/libc.so.6</name>
			<group>libc6:amd64</group>
			<version>2.31-13+deb11u5</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libc6:amd64@2.31-13+deb11u5?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">263e55f639b540a00fc87e7fdc10078c1cbe89e148ea440ad1a9cef1cbd53c6f</hash>
				<hash alg="SHA-512">8ff4f3f5c33abadfb9d32f11a2d8096c7e8020d53d82f23764688273f565962c2b4e779a832c7755ca0f2517f8cad578dcb1aee8bf78bc666b342265530cefcf</hash>
				<hash alg="SHA3-512">65445aec0f08796c88c9ae3db8ec707355f6e66a60733c6e82d8366cda4ca457937644f9a47b801e403cc4ac044a6c1c5a74debced25b62b164b5a9ce820093f</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libmariadb.so.3</name>
			<group>libmariadb3:amd64</group>
			<version>1:10.5.18-0+deb11u1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libmariadb3:amd64@1:10.5.18-0+deb11u1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">64181043e8d6abb771c79e620e0378a288a743bd74e34879f34d46dfeef130b8</hash>
				<hash alg="SHA-512">c564859c869575130a8ff44d2e09eccf6486c6274d317cd674361a53384c3cf96341cd7e6a9fa52954ccf9496e767f18107d37bc86f8957f77d1369be626e2c2</hash>
				<hash alg="SHA3-512">d39b426218bb14c8f6c537edf0cd0b90b6b2a889ba76f19f98507d3d5052b14e19e5b53cf5890e231e16f5d2143a2f1a08be7a68efc9ea3ff2297107e386bcd8</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libnghttp2.so.14</name>
			<group>libnghttp2-14:amd64</group>
			<version>1.43.0-1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libnghttp2-14:amd64@1.43.0-1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">77bf4008e35d51413ed220a7dfdcc50b528581ca7e4cb8744aa2143b740931ec</hash>
				<hash alg="SHA-512">342a98540f6b1874c8baf309a06cb65fc7210c2be0ecc1790cfb20f99e8b497e96371d13c5c135302f85b2d51fc581c1ce6acb70ef86779da142b12793af5397</hash>
				<hash alg="SHA3-512">6f682c0f8f8195dc01b5cadaa4482a658f2f637d57cda374ee19489ae908dece5dde8305681f280c668fc570fe5556f047c69e67e10a8a204065c7eed3c3f114</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libidn2.so.0</name>
			<group>libidn2-0:amd64</group>
			<version>2.3.0-5</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libidn2-0:amd64@2.3.0-5?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">93fcee5c99e146a23bd500eeda83e07bb8ebd7c79e5f43ac09a9712aacd2baa0</hash>
				<hash alg="SHA-512">0b5d1779f449b2b3afb225235e72292e8d463b350067ea5f1bdc2233d85477267e8864b66c90851a2f51fbd281a84646f568ae2e3d0b30542612a855c4e03e8e</hash>
				<hash alg="SHA3-512">6a3740f60db766b34a103905c239b52e164aebb552a10aab6f6fab0451a5b543240f80b9922dc62060e090ddc02e79789bcbf9a44de192cd8f7eb95286ba9273</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/librtmp.so.1</name>
			<group>librtmp1:amd64</group>
			<version>2:2.4~20160119.gitfa8646dae-dmo7</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/librtmp1:amd64@2:2.4~20160119.gitfa8646dae-dmo7?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">a70b8edb0a0316980f3d2978144d3ca6c60a05e81e9c28f7c1c3929ca69e040e</hash>
				<hash alg="SHA-512">505af7afe9b8bde5c7bae7d9ab58bb45f366854119ffc51e58b01e0a6cddc076908dd2e5a5cdcda0daf918f4c272106166fbd569f5b253a1382c4aa65b32746a</hash>
				<hash alg="SHA3-512">2aa2b2ef35c586adeb8eae5d03bd97e3411fa47ace8bad1e4445246f8544a9cc895ef3f3bb35420c7753819021e4c2317033bcea4064351997a3be0a17796159</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libssh2.so.1</name>
