)]}'
{
  "log": [
    {
      "commit": "7402318150a232b1325bbf56874386758f824def",
      "tree": "dc1ad3bfce96fa17573674503232f5409f0fc10f",
      "parents": [
        "fe902d2cb49ed6aa72e5a3c3fcbe4a029dade182"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 28 17:47:38 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 28 17:47:38 2026 +0200"
      },
      "message": "transfer compositionAggregate from linked sbom\n"
    },
    {
      "commit": "fe902d2cb49ed6aa72e5a3c3fcbe4a029dade182",
      "tree": "b3fae8a1eed5020cc954f4d0dfb22d7dd71d5b25",
      "parents": [
        "8cd3b1911824ca57dfe1649e41a60df0fd7f2a84"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Aug 27 22:26:59 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Aug 27 22:26:59 2026 +0200"
      },
      "message": "add ability to state completeness of relationship description\n"
    },
    {
      "commit": "8cd3b1911824ca57dfe1649e41a60df0fd7f2a84",
      "tree": "aa769f3ef7d2cf97596c307308aa1b6228b44b9b",
      "parents": [
        "4d48e6348e0e2af714fb5df03fbafc140834aa45"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Tue Aug 25 07:32:41 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Tue Aug 25 07:32:41 2026 +0200"
      },
      "message": "update cyclonedx-core-java which dropped its commons dependencies\n"
    },
    {
      "commit": "4d48e6348e0e2af714fb5df03fbafc140834aa45",
      "tree": "a6baec670d8dfacbb61c0f4f4d140d1d3e997bff",
      "parents": [
        "474724046fb68e656b7028c99681d0cdbe62311c"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Aug 17 18:53:34 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Aug 17 18:53:34 2026 +0200"
      },
      "message": "make Ivy SBOM creation the default\n"
    },
    {
      "commit": "474724046fb68e656b7028c99681d0cdbe62311c",
      "tree": "15b8b97c984e21c88767df7d99d5ff2404a44614",
      "parents": [
        "4ad120a6571c1a87d63c490324c2906d62d9b022"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Aug 17 18:50:00 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Aug 17 18:50:00 2026 +0200"
      },
      "message": "simplify setup\n"
    },
    {
      "commit": "4ad120a6571c1a87d63c490324c2906d62d9b022",
      "tree": "0166972c3badb47e7ec75a6306a6bbc154b69af5",
      "parents": [
        "c87155b2cfbafd7b596c036f2757ffff57de95f4"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Aug 17 18:33:38 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Aug 17 18:33:38 2026 +0200"
      },
      "message": "fix some javascript warnings\n"
    },
    {
      "commit": "c87155b2cfbafd7b596c036f2757ffff57de95f4",
      "tree": "1e0e8de5ba81bb9ca27ccad2a03aef0fb509deb6",
      "parents": [
        "f568de9168144e48be04e744e20ac48ce8f6d97b"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Aug 17 08:18:46 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Aug 17 08:18:46 2026 +0200"
      },
      "message": "fix javadoc errors\n"
    },
    {
      "commit": "f568de9168144e48be04e744e20ac48ce8f6d97b",
      "tree": "6f25eb1c5f4d81361e7c84455ed6100b47c72944",
      "parents": [
        "61e4d8b2d942b7890ed7d42eb2fb4073f5e19f55"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 17:45:41 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 17:45:41 2026 +0200"
      },
      "message": "add support for license expressions\n"
    },
    {
      "commit": "61e4d8b2d942b7890ed7d42eb2fb4073f5e19f55",
      "tree": "f13b8d56d6e6d08e4f6ee7386014880ec4c593fd",
      "parents": [
        "9030a625bb6f583d85d4250e21a4b075dc9ce0b2"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 16:52:47 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 16:52:47 2026 +0200"
      },
      "message": "refactor sbomLink and ivyModule into a reusable componentdef\n"
    },
    {
      "commit": "9030a625bb6f583d85d4250e21a4b075dc9ce0b2",
      "tree": "f59889cdff632bbcf8855dc1ce89f07042c3ea5f",
      "parents": [
        "7626f3949cd5cb61f920741030b89e05990135e9"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 14:17:33 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 14:17:33 2026 +0200"
      },
      "message": "add getters for all of components mutators\n"
    },
    {
      "commit": "7626f3949cd5cb61f920741030b89e05990135e9",
      "tree": "41b205773ede8dfdcd581f71b6746d70c3fb978b",
      "parents": [
        "fa44fa02b7803a8500a7551fb2d94c5b1e172dc8",
        "82d209320ec14679b649047ca8bc04c592de82cb"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 11:30:07 2026 +0000"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sun Aug 16 11:30:07 2026 +0000"
      },
      "message": "Merge pull request #2 from apache/support-ivy-as-component-source\n\ninitial implementation of Ivy based CycloneDX resolution"
    },
    {
      "commit": "82d209320ec14679b649047ca8bc04c592de82cb",
      "tree": "41b205773ede8dfdcd581f71b6746d70c3fb978b",
      "parents": [
        "0af0c7cc39b9d56b6d347e0490b3684435b59570"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 12:56:06 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 12:56:06 2026 +0200"
      },
      "message": "add license external references from Ivy modules\n"
    },
    {
      "commit": "0af0c7cc39b9d56b6d347e0490b3684435b59570",
      "tree": "a6fad050e344121f934d583e96ecde52030d86f3",
      "parents": [
