Search files, editable visual templates, and live browser targets from one registry-backed directory. Filtered query views stay crawlable for links but are deliberately noindex; the stable taxonomy pages below remain the canonical search surfaces.
Page 2 of 5; 24 results per page.
A CycloneDX SBOM whose author names and properties contain accented Latin, CJK, right-to-left Hebrew, emoji and a deliberately long property value — for testing encoding handling and field-width assumptions. Every package, version, hash and licence is fictional — the tree describes nothing real.
An intentionally corrupt CycloneDX SBOM: a valid 1.6 document cut off mid-object so the JSON never closes. Small on purpose — it exists to check that a reader fails cleanly instead of half-loading a component list. Every package, version, hash and licence is fictional — the tree describes nothing real.
A CycloneDX VEX document asserting a different analysis state for each of the four SAMPLE advisories, so a suppression pipeline can be tested against every branch at once. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
The shape a hosted dependency-alert API returns: alerts with lifecycle state, a nested advisory, a patched-version pointer and an explicitly null dismissed_reason on the alerts that were not dismissed. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
The dependency graph in GraphML, with typed attribute keys for node version, licence and depth and for edge range — the interchange format graph databases and analysis tools import. Every package, version, hash and licence is fictional — the tree describes nothing real.
The dependency graph as Mermaid, for embedding in Markdown documentation — labelled edges carry the declared range and a classDef highlights the two diamond joins. Every package, version, hash and licence is fictional — the tree describes nothing real.
The cyclic plugin graph as DOT, with the three cycle edges highlighted. Graphviz renders it happily, which is exactly why a topological sort must be the thing that rejects it. Every package, version, hash and licence is fictional — the tree describes nothing real.
A dependency graph containing a genuine three-node cycle between fictional plugins — the fixture that makes a naive recursive walker hang or blow the stack, with the cycle path stated so the expected answer is unambiguous. Every package, version, hash and licence is fictional — the tree describes nothing real.
An explicit node/edge dependency graph with in-degree, out-degree and depth precomputed, plus a diamonds array naming the two shared nodes and their parents — the reference answer for any graph builder run against the SBOMs and lockfiles here. Every package, version, hash and licence is fictional — the tree describes nothing real.
The same diamond graph as Graphviz DOT, with edge labels carrying the declared semver range and the two diamond joins filled — renderable to SVG and diffable against the JSON twin. Every package, version, hash and licence is fictional — the tree describes nothing real.
An ASCII-armored detached signature block of the shape that accompanies a SHA256SUMS file. It is a SAMPLE placeholder, not a valid OpenPGP signature — armor detectors will find it, verifiers must reject it. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
An intentionally corrupt DSSE envelope: the JSON parses and the signature block looks complete, but the payload is truncated and contains characters outside the base64 alphabet. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
A DSSE envelope whose base64 payload decodes to the SLSA v1 statement in this family — the wrapper attestation tooling actually transports. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
A Bundler lockfile in its indentation-significant block format — specs nested under GEM, transitive requirements nested one level deeper, and the BUNDLED WITH version on its own indented line. Every package, version, hash and licence is fictional — the tree describes nothing real.
`go mod graph` output: a flat edge list, one `parent@version child@version` pair per line with no indentation at all — the simplest graph serialisation in this category and the easiest to diff. Every package, version, hash and licence is fictional — the tree describes nothing real.
A Go module manifest with separate direct and // indirect require blocks for the fictional tree. Served with a .txt extension because go.mod has no registered media type; the content is verbatim go.mod syntax. Every package, version, hash and licence is fictional — the tree describes nothing real.
go.sum content: two h1: lines per fictional module — one for the module zip and one for its go.mod — which is the pairing a verifier must require. Served as .txt because go.sum has no registered media type. Every package, version, hash and licence is fictional — the tree describes nothing real.
Gradle's dependency report, which marks repeat subtrees with `(*)` and explains the marker in a footer — so a parser has to resolve those references back to their first occurrence. Every package, version, hash and licence is fictional — the tree describes nothing real.
A Gradle dependency lockfile: one `group:artifact:version=configurations` line per fictional module plus the `empty=` line that records configurations resolving to nothing. Every package, version, hash and licence is fictional — the tree describes nothing real.
A Grype-shaped report of the same four SAMPLE advisories, with the match detail block that explains WHY each package matched — the field that makes false positives diagnosable. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
The console table a scanner prints, in fixed-width columns — the output people actually paste into tickets, and the one a log scraper has to parse without a delimiter. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
The policy half of in-toto: a layout declaring which steps must run, which keys may sign them, and the MATCH/CREATE/DISALLOW artifact rules that bind each step's products to the next step's materials. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
An in-toto link file recording one build step: the materials that went in, the products that came out and their sha256 digests, wrapped in the signed/signatures envelope in-toto uses. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
The predecessor predicate: SLSA v0.2 uses invocation/materials/buildConfig where v1 uses buildDefinition/runDetails, so this file is the migration test for any verifier that must accept both. Every package, version, hash and licence is fictional — the tree describes nothing real.
We use Google Analytics and show ads via Adsterra. Non-essential cookies and ad scripts run only after you allow the matching categories. See our cookie policy.