			<group>libssh2-1:amd64</group>
			<version>1.9.0-2</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libssh2-1:amd64@1.9.0-2?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">b18f774efaf7e074338133ec9ae93dd3a94fb33ff2aa1eedbf4d5b45172d8e23</hash>
				<hash alg="SHA-512">da92260b488467878268db9a2409532bcf51b4ccc21fd4feb69ec5544a1e64f3c5c5a2a9646a05c7e3bf4ae51fa13b1564c4759d25bffeef67948452afc32743</hash>
				<hash alg="SHA3-512">0960a77dcc75b129e403b3be9b2b1c81d5c970132108c39fa8aa0781d9b9b42ec26d00732dbedff22db3d4c87bb49fcbade5b6e9b6fd076ad5cec8cb53a85f63</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libpsl.so.5</name>
			<group>libpsl5:amd64</group>
			<version>0.21.0-1.2</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libpsl5:amd64@0.21.0-1.2?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">fdbac9fe4ad96b16d715afe737b02937672370d96321b47229dd364a7f3bdc69</hash>
				<hash alg="SHA-512">bf62edb7decc3cd80d883dc77cb62f16fa15f27b87c3f7e81c92cb79f6a47aafbac3e6c4acc5f99c2d9a6879d8e14b5c5ee90a41008c7cb31125c5d484be5351</hash>
				<hash alg="SHA3-512">0db751ca767b0f5d09408fa6671521d12a360f56f99ccb55422c03fe2a2daa67b4b3df227c7c56e968b2cd53f185d1e2a00c6c4ba78ed46328728d4ad2aa4388</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2</name>
			<group>libgssapi-krb5-2:amd64</group>
			<version>1.18.3-6+deb11u3</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libgssapi-krb5-2:amd64@1.18.3-6+deb11u3?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">efc54b00cff17b2c49e3547d0076a30cee02cfd3be2ba754576d8c12a255a953</hash>
				<hash alg="SHA-512">bdff38a64595287c9323716de0e9bda7a282a070d7917b63a44124bd0001f8cfcb7ac674a1dfe2c0c4c85ae94e17d874670d2f9dcf0e2bde1a8fcea6b20a1de2</hash>
				<hash alg="SHA3-512">6d86ce80dcc9d3518c4350daf57fbc7a9cab982f118e17825e18c6dca6e38fcc20993dc31ed9695dfbdc492f08849af452b6c59c9698911d0bd2441449809a4f</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2</name>
			<group>libldap-2.4-2:amd64</group>
			<version>2.4.59+dfsg-1~bpo11+1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libldap-2.4-2:amd64@2.4.59+dfsg-1~bpo11+1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">b8d87d6c3ebf8509c69218aa519d3f14f74157bfb0d150d726982d4ead14977c</hash>
				<hash alg="SHA-512">23d48c37dff53ecd750417ed2321ae0035aa55902668195e37c8c1ab572a90af8eff7b0fb3537405f93fe6e1eb362b3f10c9286b9f84fe932490fc0e1abaf283</hash>
				<hash alg="SHA3-512">074e186e5b114b00a9864379204fa9fc4342d5d24dd14aa2f98ed66498df40f6998a7d248e02f1096a4067f7d032b06dca67541ce0fc11c82aacb0f0ce381bac</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/liblber-2.4.so.2</name>
			<group>libldap-2.4-2:amd64</group>
			<version>2.4.59+dfsg-1~bpo11+1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libldap-2.4-2:amd64@2.4.59+dfsg-1~bpo11+1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">dfa8cddd491fc8d77626c10f268aef30bb0f313789f4b8cf124f9c757067f77d</hash>
				<hash alg="SHA-512">ec556a190ec17c05acdd95d14fead6076b709b8d95b56bbc33043415d0f5ac8857ecc38d7e8994e8e12dd67d2e75835d658ba377b65b1563f1c92fd2148e54d4</hash>
				<hash alg="SHA3-512">905a151091483d273c29340ef2fd3819976c40a5f1f305b9389be8f5699ca64bec5094b34d3ef11c3810453993adb6d4bfe0327c57e8f0e4a6894584e9a5a0dc</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libzstd.so.1</name>