        "2d21ab4dec4b7b9e9e24104d94fc2bef8e488dd5"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 12:50:00 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 12:50:00 2026 +0200"
      },
      "message": "optimize\n"
    },
    {
      "commit": "2d21ab4dec4b7b9e9e24104d94fc2bef8e488dd5",
      "tree": "68f2234fbffd79d744e08a82cba15863288c72b5",
      "parents": [
        "783adc7a1eef11930db37020bff915a905722ac7"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 09:34:58 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 09:34:58 2026 +0200"
      },
      "message": "provide more metadata for Ivy\n"
    },
    {
      "commit": "783adc7a1eef11930db37020bff915a905722ac7",
      "tree": "52c1f84b0adeb24dad0dcf079cb0afc466612886",
      "parents": [
        "43a48dbedff2c73105897830e4ade957b1498ed8"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 09:17:03 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 09:17:03 2026 +0200"
      },
      "message": "make cyclonedx-core-java guess SPDX license id when not specified\n"
    },
    {
      "commit": "43a48dbedff2c73105897830e4ade957b1498ed8",
      "tree": "1140d15bf57372ec6294cd361f4cdfab677c67fe",
      "parents": [
        "f06c63f300476a74b18b5311b420938c069e761b"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 08:04:03 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 08:04:03 2026 +0200"
      },
      "message": "add ivy/commons-codec dependencies in \"manual SBOM\" as well\n"
    },
    {
      "commit": "f06c63f300476a74b18b5311b420938c069e761b",
      "tree": "35a098d79b37994df7b0bf49cc4e684ca99407bc",
      "parents": [
        "f069bfdf98dd018e501c97af573601548a6464b1"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 07:43:07 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 16 07:43:07 2026 +0200"
      },
      "message": "make templateComponent work for referenced components\n"
    },
    {
      "commit": "f069bfdf98dd018e501c97af573601548a6464b1",
      "tree": "e750bd9ba7d5b112e53a69cffd10829e13ecedd7",
      "parents": [
        "ec97eeba7774d414bf2290aa9e1b6bef1bae86d4"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 15 20:30:32 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 15 20:30:32 2026 +0200"
      },
      "message": "make it easier to supply additional data to Ivy dependencies\n"
    },
    {
      "commit": "ec97eeba7774d414bf2290aa9e1b6bef1bae86d4",
      "tree": "6863c15c2816e03f3ce20f19bc8b5e77f3cc0c54",
      "parents": [
        "3e937d2209f9bef886ffc01d7b3aea3ba60c488f"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 15 20:28:43 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 15 20:28:43 2026 +0200"
      },
      "message": "with ivyModule there is a good reason to resolve the main compoment\n"
    },
    {
      "commit": "3e937d2209f9bef886ffc01d7b3aea3ba60c488f",
      "tree": "508a1c39e2399c9474658b361f49ea8fd80f54de",
      "parents": [
        "eaa90bb2e346f69e02ec02fc2e8f8f5415c178b1"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 15 14:32:56 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 15 14:32:56 2026 +0200"
      },
      "message": "I wouldnÄt really know how to test this, TBH\n"
    },
    {
      "commit": "eaa90bb2e346f69e02ec02fc2e8f8f5415c178b1",
      "tree": "4f963c55c2d8a6e1c8aad3ce42b9651e69978986",
      "parents": [
        "71cb7f865363b7aecd7213d10a2a172359631d1a"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 15 13:23:41 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 15 13:23:41 2026 +0200"
      },
      "message": "document the parts of ivyModule I\u0027ve already written tests for\n"
    },
    {
      "commit": "71cb7f865363b7aecd7213d10a2a172359631d1a",
      "tree": "51a3f6f270c86ccb60087e13867acb824658fab4",
      "parents": [
        "0ac76cfcb6f3ce350772f1ac47e02c2fb509a216"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 17:45:40 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 17:45:40 2026 +0200"
      },
      "message": "use classloader task to load ivy into antlib\n"
    },
    {
      "commit": "0ac76cfcb6f3ce350772f1ac47e02c2fb509a216",
      "tree": "b57807300a817081012c629ebf2722cd8ceb30a1",
      "parents": [
        "082a843a1b5e58753912fbf19fb596df87b38fe3"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 09 22:15:51 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 07:36:38 2026 +0200"
      },
      "message": "incomplete set of tests\n"
    },
    {
      "commit": "082a843a1b5e58753912fbf19fb596df87b38fe3",
      "tree": "e8dc9498b564f2ee012775d38eef4a3dc5add953",
      "parents": [
        "d558b22987c55009a733513b9158403e6d43a46d"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 09 18:36:34 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 07:36:37 2026 +0200"
      },
      "message": "fix reference name with resolveId\n"
    },
    {
      "commit": "d558b22987c55009a733513b9158403e6d43a46d",
      "tree": "51d2445653068d2a376a133ad1ca15cfb2fa18c8",
      "parents": [
        "a8a2a4904f91195f3c6c457d98830e30af8ff952"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 09 10:41:28 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 07:36:37 2026 +0200"
      },
      "message": "move sbomlink tests to separate build file\n"
    },
    {
      "commit": "a8a2a4904f91195f3c6c457d98830e30af8ff952",
