anchor.diff:  <component group="org.apache.pdfbox" name="pdfbox" version="2.0.17">
      <artifact name="pdfbox-2.0.17.jar">
         <md5 value="c713a8e252d0add65e9282b151adf6b4" origin="official site"/>
  -      <sha1 value="b5c8dff799bd967c70ccae75e6972327ae640d35" origin="official site"/>
  +      <sha1 value="b5c8dff799bd967c70ccae75e6972327ae640d35" origin="official site" reason="Additional check for this artifact"/>
      </artifact>
   </component>
   ----
  
positive.code: <verification-metadata>
     <configuration>
        <trusted-artifacts>
           <trust group="^com[.]mycompany($|([.].*))" regex="true"/>
        </trusted-artifacts>
     </configuration>
  </verification-metadata>
  
negative.code: <verification-metadata>
     <configuration>
        <trusted-artifacts>
           <trust group="com.mycompany" reason="We trust mycompany artifacts"/>
        </trusted-artifacts>
     </configuration>
  </verification-metadata>
  