			<group>libzstd1:amd64</group>
			<version>1.4.8+dfsg-2.1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libzstd1:amd64@1.4.8+dfsg-2.1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">96200194950e60c3cee9aed6aea014c7eeec1260212ea2e3cbd4c9f97dd1ab8f</hash>
				<hash alg="SHA-512">d8eda670bc88adb09b823ff32a37b5ba92d9fc1b21a4eb5e5df665bd43f5a50d744e5c326354f3ea0cf5a5f7862a30d875ede5c4601cf45895a5b6843f2cf63c</hash>
				<hash alg="SHA3-512">e2ab679408515240745be67a48e7dc485403a75834cb6ab4035bccac285f72319065055b23c134d85676f79ebf6969311be21fc7c3d26df6f6ef19de1ab6a0af</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libbrotlidec.so.1</name>
			<group>libbrotli1:amd64</group>
			<version>1.0.9-2+b2</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libbrotli1:amd64@1.0.9-2+b2?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">998635bd10716965b4ab28657a92b040c95931b84bc821cfd74b01fd8b345fae</hash>
				<hash alg="SHA-512">67c0ea507db27d0528e44ff700fb8ca20e5e46dce04fe0e826ef90f29ab1e340d79e8b219a5f4c0bd981592defc4cc4dd678e2e210b4242eb4dd37bf04ae5887</hash>
				<hash alg="SHA3-512">1ec248cbbba9db24b619c6c17b41a1faaf7ee1c62d61db379ae9f0d367314b105ac52b575cef75ae45bcc041fc42dbce8cfd033d6cd6460372fd4e9232434713</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/libz.so.1</name>
			<group>zlib1g:amd64</group>
			<version>1:1.2.11.dfsg-2+deb11u2</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/zlib1g:amd64@1:1.2.11.dfsg-2+deb11u2?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">062372f2053424d8bafd9378ebdcc29a08d7e1850342b3fd5a0e73462ed84901</hash>
				<hash alg="SHA-512">1cb8338ce5fc0a5fb836a4dedfe8a0fd7180a27909ddfac052e770bc380b67f8fd6f7be7682518b1866ea36cbdef1ea3089ddef3966daeef2afd0ef930bcd699</hash>
				<hash alg="SHA3-512">caeeb954209f43297ba98910ec52075ebe6534580944aa5df70a63690e5e4bf1b40ddf6b03c6dcae01e1fd3cdfc63852a470a3ccc921f24ffd2efdb8d9471bf3</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libunistring.so.2</name>
			<group>libunistring2:amd64</group>
			<version>0.9.10-4</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libunistring2:amd64@0.9.10-4?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">e9bb6062a8ae8ec7cb282b9c9bde83ac956d2f9fcfa9161c9995af073ff4e55b</hash>
				<hash alg="SHA-512">d5d02e2125440d0306adfe0d584f37eebd9adc858dddfa1054b6761e10f205ee499a973368663b668e49938c36d0450f74708631acfa672412844b2cd41b8b6b</hash>
				<hash alg="SHA3-512">73bad7b0a61becd60c45d8ac5162552434ef4eb3c5788b4639a321972b16364fe8d0cb060161da912f325cb3fe3a47ff52952f1976ca07584633abee120b572b</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libgnutls.so.30</name>
			<group>libgnutls30:amd64</group>
			<version>3.7.1-5+deb11u3</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libgnutls30:amd64@3.7.1-5+deb11u3?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">bc7e81b1cc8fd740c1a05af987323ed7626e8fb2ecd904a6fb64ebf7cda55832</hash>
				<hash alg="SHA-512">19bd394ed5a5ec86bcad489ad0b2393b0c4d6adf3d4068063c28afcf94bae3f7edcdeb59538ced1e3217ba69421c4591a311a6013fd472ffdbd3ddbfc85c07d3</hash>
				<hash alg="SHA3-512">257ce26d84b32160da383be7fd561a6528e27726073dc9138cfa5c58fcc917a1ab285a10399a63cdf4226d3eb4e198f72c40658c8624de9bbb9046bfa7a48b5a</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libhogweed.so.6</name>