      "tree": "5a67a330e13fc74cc39d17d5b95b4ca2d79c300e",
      "parents": [
        "b48430a2c7752c1975ad1c6931bc986747af2934"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 07 16:28:27 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 07:36:37 2026 +0200"
      },
      "message": "SBOMs created manually and using Ivy\n"
    },
    {
      "commit": "b48430a2c7752c1975ad1c6931bc986747af2934",
      "tree": "8f84162284553382c89eaa77e170e4a705a364e8",
      "parents": [
        "23d0c48a31cbe8772ad7603ccfcaa88967588fb0"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 07 16:17:21 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 07:36:37 2026 +0200"
      },
      "message": "calculate hashes for Ivy dependencies retrieved\n"
    },
    {
      "commit": "23d0c48a31cbe8772ad7603ccfcaa88967588fb0",
      "tree": "2e2e4f15118402af07fbbe4c51ccfac8f87b3002",
      "parents": [
        "1eb42e9ce3ada407f5fd9e0c7b9a20bc3c6529af"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 02 12:31:07 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 07:36:36 2026 +0200"
      },
      "message": "deal with optional and external components\n"
    },
    {
      "commit": "1eb42e9ce3ada407f5fd9e0c7b9a20bc3c6529af",
      "tree": "9ac3f318a7c455355f33635c8f90e0ee5cc64c5a",
      "parents": [
        "9adde4ec2a8fd3f0515e7bcec8a6864932de901c"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 01 19:49:31 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 07:36:36 2026 +0200"
      },
      "message": "include provided dependencies in SBOM\n"
    },
    {
      "commit": "9adde4ec2a8fd3f0515e7bcec8a6864932de901c",
      "tree": "b551835e7b0cf9dfab8a0473507b46745ee50f5a",
      "parents": [
        "fa44fa02b7803a8500a7551fb2d94c5b1e172dc8"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 19 15:12:18 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 07:36:34 2026 +0200"
      },
      "message": "initial implementation of Ivy based CycloneDX resolution\n"
    },
    {
      "commit": "fa44fa02b7803a8500a7551fb2d94c5b1e172dc8",
      "tree": "8d8869f3fef33c4915934122c124ea84555648bb",
      "parents": [
        "b8da901473c2f7d905f474bb53bfcbc29c8361d9"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 07:05:02 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 07:05:02 2026 +0200"
      },
      "message": "deperecations in cyclonedx-core-java 13.x\n"
    },
    {
      "commit": "b8da901473c2f7d905f474bb53bfcbc29c8361d9",
      "tree": "a8f9c755c9325c5e8997317ec9085c4ff55f5bdf",
      "parents": [
        "2a91ff72bfff1f2961bd106915ad079b6d333f31"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 06:51:59 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 06:51:59 2026 +0200"
      },
      "message": "stop using raw types\n"
    },
    {
      "commit": "2a91ff72bfff1f2961bd106915ad079b6d333f31",
      "tree": "4ff4ed52e4e5de45b9271b7bc92e7fc867b2cf5a",
      "parents": [
        "6b257a1b987fd3afbc8cadfb6070370736d13081"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 06:46:19 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 06:46:19 2026 +0200"
      },
      "message": "mimic getBuildDate change of Ant\u0027s master branch\n"
    },
    {
      "commit": "6b257a1b987fd3afbc8cadfb6070370736d13081",
      "tree": "32ceb21e1f8b57bcc488276fa8329aa047d7fa01",
      "parents": [
        "4771e74e55f6c1f3d5ecc92929ea1b3e38b28034"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 06:38:19 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Aug 14 06:38:19 2026 +0200"
      },
      "message": "update common antlib infrastructure\n"
    },
    {
      "commit": "4771e74e55f6c1f3d5ecc92929ea1b3e38b28034",
      "tree": "b290db4f1da3236ebcfae438f0419a2accf0f28e",
      "parents": [
        "d805b06bdd290af38ea339aaa7e7591e41504a8c"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Wed Aug 05 18:40:30 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Wed Aug 05 18:40:30 2026 +0200"
      },
      "message": "forgot to update pom\n"
    },
    {
      "commit": "d805b06bdd290af38ea339aaa7e7591e41504a8c",
      "tree": "dbc3964e76ec3b982c16ae02532e71f8e4e4598e",
      "parents": [
        "21b15ad03fe419bd284e97b3e6835e979dc7a515"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Wed Aug 05 18:37:28 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Wed Aug 05 18:37:28 2026 +0200"
      },
      "message": "explict version of commons-codec\n"
    },
    {
      "commit": "21b15ad03fe419bd284e97b3e6835e979dc7a515",
      "tree": "7c416edaaa31dc9b5ecd4a071cabeb21881c28ca",
      "parents": [
        "61877402780639a77795ed85dccedbf7d142d0d8"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Wed Aug 05 18:33:48 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Wed Aug 05 18:33:48 2026 +0200"
      },
      "message": "new version of cyclonedx-core-java\n"
    },
    {
      "commit": "61877402780639a77795ed85dccedbf7d142d0d8",
      "tree": "0aeb29b430fa0b2f9c71eda23a79bd96534e10b3",
      "parents": [
        "ecf3e24f389a9c531af87b8e0664a61fbd2db72b"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 02 19:37:13 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 02 19:37:13 2026 +0200"
      },
      "message": "POM lacks a description\n"
    },
