Search files, editable visual templates, and live browser targets from one registry-backed directory. Filtered query views stay crawlable for links but are deliberately noindex; the stable taxonomy pages below remain the canonical search surfaces.
Page 1 of 5; 24 results per page.
The policy an admission controller evaluates before an artifact is allowed through: required predicate types, an allowed-builder list, a minimum SLSA level, a transparency-log requirement and one dated exception. Every package, version, hash and licence is fictional — the tree describes nothing real.
An in-toto statement whose predicate is an entire SPDX 2.3 document — the nesting that makes attestation payloads large and that a size-limited verifier has to cope with. Every package, version, hash and licence is fictional — the tree describes nothing real.
The plain build record a CI job writes next to its artifacts — source ref and commit, builder identity, timings, toolchain versions and output digests — from which a provenance statement can be generated. Every package, version, hash and licence is fictional — the tree describes nothing real.
Bun's text lockfile, where each package is a positional array of descriptor, dependency map and integrity string rather than an object — a shape that breaks parsers assuming every lock entry is keyed. Every package, version, hash and licence is fictional — the tree describes nothing real.
Cargo's tree output, which writes versions with a leading `v` and marks already-shown subtrees with `(*)` — close enough to npm's tree to fool a parser, different enough to break one. Every package, version, hash and licence is fictional — the tree describes nothing real.
A cargo-audit report that shows three findings while a fourth is on the ignore list, plus an unmaintained-crate warning — so a gate must decide whether warnings count against it. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
The same fictional Rust tree pinned by a version 3 Cargo.lock, for testing that a reader keys on the declared version rather than assuming the newest format. Every package, version, hash and licence is fictional — the tree describes nothing real.
A Rust Cargo.lock in the version 4 format — TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional — the tree describes nothing real.
An intentionally corrupt Cargo.lock: a valid version 4 lockfile cut off inside a [[package]] table so the final key/value pair is incomplete. Small on purpose. Every package, version, hash and licence is fictional — the tree describes nothing real.
A PHP composer.lock in JSON, pinning each fictional package by both a git reference and a dist zip shasum, with a content-hash binding it to composer.json. Every package, version, hash and licence is fictional — the tree describes nothing real.
A conda explicit lock: an @EXPLICIT marker followed by one fully-resolved URL per fictional package with an md5 fragment — no solver involved, which is exactly what makes it a lockfile. Every package, version, hash and licence is fictional — the tree describes nothing real.
A CSAF 2.0 VEX advisory with the nested product tree that CSAF requires — vendor, product name, product version — and product_status buckets rather than a per-statement status field. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
A CycloneDX 1.4 XML SBOM of the same fictional tree — the version most long-lived tooling emitted first, kept for backwards-compatibility tests against the 1.5 and 1.6 documents in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.
A CycloneDX 1.5 SBOM of the same fictional tree, useful for spec-version migration tests: 1.5 introduced the object form of metadata.tools and this file uses it, while dropping the 1.6-only external references. Every package, version, hash and licence is fictional — the tree describes nothing real.
A complete CycloneDX 1.6 SBOM in JSON for a fictional application and its nine dependencies, with purls, SHA-256 hashes, supplier records, external references and an explicit dependency graph. Every package, version, hash and licence is fictional — the tree describes nothing real.
The same fictional CycloneDX 1.6 SBOM serialised as XML against the cyclonedx.org/schema/bom/1.6 namespace — the JSON twin of this file carries identical components and edges, so a converter can be diffed exactly. Every package, version, hash and licence is fictional — the tree describes nothing real.
The smallest CycloneDX document that is still valid: required metadata, one fictional component, and no dependencies array — for testing that a reader handles an SBOM with nothing optional present. Every package, version, hash and licence is fictional — the tree describes nothing real.
A CycloneDX SBOM whose root component is an OCI container image rather than an application, mixing a fictional operating-system package with language packages — the shape an image scanner emits. Every package, version, hash and licence is fictional — the tree describes nothing real.
A CycloneDX 1.6 SBOM whose dependencies array contains two diamonds: the fictional example-logger is reached through three parents and example-json-path through two, both resolving to a single node. Every package, version, hash and licence is fictional — the tree describes nothing real.
A CycloneDX 1.6 SBOM that carries its own vulnerabilities array — four clearly-marked SAMPLE advisories in the invented NOVUS-SAMPLE namespace, with CVSS v3.1 vectors, CWE classes and affected version ranges. Every package, version, hash and licence is fictional — the tree describes nothing real.
Every fictional component in this CycloneDX SBOM carries three hash algorithms and five external-reference types (distribution, vcs, issue-tracker, documentation, build-system). Every package, version, hash and licence is fictional — the tree describes nothing real.
An intentionally invalid CycloneDX SBOM: the JSON parses, but bomFormat is missing, one component has no name, and a dependency references a bom-ref that no component declares. Every package, version, hash and licence is fictional — the tree describes nothing real.
A CycloneDX SBOM that declares external services and composition completeness alongside components — the sections tools most often skip. Both services are fictional endpoints on the .example domain. Every package, version, hash and licence is fictional — the tree describes nothing real.
A CycloneDX SBOM that uses compound SPDX licence expressions — AND, OR, WITH and a LicenseRef — instead of plain licence ids, for testing compliance scanners that must evaluate the expression grammar. Every package, version, hash and licence is fictional — the tree describes nothing real.
We use Google Analytics and show ads via Adsterra. Non-essential cookies and ad scripts run only after you allow the matching categories. See our cookie policy.