			<group>libhogweed6:amd64</group>
			<version>3.7.3-1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libhogweed6:amd64@3.7.3-1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">df1d03ec50bcb83f2c2d6700ac088ac505add67ab1b1c59b6b57ec9d96aa5881</hash>
				<hash alg="SHA-512">f3d51e9bb8afe865d26bead6d78d68383fe1c96051dade2f25c547dc6e107078b55074131a6f30a71d04f6ac78f5fa7dc9dc309bd9103530c8d5426f65acb8ed</hash>
				<hash alg="SHA3-512">388d11dfa59bd82ee95c3492b01539ce9f7cbee0a00f6f74ccd96fde8887458064274f036aa2fd8171b804bb51516d03cfa5508ec46bcaf9da287f9469ef2e2a</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libnettle.so.8</name>
			<group>libnettle8:amd64</group>
			<version>3.7.3-1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libnettle8:amd64@3.7.3-1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">1728ad2116381da96d69d62fdb09d774be4ae6d39187ad741732f100c4426d7a</hash>
				<hash alg="SHA-512">1960447eb9ab19823682800d9beba099666b1a8e277b9193343eaffd0ce0391ac190ae3efa8743f2cecbfae9b7f7eba8ccc7bee611dc18e4b56e92a139b1dadf</hash>
				<hash alg="SHA3-512">9c96bd08c8c80cb452ed7b320fd7094c9b6a2776003864fac10a87f5bd368e0534c0f441d4faca57aa1ca9cbe60a3e8a0b6e566f16bff7020829d821ac817fc3</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libgmp.so.10</name>
			<group>libgmp10:amd64</group>
			<version>2:6.2.1+dfsg-1+deb11u1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libgmp10:amd64@2:6.2.1+dfsg-1+deb11u1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">1ce1c61a3bb0eff2c58b3ff3a473972dc7d95d45fba8abaa0e5e993d923e80c2</hash>
				<hash alg="SHA-512">3afe6c46fa32de654c4ebb5e9f53230e38be46ae5ae044334c4bc04069575a3c0d66b498b494c4042d0cf7f276ea6df8296c242ee4ecc3b0229b141a9649421f</hash>
				<hash alg="SHA3-512">cfcf04ea87dc764334bdf81e9252af04e30bd7d8d8d1a307b16eed55cbe372251c87b7200036878e53a4f6ed9f4fa58fa8ef036cd6818feb40a00920226f583c</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libgcrypt.so.20</name>
			<group>libgcrypt20:amd64</group>
			<version>1.8.7-6</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libgcrypt20:amd64@1.8.7-6?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">babf88a99ae7a4b8640237d6928f52a7c51d3e009db2737fbc573111b816bb73</hash>
				<hash alg="SHA-512">1d9e8dda401013c98086306ffe22cdc347efe398eba556f52cbbec6bf3718f78a90edeeba7b069d35bc35fbcc6b0ec65334e6f137f9844eb8769db4a53e419a2</hash>
				<hash alg="SHA3-512">ef9c310f001ea740f10d443cf3591e007b8021ec800db14c977bf5a9c06f7a1720eb49f225899492e11f85d073a3640acb7040ee0cf43f9b36287a85d33e0cb9</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libkrb5.so.3</name>
			<group>libkrb5-3:amd64</group>
			<version>1.18.3-6+deb11u3</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libkrb5-3:amd64@1.18.3-6+deb11u3?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">d4e9b28c4f2f7acfac1a8558fcbcfb1dc356920871ec2e910a57495f7cce505c</hash>
				<hash alg="SHA-512">634af0cec82f66baa725c5d7b7965d068237b26045ad165a28fe7319328cfb4de8dab62bf44b4ee5842bc50a306c16ad115705ddc43836d032b55576a485d7dc</hash>
				<hash alg="SHA3-512">5257e7eaef6e578198a5e73563d71c423a98bf082cfad47a9725f29b9bfc624b7d5e88956013320e0c0f6641d31331900ffe6ce8d347f703d9ae0d721479b7fc</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libk5crypto.so.3</name>
			<group>libk5crypto3:amd64</group>