    {
      "commit": "ecf3e24f389a9c531af87b8e0664a61fbd2db72b",
      "tree": "baed2654484384d1b2cc8510e50e5caa6b4bb9f1",
      "parents": [
        "bdef35beb6c5fed46c4e2e3abda4d0ec0825eace"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 02 11:41:54 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Aug 02 11:41:54 2026 +0200"
      },
      "message": "fix comment\n"
    },
    {
      "commit": "bdef35beb6c5fed46c4e2e3abda4d0ec0825eace",
      "tree": "95efd70b190cd94d0d5db86cfe727b8b8f6ed1af",
      "parents": [
        "6b03d9bd40cc344c17759d7855d0620ff2131835"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 01 15:44:14 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Aug 01 15:44:14 2026 +0200"
      },
      "message": "explicitly mention BuildException in throws clause\n"
    },
    {
      "commit": "6b03d9bd40cc344c17759d7855d0620ff2131835",
      "tree": "eae7241fe3bbe061fee8c501cf6532144163f519",
      "parents": [
        "54bd0349c0128d74a13967ef64b34e5a8ef4bd91"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 26 19:59:13 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 26 19:59:13 2026 +0200"
      },
      "message": "requires Java9+ to build SBOMs\n"
    },
    {
      "commit": "54bd0349c0128d74a13967ef64b34e5a8ef4bd91",
      "tree": "22689b7e3ce3ccdebb77089d7c479e46abe16312",
      "parents": [
        "ee8074d90073b4023b7164cc3aeb98d5f21efd05"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Tue Jul 21 08:05:34 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Tue Jul 21 08:05:34 2026 +0200"
      },
      "message": "sort nested components when they are used instead of before they are resolved\n"
    },
    {
      "commit": "ee8074d90073b4023b7164cc3aeb98d5f21efd05",
      "tree": "ee29e255ece5fad4bb116d560aadea4e3c51b080",
      "parents": [
        "9f81746ffe0caa2c9f77b3b4a9da27c6315f52e2"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Jul 20 21:38:31 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Jul 20 21:38:31 2026 +0200"
      },
      "message": "used the same byte of the checksum twice\n"
    },
    {
      "commit": "9f81746ffe0caa2c9f77b3b4a9da27c6315f52e2",
      "tree": "111967fe146010b49fe4081bf297243137268d4a",
      "parents": [
        "e719a820570f1e9a9280d7168fd62ae504edadb2"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Jul 20 20:19:37 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Jul 20 20:19:37 2026 +0200"
      },
      "message": "calculate a stable serial number if SOURCE_DATE_EPOCH is set\n"
    },
    {
      "commit": "e719a820570f1e9a9280d7168fd62ae504edadb2",
      "tree": "340a0c1babf924aa260c9cb127d7b59b61948c02",
      "parents": [
        "581ae00b98e7e050a6eab32b53b6b7a49a42ca1e"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Jul 20 20:18:52 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Jul 20 20:18:52 2026 +0200"
      },
      "message": "location of ivy jar has changed\n"
    },
    {
      "commit": "581ae00b98e7e050a6eab32b53b6b7a49a42ca1e",
      "tree": "181bc5eaa81a3881f80d107a3881122572a3951b",
      "parents": [
        "394efc7cb16003c9f625b9730b07ecdb60140c7f"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 19 16:40:07 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 19 16:40:07 2026 +0200"
      },
      "message": "extract SBOM link reading from Component class\n"
    },
    {
      "commit": "394efc7cb16003c9f625b9730b07ecdb60140c7f",
      "tree": "4b7b03414fe38455dca583221c1f53f659c365d1",
      "parents": [
        "6d59d3a7620eaeb77f684638f34aa7c45c5bb658"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 19 15:11:24 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 19 15:11:24 2026 +0200"
      },
      "message": "from a classloader perspective it is better to have Ivy provided externally\n"
    },
    {
      "commit": "6d59d3a7620eaeb77f684638f34aa7c45c5bb658",
      "tree": "0ca14f8d194c7d0a8d1d6c78e7e57371e964ef0d",
      "parents": [
        "1ca8ce0e0dff4df1fc47ffb68a4117f4b6424148"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 19 10:47:05 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 19 10:47:05 2026 +0200"
      },
      "message": "remove build-system external reference\n"
    },
    {
      "commit": "1ca8ce0e0dff4df1fc47ffb68a4117f4b6424148",
      "tree": "365be0d97c71ee6261c3947a318669396a84e4eb",
      "parents": [
        "2b077a32b53097ec08719e3eb44022845419811e"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 19 10:26:40 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jul 19 10:26:40 2026 +0200"
      },
      "message": "add dependency on Ivy so I can start working on Ivy integration\n"
    },
    {
      "commit": "2b077a32b53097ec08719e3eb44022845419811e",
      "tree": "0089f002b0f7fefac22b14e5fcfa6afbd35e63b5",
      "parents": [
        "d3a049834abb7ea0abd775307b7b46a7e1b7d7e2"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jul 18 14:46:28 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jul 18 14:46:28 2026 +0200"
      },
      "message": "sort list valued BOM attributes for reproducible builds\n"
    },
    {
      "commit": "d3a049834abb7ea0abd775307b7b46a7e1b7d7e2",
      "tree": "9deee939a92835ac2d1cbe7b908d43ca6e6084fb",
      "parents": [
