Browse supply-chain · Novus Examples

pip-audit Report (JSON)

A pip-audit report for the fictional Python packages. It deliberately carries no severity field — pip-audit does not assign one — which is the case a severity gate must handle without defaulting to critical. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

File: JSON · Vulnerability
Use case: JSON parsingConversion testing+1· Conversion set

pip-compile Annotated requirements.txt

A pip-compile output where every pin carries a `# via` annotation naming the requirement that pulled it in — the only place the transitive graph survives in a pip workflow. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: TXT · Lockfiles
Use case: Config parsingGraph data+1· Conversion set

pipdeptree JSON Output

pipdeptree output, whose top level is an ARRAY rather than an object — the shape that breaks a loader written against npm's tree — with both installed and required versions on every edge. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: JSON · Graphs
Use case: JSON parsingGraph data+1· Conversion set

Pipfile.lock (Pipenv)

A Pipenv lockfile in JSON, with the _meta hash that ties it to its Pipfile, a named index source and nine fictional pinned packages in the default section. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: LOCK · Lockfiles
Use case: JSON parsingConfig parsing+1· Conversion set

pnpm-lock.yaml (lockfileVersion 9)

A pnpm v9 lockfile with its three-section layout — importers for declared specifiers, packages for resolution metadata and snapshots for the resolved edges — pinning the same fictional tree. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: YAML · Lockfiles
Use case: Config parsingConversion testing+1· Conversion set

Podfile.lock (CocoaPods)

A CocoaPods lockfile: a YAML-subset document listing pods with their nested requirements, a SPEC CHECKSUMS block of SHA-1 values and the CocoaPods version that produced it. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: LOCK · Lockfiles
Use case: Config parsingConversion testing· Conversion set

poetry.lock (TOML)

A Poetry lockfile: TOML array-of-tables entries with per-artifact sha256 hashes, a [package.dependencies] table per package and the content-hash that binds the lock to pyproject.toml. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: LOCK · Lockfiles
Use case: Config parsingConversion testing+1· Conversion set

Provenance Verification Runbook (Markdown)

The five checks a verifier must perform against the attestation fixtures in this category, and the exact result each one should produce — including the two that are meant to fail. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: MD · Provenance
Use case: Editor testingConversion testing· Conversion set

pubspec.lock (Dart/Flutter)

A Dart pubspec.lock in YAML, labelling each fictional package as direct main or transitive and recording a sha256 in its description block along with the SDK constraint. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: LOCK · Lockfiles
Use case: Config parsingConversion testing· Conversion set

Rekor Transparency-Log Entry

A transparency-log entry keyed by its own UUID at the top level — a shape that breaks parsers expecting a fixed root key — with a base64 body that decodes to a dsse record. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

File: JSON · Provenance
Use case: JSON parsingSchema validation+1· Conversion set

Release SHA256SUMS Manifest

The oldest supply-chain artifact there is: a sha256sum manifest with the exact two-space separator the tool emits, listing a fictional release tarball and its nine dependency archives. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: TXT · Provenance
Use case: Config parsingConversion testing+1· Conversion set

Reproducible Build Comparison Report

Two independent builds of the same fictional artifact on different architectures, both producing one digest — the evidence a rebuilder publishes, with SOURCE_DATE_EPOCH recorded as the thing that made it possible. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: JSON · Provenance
Use case: JSON parsingVisual diff / regression+1· Conversion set

SBOM Attestation Envelope (cosign Shape)

An attestation that binds an SBOM to an artifact digest rather than shipping the SBOM loose — the pattern keyless signing produces, complete with the empty keyid that identity-based signing leaves behind. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

File: JSON · Provenance
Use case: JSON parsingSchema validation+1· Conversion set

SBOM Component Inventory (CSV)

The same fictional component tree flattened to a spreadsheet-friendly CSV — name, version, licence, depth, purl and a SHA-256 prefix — for testing the export path SBOM tools offer alongside JSON. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: CSV · Sbom · 10 rows
Use case: CSV parsingData import+1· Conversion set

SBOM Format Crosswalk (CycloneDX to SPDX)

The field-by-field map between the CycloneDX 1.6 and SPDX 2.3 documents in this category, plus the five invariants a correct conversion preserves and the three things it legitimately loses. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: MD · Sbom
Use case: Conversion testingEditor testing· Conversion set

Scanner Report, Truncated — Intentionally Corrupt

An intentionally corrupt scanner report: a valid Trivy-shaped JSON document cut off inside the first finding, for testing that a CI gate fails the build rather than reporting zero vulnerabilities. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

File: JSON · Vulnerability
Use case: Error handlingJSON parsing· Conversion set

Scanner SARIF 2.1.0 Report

The same four SAMPLE findings expressed as SARIF 2.1.0 — the format code-scanning dashboards ingest — with a rules array, security-severity properties and physical locations. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

File: JSON · Vulnerability
Use case: JSON parsingSchema validation+1· Conversion set

Severity Scoring and SLA Matrix (CSV)

A severity-band table mapping CVSS ranges to remediation SLAs and gate actions, with the finding count each band has in this fixture set — so a policy engine can be tested end to end. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

File: CSV · Vulnerability · 5 rows
Use case: CSV parsingConfig testing+1· Conversion set

Sigstore Bundle (v0.3 Shape)

A Sigstore bundle in the shape verifiers read: a SAMPLE certificate, a transparency-log entry with an inclusion proof and checkpoint, and the DSSE envelope carrying the provenance. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

File: JSON · Provenance
Use case: JSON parsingCertificate & key testing+1· Conversion set

SLSA Build Level Matrix (CSV)

How the nine fictional dependencies distribute across SLSA build levels, with the policy outcome for each band — the table that turns the VSA's dependencyLevels object into something reviewable. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: CSV · Provenance · 4 rows
Use case: CSV parsingData import+1· Conversion set

SLSA Verification Summary Attestation (VSA)

A VSA — the attestation a verifier issues so downstream consumers do not have to re-verify the whole chain — recording a PASSED result against a fictional SLSA L3 policy and the level distribution of dependencies. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: JSON · Provenance
Use case: JSON parsingSchema validation+1· Conversion set

SPDX 2.2 Legacy SBOM (Tag-Value)

The same fictional tree as an SPDX 2.2 tag-value document — the version still produced by older toolchains — for upgrade and compatibility tests against the 2.3 twin in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: SPDX · Sbom
Use case: Config parsingConversion testing+1· Conversion set

SPDX 2.3 Application SBOM (JSON)

An SPDX 2.3 SBOM in JSON describing the same fictional tree as the CycloneDX documents in this category, with SPDXIDs, purl external references, SHA-256 checksums and DESCRIBES/DEPENDS_ON relationships. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: JSON · Sbom
Use case: JSON parsingConversion testing+2· Paired fixture

SPDX 2.3 Application SBOM (Tag-Value)

The same SPDX 2.3 SBOM in the specification's plain-text tag-value form — the serialisation many licence-compliance tools still read first, and the exact twin of the JSON document in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.

File: SPDX · Sbom
Use case: Conversion testingConfig parsing+1· Paired fixture

Explore the test library

Filter the library

116 results