			<version>1.18.3-6+deb11u3</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libk5crypto3:amd64@1.18.3-6+deb11u3?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">0018c2a2281e6dcf05c83bea4beb880fd8b15ac52ac5312e0d04d5162cad5f42</hash>
				<hash alg="SHA-512">0b4a86d7f2556b24f462f2a3893cffb79a8873da129235b67b7e375f8cd442f383369b9dcbf40761dabba0a127837b642192feee70f0f78a6bf0414830dbdb99</hash>
				<hash alg="SHA3-512">6ffed1ddbb74419179d9faf9d2435442b97596bc5a7b1eaf9834d91d93403d4fb72391b9af8c3bae715c3073b7de41811feaaad4c95b341faa1e2db0f4c6f24b</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/libcom_err.so.2</name>
			<group>libcom-err2:amd64</group>
			<version>1.46.6-1~bpo11+1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libcom-err2:amd64@1.46.6-1~bpo11+1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">0c628ce4c46cbd783642c0e418c7f9c50a867c10dddec58ea4dc3d5db23e1b04</hash>
				<hash alg="SHA-512">5afa5605dee02d9c35a2402dbde3127fbe3cbd9a4b3a87dc5e23f3ea30d1089baca6dbacb9b4565a6e97bb48d626f9f80c2b6c5327e3dad12c1aaaf118ce966a</hash>
				<hash alg="SHA3-512">519fed7f12028dd1a86a446e44f12317c0a025c5736daabf8ec6c49b64fa749032e868ea31fc03743d732841b37c9bf0490b3bbb5c2546b9f2c242e4fc258acf</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libkrb5support.so.0</name>
			<group>libkrb5support0:amd64</group>
			<version>1.18.3-6+deb11u3</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libkrb5support0:amd64@1.18.3-6+deb11u3?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">9d50a32e1a9fe43ec9031be96938e7c85e0ea3ee06fd77fe01d8d0fdbff6ec65</hash>
				<hash alg="SHA-512">80760d801ada6143bca25caf6e455597a499b4366b7ec44a80af558ed2ec28609cf938e915d45d5224cd7cd6cb781720c3b7e143130c50546207d3e70f0f2bb5</hash>
				<hash alg="SHA3-512">8483ee561c7d5bf87a4480a2e8f096c91b4f19e3d465a4dc806dc0aaaf3a439b2039ace05490e6913c29f4df7d49cc921840626ddb475b7a4ab3e0bc39f44bd4</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libsasl2.so.2</name>
			<group>libsasl2-2:amd64</group>
			<version>2.1.27+dfsg-2.1+deb11u1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libsasl2-2:amd64@2.1.27+dfsg-2.1+deb11u1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">86ae7ca3d083253168d88876ce048f30e4e4e4a33e129d3e1354be8caa901fe6</hash>
				<hash alg="SHA-512">7a4c1cda194edee4512802514603c55e1c833e5454fb0b9a7cc5a386ef8c0cac0f65acc595a3481891c95525b36c2394b91695a4451a73448a9556061253bb13</hash>
				<hash alg="SHA3-512">bf245f4e82f351674c5ae7e7bebd612d8e4d105d672cd705806d0efaf750c5a3024f21469ef7ea6bcbc5b3bb2921789557bdf9e83281851263c4529cc836f572</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libbrotlicommon.so.1</name>
			<group>libbrotli1:amd64</group>
			<version>1.0.9-2+b2</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libbrotli1:amd64@1.0.9-2+b2?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">df4c882c856b522cef515963a90d0f5f33d5b55d1bc3a855a92ce55bf9dcbb4d</hash>
				<hash alg="SHA-512">d8adc9aff84ceae3f102e8789a2ba2acc056682723d22290740e822736bef466012e3948f2336db65c4c02974cc9a846cf67a7e7ae9de784bb0206284f3889a2</hash>
				<hash alg="SHA3-512">63029c87bb7fe719b34729bf38f42b8c9039364727a2f205a81daf30735336b150b5548230c6da2e595cd17cf59ce17eb808f20fb859837456f30638edf7ffeb</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libp11-kit.so.0</name>