        "e3fd8efb932ba08410cbacfe5e661e630391cb8f"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jul 18 09:26:14 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jul 18 09:26:14 2026 +0200"
      },
      "message": "make SBOM\u0027s timestamp honor reproducible builds requirements\n"
    },
    {
      "commit": "e3fd8efb932ba08410cbacfe5e661e630391cb8f",
      "tree": "e98577f36306b4522023d7f40c4bcc9b59681d72",
      "parents": [
        "e234d1db0afd1aae5bfab5980ccf1ff1d9ba6dc6"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jul 18 09:07:03 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jul 18 09:07:03 2026 +0200"
      },
      "message": "license headers\n"
    },
    {
      "commit": "e234d1db0afd1aae5bfab5980ccf1ff1d9ba6dc6",
      "tree": "007fb2dc34132504572a2068d0a138ae314d3f86",
      "parents": [
        "56cb43d86c25b26fd4b67ed236f77c5ff3ecebbd"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jul 17 05:47:43 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jul 17 05:47:43 2026 +0200"
      },
      "message": "update dependencies in SBOM\n"
    },
    {
      "commit": "56cb43d86c25b26fd4b67ed236f77c5ff3ecebbd",
      "tree": "5018a651ac10dd338b6034bf9f98aa2e9ce36b00",
      "parents": [
        "71bf9f9a72cef5624a614aabb10985fa465355c4"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jul 16 19:51:50 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jul 16 19:52:42 2026 +0200"
      },
      "message": "bump cyclonedx-core-java dependency, make CycloneDX 1.7 the new default\n"
    },
    {
      "commit": "71bf9f9a72cef5624a614aabb10985fa465355c4",
      "tree": "00f36024b30f6fa91e7e3569cb77206358d940bd",
      "parents": [
        "09ff42b75e61cbcef93ef6ecada40f6a8aed804b"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Wed Jul 15 18:01:23 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Wed Jul 15 18:01:23 2026 +0200"
      },
      "message": "pick up Ivy update\n"
    },
    {
      "commit": "09ff42b75e61cbcef93ef6ecada40f6a8aed804b",
      "tree": "5769dbbce57938e769b6482dad59e68336c92c76",
      "parents": [
        "3b548b65dc4b1abef771f1bc5a203f8162952952"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jul 11 16:15:03 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jul 11 16:15:03 2026 +0200"
      },
      "message": "allow a way to set the serial number of the generated BOM\n"
    },
    {
      "commit": "3b548b65dc4b1abef771f1bc5a203f8162952952",
      "tree": "b58399436178a336ece8f9c6b1a4eb044178a74a",
      "parents": [
        "4d111ad8776a7e9153f18646777f376282a01f1f"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jun 21 10:41:42 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jun 21 10:41:42 2026 +0200"
      },
      "message": "extract macrodef defined at least four times now into a task provided by the antlib\n"
    },
    {
      "commit": "4d111ad8776a7e9153f18646777f376282a01f1f",
      "tree": "eb5a67c6f10a7f5834d5c1b21d5773a3742bb56b",
      "parents": [
        "d88a4601a4d7b538bd547d6a7208406e52e6099e"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jun 21 09:58:09 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jun 21 09:58:09 2026 +0200"
      },
      "message": "stray closing p tag\n"
    },
    {
      "commit": "d88a4601a4d7b538bd547d6a7208406e52e6099e",
      "tree": "2bae4e5a6a0045890831176c9c094290a03a8458",
      "parents": [
        "71cb81dde4d745937742733aaf58a5b284ed7516"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jun 20 12:22:29 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jun 20 12:22:29 2026 +0200"
      },
      "message": "import bugfixes of common build\n"
    },
    {
      "commit": "71cb81dde4d745937742733aaf58a5b284ed7516",
      "tree": "7f63edb65099f51aff0a981721216e82e20c8848",
      "parents": [
        "9576d5e232e3e2e712fb4e2e4a6f8836fa6c4346"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jun 20 07:52:15 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat Jun 20 07:52:15 2026 +0200"
      },
      "message": "adjust ivy.xml\n"
    },
    {
      "commit": "9576d5e232e3e2e712fb4e2e4a6f8836fa6c4346",
      "tree": "42c02b253c51225a87c8e802c5365fbc8fd0fe72",
      "parents": [
        "b7a80e862d3f9b2d48fccaa12db3f37d89e5a455"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 19 21:38:36 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 19 21:38:36 2026 +0200"
      },
      "message": "CycloneDX Spec prefers .cdx.json\n\nhttps://cyclonedx.org/specification/overview/#recognized-file-patterns\n"
    },
    {
      "commit": "b7a80e862d3f9b2d48fccaa12db3f37d89e5a455",
      "tree": "17829935235ad57724323fa26ad89e9e46cbe941",
      "parents": [
        "e6ed5aa2efa74bea02fe1296b1dd75e9695f56b5"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 19 18:34:29 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 19 18:34:29 2026 +0200"
      },
      "message": "AntUnit 1.5.0\n"
    },
    {
      "commit": "e6ed5aa2efa74bea02fe1296b1dd75e9695f56b5",
      "tree": "976609af5aa7a881cc9579dbb129942eb57626d6",
      "parents": [
        "9d284f5be3604adba764b63d6de29a4ceccb9611"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 19 18:21:13 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 19 18:21:13 2026 +0200"
      },
      "message": "user common setup for SBOM\n"
    },
    {
