Novus Examples, Real, documented example files for testing

Cucumber Messages: Passing Checkout Run (NDJSON)

The machine twin of checkout.feature: the cucumber-messages envelope stream a runner emits, with meta, source, gherkinDocument, one pickle per expanded scenario, and paired testStepStarted/testStepFinished envelopes carrying nanosecond durations. Written as NDJSON because that is the format's actual wire shape: one envelope per line, not a JSON array.

File: NDJSON · Bdd · UTF-8
Use case: JSON parsingConversion testing+1· Conversion set

Customer Feedback (Fillable PDF)

A fillable PDF customer-feedback AcroForm: a 1–5 rating radio row, a 0–10 NPS dropdown, what-you-liked checkboxes, and a comments box.

File: PDF · Acroform · 9 fields
Use case: Form testingPDF form filling+2

CWL CommandLineTool Definition

A CWL v1.2 CommandLineTool with typed inputs, positional and prefixed bindings, a JavaScript outputEval expression, resource requirements, a Docker hint, and an IANA $namespaces block. Inert: it describes an invocation and runs nothing.

File: CWL · Cwl
Use case: Config testingConfig parsing+1

CWL Scatter and Cross-Product

CWL scatter in both forms: a single-parameter scatter over an array input, and a two-parameter scatter with scatterMethod flat_crossproduct. The scatter dimensionality is what distinguishes correct CWL engines from approximate ones.

File: CWL · Cwl
Use case: Graph dataData engineering+1

CWL Workflow (Six-Step Topology)

A CWL Workflow carrying the same six-step ETL topology as the Airflow and Argo fixtures, with dependencies expressed as step output references and a multi-source input resolved by pickValue. For cross-format DAG conversion tests.

File: CWL · Cwl
Use case: Graph dataData engineering+1

CWL Workflow, Intentionally Invalid

An intentionally invalid CWL document: a nonexistent cwlVersion, an unknown class, a step consuming an output no step produces, and outputs given as a bare string. Four documented faults for a CWL validator to report.

File: CWL · Cwl
Use case: Error handlingConfig parsing+1

CycloneDX 1.4 Application SBOM (XML)

A CycloneDX 1.4 XML SBOM of the same fictional tree: the version most long-lived tooling emitted first, kept for backwards-compatibility tests against the 1.5 and 1.6 documents in this family. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: XML · Sbom
Use case: Conversion testingSchema validation· Conversion set

CycloneDX 1.5 Application SBOM (JSON)

A CycloneDX 1.5 SBOM of the same fictional tree, useful for spec-version migration tests: 1.5 introduced the object form of metadata.tools and this file uses it, while dropping the 1.6-only external references. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: JSON parsingConversion testing+1· Conversion set

CycloneDX 1.6 Application SBOM (JSON)

A complete CycloneDX 1.6 SBOM in JSON for a fictional application and its nine dependencies, with purls, SHA-256 hashes, supplier records, external references and an explicit dependency graph. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: JSON parsingConversion testing+2· Paired fixture

CycloneDX 1.6 Application SBOM (XML)

The same fictional CycloneDX 1.6 SBOM serialised as XML against the cyclonedx.org/schema/bom/1.6 namespace: the JSON twin of this file carries identical components and edges, so a converter can be diffed exactly. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: XML · Sbom
Use case: Conversion testingSchema validation+1· Paired fixture

CycloneDX 1.6 Minimal SBOM (One Component)

The smallest CycloneDX document that is still valid: required metadata, one fictional component, and no dependencies array, for testing that a reader handles an SBOM with nothing optional present. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: JSON parsingSchema validation+1· Conversion set

CycloneDX Container Image SBOM

A CycloneDX SBOM whose root component is an OCI container image rather than an application, mixing a fictional operating-system package with language packages: the shape an image scanner emits. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: JSON parsingConversion testing+1· Conversion set