			<group>libp11-kit0:amd64</group>
			<version>0.23.22-1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libp11-kit0:amd64@0.23.22-1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">9e76f7ed4e06516cabeaddb5dae8debef78a9d9b5256201e208f1c9e1cfca22d</hash>
				<hash alg="SHA-512">279c291c9fe8231d2d7f9289917f65c2c262ccc584504bdafb85ac25b209106cef3861ec3144ef205d7446a510815903d5a4a5397e1c788e945faae556e2d85a</hash>
				<hash alg="SHA3-512">78ccc22fc3abf9a1ea3dc16ebc0b8de76e8b190a32264b16d7d4a67f1fe5c7a240797f18177d364bf4980db1100d697f79edd7501492688098d85821e5dd88f3</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libtasn1.so.6</name>
			<group>libtasn1-6:amd64</group>
			<version>4.16.0-2+deb11u1</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libtasn1-6:amd64@4.16.0-2+deb11u1?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">5d8f486998e436d03f3adea53bdee17424face6fcb06740437cb11cc059bc14b</hash>
				<hash alg="SHA-512">bcba47a85aae4a857cee729865f26c5563a2047803e7d2f0dc5a2690ab74caa73d5a1aa4ac22288c4eee23515a7332a8340147d68455ab6823454b374c7f7360</hash>
				<hash alg="SHA3-512">c4baa621dff7423e062bf92b7438661ba0e4f0207c16c8ecf26f71e85e7beb38185c2af56577c75c47338f813c86f57b43c071e9f1b37fe31b594146ce2f4565</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/libgpg-error.so.0</name>
			<group>libgpg-error0:amd64</group>
			<version>1.38-2</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libgpg-error0:amd64@1.38-2?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">4f31d8ae7ff7e77a85a1c66752b51bfcf7db7987d0cdbfa7ca335164c36312be</hash>
				<hash alg="SHA-512">c8f1943b49ce8fa69059d92b37044a52606f815db67210213be0064b7e123d56ee284525828e0392484c311193fe28853882abc79d6dfed5e0696b9e858645d8</hash>
				<hash alg="SHA3-512">eb2cc534d1ccd41eeae4c36e095894c02590369cc4b561e357e28f0792c65d21e359644181fbe0c538ab5278c73606e5124192e2ff75a1a6477cf58d05df5af4</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/lib/x86_64-linux-gnu/libkeyutils.so.1</name>
			<group>libkeyutils1:amd64</group>
			<version>1.6.1-2</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libkeyutils1:amd64@1.6.1-2?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">c73919c0038fe1b6f4fa688228630b5334e2df35f066a21b60f395ae8626e55d</hash>
				<hash alg="SHA-512">a62f8e5d9f802b13a7f932207983bc61bf43ca107e2065fa4e403e540d5455a3ca39304afa30202df8b8b1ca0007cc9730ad6d02e2206b46c71a77ff9204c211</hash>
				<hash alg="SHA3-512">179494af927f8ed67b651668b47a728eb666ab4fd5ecee0a7ffd9f6ea2d98db23ec3535a5129ff5bc2dc3ee059b264eae4fdc9a3c8daaa47cf24c7710450b409</hash>
			</hashes>
		</component>
		<component type="library">
			<name>/usr/lib/x86_64-linux-gnu/libffi.so.7</name>
			<group>libffi7:amd64</group>
			<version>3.3-6</version>
			<scope>required</scope>
			<purl>pkg:deb/debian/libffi7:amd64@3.3-6?arch=x86-64&distro=bullseye</purl>
			<hashes>
				<hash alg="SHA-256">d7ce7e96311388ad35a34835c0db7738c869c8e1c88c071e9af5971e6765d89e</hash>
				<hash alg="SHA-512">9a0500fb95988b8fe309f049ace7fe0c91f2a35bf8abfdd90310f913d81fdd04d00808507467e24ff51773028f0e6528f0fed4a7ed23e28af36f8ece35fdf409</hash>
				<hash alg="SHA3-512">a501da39e7f6bd6b2d8089f26ca80e9298d2de4805b27d3e31f3ac5176a1ce0ec068b20cb587f01701fda337d184c756015d9ad8f385bc8873d0bfe3939533e9</hash>
			</hashes>
		</component>
	</components>
</bom>