      "commit": "9d284f5be3604adba764b63d6de29a4ceccb9611",
      "tree": "7fd4279a644252718fc3e1c10885a62318339c46",
      "parents": [
        "cd13226ae4aa850912a4249919a8f93bbea9ee59"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jun 14 15:08:52 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jun 14 15:08:52 2026 +0200"
      },
      "message": "since Locator is used directly, the dependency on ant-launcher is no longer just transitive\n"
    },
    {
      "commit": "cd13226ae4aa850912a4249919a8f93bbea9ee59",
      "tree": "7563ff8ba21bdceab062c06a6d12d11150a5eabc",
      "parents": [
        "64a0117d29e2c135cac3d0d5f4a2dbf570322c60"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jun 14 14:42:09 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jun 14 14:42:09 2026 +0200"
      },
      "message": "new resource collection that will help with SBOMs for tarballs\n"
    },
    {
      "commit": "64a0117d29e2c135cac3d0d5f4a2dbf570322c60",
      "tree": "d2e7e63d77a0a06aecdc63f0cb236213d512372e",
      "parents": [
        "2734d6c11e9cd18425daa0ac8fc0d3ddd9d49993"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 12 10:02:00 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 12 10:02:00 2026 +0200"
      },
      "message": "typo\n"
    },
    {
      "commit": "2734d6c11e9cd18425daa0ac8fc0d3ddd9d49993",
      "tree": "45bedfe2e045ed5c67638c864e927b3fe815f597",
      "parents": [
        "4ac4b166f1b1e1901450efd18e36a6da3e9f6b74"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 12 09:51:10 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 12 09:51:10 2026 +0200"
      },
      "message": "document the SHA3 \"problem\"\n\nhttps://github.com/CycloneDX/cyclonedx-core-java/issues/848\n"
    },
    {
      "commit": "4ac4b166f1b1e1901450efd18e36a6da3e9f6b74",
      "tree": "272b680f6fb4a0d9987b7d26d426e24251c231a1",
      "parents": [
        "e9b0e88241cbab6fc5f384ef08a9d9272ac24093"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Jun 08 21:30:24 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon Jun 08 21:30:24 2026 +0200"
      },
      "message": "use Ant\u0027s Locator instead of reinventing it\n"
    },
    {
      "commit": "e9b0e88241cbab6fc5f384ef08a9d9272ac24093",
      "tree": "6d0abcd76821a6b950576c6baa5b272d2d855fae",
      "parents": [
        "b6f81afd5906ea765b9cd9df8ff89124a645a50d"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jun 07 07:50:06 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun Jun 07 07:50:06 2026 +0200"
      },
      "message": "fix locating of Antlib jar for tool information\n\nI\u0027ve written too much C# lately, it seems\n"
    },
    {
      "commit": "b6f81afd5906ea765b9cd9df8ff89124a645a50d",
      "tree": "b0de445b527b2b5082895224924f19e125496229",
      "parents": [
        "23571d9d062f5dd61c2056e062130b522c118fb6"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 05 09:54:56 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 05 09:54:56 2026 +0200"
      },
      "message": "also add documentation link to tool-meta\n"
    },
    {
      "commit": "23571d9d062f5dd61c2056e062130b522c118fb6",
      "tree": "73d5d718078f8e9f935e76e4488136dc10dd77e8",
      "parents": [
        "a873e80d3cb9f6a14e7389f5d822eb8214caa1aa"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 05 08:28:55 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 05 08:28:55 2026 +0200"
      },
      "message": "the BSI TR is not binding for the EU CRA, yet. Things may change.\n"
    },
    {
      "commit": "a873e80d3cb9f6a14e7389f5d822eb8214caa1aa",
      "tree": "a9287f8ef046dca0aea86b8ec4a6934834e5bbf0",
      "parents": [
        "42969ccaede33a114ad7b92357f5e535b85a94a0"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 05 08:18:51 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri Jun 05 08:18:51 2026 +0200"
      },
      "message": "maybe you sometimes don\u0027t want bom-externalReferences for internal SBOMs\n"
    },
    {
      "commit": "42969ccaede33a114ad7b92357f5e535b85a94a0",
      "tree": "f9c5c0f3414b2966a55e3caec2f557b006e3819f",
      "parents": [
        "1e9928e86d48ca486c759b96f0cfcff4679a7649"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 15:45:27 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 15:45:27 2026 +0200"
      },
      "message": "add security.txt link to tool component as well\n"
    },
    {
      "commit": "1e9928e86d48ca486c759b96f0cfcff4679a7649",
      "tree": "7f8b0f153858c46df0f537fd578228a1c902d1d3",
      "parents": [
        "477e65fa3d4b562d4a1798e96f36b2a65246193a"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 15:34:30 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 15:34:30 2026 +0200"
      },
      "message": "Ant has got a security.txt\n"
    },
    {
      "commit": "477e65fa3d4b562d4a1798e96f36b2a65246193a",
      "tree": "d9cbe010801c734d8e8e3bac72ba643dc0180438",
      "parents": [
        "8fd469413d5ae339a4663faede26b6b33f39e89f"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 15:29:02 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 15:29:02 2026 +0200"
      },
      "message": "add bom-type externalreferences when sbomLink is used\n"
    },
    {
      "commit": "8fd469413d5ae339a4663faede26b6b33f39e89f",
      "tree": "f29ddaaeeb1f570ed451b6d905e8026891292a18",
      "parents": [