CycloneDX SBOM With Diamond Dependency Graph

A CycloneDX 1.6 SBOM whose dependencies array contains two diamonds: the fictional example-logger is reached through three parents and example-json-path through two, both resolving to a single node. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: JSON parsingGraph data+1· Conversion set

CycloneDX SBOM With Embedded SAMPLE Vulnerabilities

A CycloneDX 1.6 SBOM that carries its own vulnerabilities array: four clearly-marked SAMPLE advisories in the invented NOVUS-SAMPLE namespace, with CVSS v3.1 vectors, CWE classes and affected version ranges. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: JSON parsingSchema validation+1· Conversion set

CycloneDX SBOM With External References and Multi-Algorithm Hashes

Every fictional component in this CycloneDX SBOM carries three hash algorithms and five external-reference types (distribution, vcs, issue-tracker, documentation, build-system). Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: JSON parsingMetadata testing+1· Conversion set

CycloneDX SBOM With Schema Violations: Intentionally Invalid

An intentionally invalid CycloneDX SBOM: the JSON parses, but bomFormat is missing, one component has no name, and a dependency references a bom-ref that no component declares. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: Schema validationError handling+1· Conversion set

CycloneDX SBOM With Services and Compositions

A CycloneDX SBOM that declares external services and composition completeness alongside components: the sections tools most often skip. Both services are fictional endpoints on the .example domain. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: JSON parsingSchema validation+1· Conversion set

CycloneDX SBOM With SPDX Licence Expressions

A CycloneDX SBOM that uses compound SPDX licence expressions (AND, OR, WITH and a LicenseRef), instead of plain licence ids, for testing compliance scanners that must evaluate the expression grammar. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: JSON parsingSchema validation+1· Conversion set

CycloneDX SBOM With Unicode Metadata (Edge Case)

A CycloneDX SBOM whose author names and properties contain accented Latin, CJK, right-to-left Hebrew, emoji and a deliberately long property value, for testing encoding handling and field-width assumptions. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom · UTF-8 (no BOM)
Use case: JSON parsingEncoding detection+1· Conversion set

CycloneDX SBOM, Truncated: Intentionally Corrupt

An intentionally corrupt CycloneDX SBOM: a valid 1.6 document cut off mid-object so the JSON never closes. Small on purpose: it exists to check that a reader fails cleanly instead of half-loading a component list. Every package, version, hash and licence is fictional: the tree describes nothing real.

File: JSON · Sbom
Use case: Error handlingJSON parsing· Conversion set

CycloneDX VEX Document

A CycloneDX VEX document asserting a different analysis state for each of the four SAMPLE advisories, so a suppression pipeline can be tested against every branch at once. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

File: JSON · Vulnerability
Use case: JSON parsingSchema validation+1· Conversion set

DAE: COLLADA Cube

A 10 mm cube as COLLADA (.dae): the XML digital-asset-exchange format used across 3D tools and game engines. For testing COLLADA parsers and conversion.

File: DAE · Mesh · 12 triangles
Use case: Conversion testing· Conversion set

DAE: Signpost, Y_UP declared

The same signpost as COLLADA with `<up_axis>Y_UP</up_axis>` and `<unit meter="1" name="metre"/>` in its asset block. Unlike glTF, OBJ and STL, COLLADA states its convention, so an importer that still gets the orientation wrong has no excuse.

File: DAE · Units · 48 triangles
Use case: Conversion testingMetadata testing+1· Paired fixture

DAE: Signpost, Z_UP declared

The same signpost as COLLADA with `<up_axis>Z_UP</up_axis>` and `<unit meter="1" name="metre"/>` in its asset block. Unlike glTF, OBJ and STL, COLLADA states its convention, so an importer that still gets the orientation wrong has no excuse.

File: DAE · Units · 48 triangles
Use case: Conversion testingMetadata testing+1· Paired fixture

Explore the test library

Filter the library

5297 results