Sammeln der Information

  • SBOM_Check beginnt mit ldd
    • Abfrage apt nach Paket basierend auf Dateipfad
    • Ermittlung Architektur und Distribution via uname()
    • Paketversionen via aptitude und dpkg
  • Berechnung aller Hashes der Bibliotheken
  • sehr viel Analyse spezifischer Informationen
  • keine einheitliche Quelle für alle Komponenten
    • Projekte verwenden teilweise mehrere Programmiersprachen
    • gemischte Quellen (Container, weitere Executables)

Granularität

  • Applikationen
  • Bibliotheken
  • Frameworks
  • Betriebssysteme
  • Container
  • Firmware
  • Dateien
  • Hardware
  • Services

Komponentenliste vom OWASP Dependency-Track

Fokus: Was muss/kann man upgraden?

SBOM Unterstützung

Doxygen kann Call Graphs für Dateien, Funktionen oder Klassen erzeugen.

Komponentenauswahl

  • Mehrere mögliche Lösungen (abhängig vom Projekt)
  • Generell gilt:
    • weniger ist mehr
    • Standardbibliotheken bevorzugen
    • Sicherheit der Quelle(n) evaluieren
    • Keep It Simple Prinzip anwenden

Fragen?

Quellen

About the Author

René Pfeiffer was born in the year of Atari's founding and the release of the game Pong. Since his early youth he started taking things apart to see how they work. He couldn't even pass construction sites without looking for electrical wires that might seem interesting. The interest in computing began when his grandfather bought him a 4-bit microcontroller with 256 byte RAM and a 4096 byte operating system, forcing him to learn Texas Instruments TMS 1600 assembler before any other programming language.

After finishing school he went to university in order to study physics. He then collected experiences with a C64, a C128, two Commodore Amigas, DEC's Ultrix, OpenVMS and finally GNU/Linux on a PC in 1997. He is using Linux since this day and still likes to take things apart und put them together again. Freedom of tinkering brought him close to the Free Software movement, where he puts some effort into the right to understand how things work – which he still does.

René is a senior systems administrator, a lecturer at the University of Applied Sciences Technikum Wien and FH Burgenland, and a senior security consultant. He uses all the skills in order to develop security architectures, maintain/improve IT infrastructure, test applications, and to analyse security-related attributes of applications, networks (wired/wireless, components), (cryptographic algorithms), protocols, servers, cloud platforms, and more indicators of modern life. SEC4YOU Advanced IT Services GmbH benefits from his experience. If you are interested in putting your security to the test, please let us know.