        "caad2b677afb55b3600188106224295e52525028"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 15:09:41 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 15:09:41 2026 +0200"
      },
      "message": "add properties required by BSI TR for EU CRA\n\nsee\nhttps://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03183/BSI-TR-03183-2_v2_1_0.pdf?__blob\u003dpublicationFile\u0026v\u003d5\nsection 8.2\n"
    },
    {
      "commit": "caad2b677afb55b3600188106224295e52525028",
      "tree": "93adc1835e999e1bd650318e75d9e5711144a33c",
      "parents": [
        "59936ed9fcff2812f323fd6ce6d2a7257d2ac75b"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 14:55:51 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 14:55:51 2026 +0200"
      },
      "message": "introduce propertyset\n"
    },
    {
      "commit": "59936ed9fcff2812f323fd6ce6d2a7257d2ac75b",
      "tree": "257a9e859c8166d13fb6977d190fd2e76c518f62",
      "parents": [
        "66199c153c8fcec792b286ac569484a8bb8cb327"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 14:18:11 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 14:18:11 2026 +0200"
      },
      "message": "more external references\n"
    },
    {
      "commit": "66199c153c8fcec792b286ac569484a8bb8cb327",
      "tree": "b64669b6728e8ff0ea80e795b7af1e3f5d953c49",
      "parents": [
        "1d1e1a7080e7d9d99b1dc3e115b774246c296f80"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 08:47:49 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 08:47:49 2026 +0200"
      },
      "message": "archiveUrl is wrong\n"
    },
    {
      "commit": "1d1e1a7080e7d9d99b1dc3e115b774246c296f80",
      "tree": "2a069d9bd9b121c3fddeac1f44ba955db50e8909",
      "parents": [
        "1af2644a75deb1cce5136947cfaa56fa7fb784da"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 07:27:26 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu Jun 04 07:27:26 2026 +0200"
      },
      "message": "no longer need the examples, we\u0027ve got a real release to show now\n"
    },
    {
      "commit": "1af2644a75deb1cce5136947cfaa56fa7fb784da",
      "tree": "ac6ff0c6f112929b67c3703ca468021b851668a3",
      "parents": [
        "20fbdfb76f523bfdba00666a3a112eedd68271f4"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun May 31 16:37:50 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Wed Jun 03 20:56:44 2026 +0200"
      },
      "message": "prepare RC1 of 0.1\n"
    },
    {
      "commit": "20fbdfb76f523bfdba00666a3a112eedd68271f4",
      "tree": "3932e6cfb0f3b809a39c1f042bb8b803aa2bb85c",
      "parents": [
        "450bf638930e5b2c5ca5ca77577501fb7016a70c"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun May 31 16:35:35 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sun May 31 16:35:35 2026 +0200"
      },
      "message": "antlibs have got an extra directory layer for their releases\n"
    },
    {
      "commit": "450bf638930e5b2c5ca5ca77577501fb7016a70c",
      "tree": "dd50f5eaeb20bbb8353af47f783050f23eee8331",
      "parents": [
        "48f8669a85799c8ce1f1c7e64efa5391b8548492"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 30 18:13:19 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 30 18:13:19 2026 +0200"
      },
      "message": "don\u0027t poison metadata cache with extra tool data\n"
    },
    {
      "commit": "48f8669a85799c8ce1f1c7e64efa5391b8548492",
      "tree": "244ff06e0755dcb1e871a13a4ed071ca9706ecdc",
      "parents": [
        "bd9b56e2a7f29e250345903dacce1f898c1e3bed"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 30 08:18:16 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 30 08:18:16 2026 +0200"
      },
      "message": "still trying to understand the Gump failure\n"
    },
    {
      "commit": "bd9b56e2a7f29e250345903dacce1f898c1e3bed",
      "tree": "b28c099c69533dd2bcba2e26e94be2e42b75a98e",
      "parents": [
        "f76f840afd19982f0c4335b2d681beed55841cb0"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 30 08:05:46 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 30 08:06:03 2026 +0200"
      },
      "message": "update common to select fat-distribution configuration\n"
    },
    {
      "commit": "f76f840afd19982f0c4335b2d681beed55841cb0",
      "tree": "7549973124474a4b3883fc7160f8b46f9bcaaf12",
      "parents": [
        "47673a4a0da3c2076d2c2e77438fd66b7a126759"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri May 29 14:46:33 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri May 29 14:46:33 2026 +0200"
      },
      "message": "I don\u0027t want provided or test dependencies in fat-jar\n"
    },
    {
      "commit": "47673a4a0da3c2076d2c2e77438fd66b7a126759",
      "tree": "3bfc59ce8afd28e971815750f5e06673167563c0",
      "parents": [
        "c2a45a4762b02f4d8ebb297a58584ca348690a35"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri May 29 14:24:16 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri May 29 14:24:16 2026 +0200"
      },
      "message": "add manufacturer to SBOM to make EU CRA happy\n"
    },
    {
      "commit": "c2a45a4762b02f4d8ebb297a58584ca348690a35",
      "tree": "85d0dfbc3dc16139e876266a9ade3aed48d114b9",
      "parents": [
        "7fc2f22ae3ac2d67b0b4974432b2951368bf30fd"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri May 29 14:09:03 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Fri May 29 14:09:03 2026 +0200"
      },
      "message": "last update was incomplete\n"
    },
    {
      "commit": "7fc2f22ae3ac2d67b0b4974432b2951368bf30fd",
      "tree": "38a619fe27ca0c418174d25b5a74ab007bf7d2dc",
      "parents": [
        "4c0b03d67f31411e19cb2e2b65e18d018126057e"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu May 28 07:10:00 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Thu May 28 07:10:00 2026 +0200"
      },
      "message": "remove distributionbom for now\n"
    },
    {
      "commit": "4c0b03d67f31411e19cb2e2b65e18d018126057e",
      "tree": "132cfc89e48996534683a6223514e137a111f1cf",
      "parents": [
        "a8ecf93ecbd6364e3d96c853ec5639a67eaf8743"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Tue May 26 18:21:23 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Tue May 26 18:21:23 2026 +0200"
      },
      "message": "make supplier take the lead over manufacturer\n"
    },
    {
      "commit": "a8ecf93ecbd6364e3d96c853ec5639a67eaf8743",
      "tree": "2ecbf8cada1168e913df4501f84560404e45536b",
      "parents": [
        "2f545ed8ffb388f8da5cfad663f046ddb54d87ec"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Tue May 26 12:35:54 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Tue May 26 12:35:54 2026 +0200"
      },
      "message": "become more formal\n"
    },
    {
      "commit": "2f545ed8ffb388f8da5cfad663f046ddb54d87ec",
      "tree": "066c7b2ffc3f9d3ffac3846816ba32dfbf425378",
      "parents": [
        "746867e710c3dd4486bf56c436aa17f44b093c7c"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Tue May 26 12:32:09 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Tue May 26 12:32:09 2026 +0200"
      },
      "message": "add warning about API instability\n"
    },
    {
      "commit": "746867e710c3dd4486bf56c436aa17f44b093c7c",
      "tree": "42ca71b458b25a6d60a621d73c93036ef817dae6",
      "parents": [
        "14cb6812a028088bef295b84107a5da3f02226ed"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon May 25 13:06:10 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon May 25 13:06:10 2026 +0200"
      },
      "message": "try to fix Gump test failure\n"
    },
    {
      "commit": "14cb6812a028088bef295b84107a5da3f02226ed",
      "tree": "2155f8e266859a2e81da6cb32ead435c3dff6f16",
      "parents": [
        "1c83c95819aff2f28faf46f9e267ccfec6c45c6a"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon May 25 13:05:34 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon May 25 13:05:34 2026 +0200"
      },
      "message": "use gitbox instead of hithub for VCS links\n"
    },
    {
      "commit": "1c83c95819aff2f28faf46f9e267ccfec6c45c6a",
      "tree": "3fc6623019608be97936b6e1a33388ef5e3db4d9",
      "parents": [
        "167e89bb7ab40b3dd98b46c41906198f0e8e6054"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon May 25 12:51:21 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Mon May 25 12:51:21 2026 +0200"
      },
      "message": "yes, please try it out\n"
    },
    {
      "commit": "167e89bb7ab40b3dd98b46c41906198f0e8e6054",
      "tree": "21ed506abd4fd2822c5301f25ec54e3667ceba2a",
      "parents": [
        "86dc58e757af4ee5f0aa5d826cd9ee5aa77a5822"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 23 18:22:13 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 23 18:22:13 2026 +0200"
      },
      "message": "use versioned dependencies in -withdeps tarballs\n"
    },
    {
      "commit": "86dc58e757af4ee5f0aa5d826cd9ee5aa77a5822",
      "tree": "e598facb5ce101c020fb1e7926c34af531a84d82",
      "parents": [
        "08ae8826e7ec914bf69c477023bee930c0b5c47f"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 23 18:04:03 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 23 18:04:03 2026 +0200"
      },
      "message": "add license to BOMs\n"
    },
    {
      "commit": "08ae8826e7ec914bf69c477023bee930c0b5c47f",
      "tree": "2a3fbba6a2d704eedd6aa88c96c987714dafd46e",
      "parents": [
        "70d9fa688fb87d507ce1b6adef171943a61f6ba4"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 23 18:03:35 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 23 18:03:35 2026 +0200"
      },
      "message": "initial test for distributionbom\n"
    },
    {
      "commit": "70d9fa688fb87d507ce1b6adef171943a61f6ba4",
      "tree": "312bf1e4c5d1a5aad11f24ae0d9d533439028c3a",
      "parents": [
        "d8c0f08d4ab35ac6e6e7849ad11aedf3af5114e0"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 23 17:48:40 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 23 17:48:40 2026 +0200"
      },
      "message": "add jar as nested component to binary distribution SBOMs\n"
    },
    {
      "commit": "d8c0f08d4ab35ac6e6e7849ad11aedf3af5114e0",
      "tree": "ef3b9372fd99fcd842c5ce0e804a7a5792c9133f",
      "parents": [
        "7584d45063e32b840c8310f9a757675a06668847"
      ],
      "author": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 23 17:48:01 2026 +0200"
      },
      "committer": {
        "name": "Stefan Bodewig",
        "email": "bodewig@apache.org",
        "time": "Sat May 23 17:48:01 2026 +0200"
      },
      "message": "try to generalize logic for tarball boms\n"
    }
  ],
  "next": "7584d45063e32b840c8310f9a757675a06668847"
}