Cargo.lock, Truncated — Intentionally Corrupt
An intentionally corrupt Cargo.lock: a valid version 4 lockfile cut off inside a [[package]] table so the final key/value pair is incomplete. Small on purpose. Every package, version, hash and licence is fictional — the tree describes nothing real.
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
version = 4
[[package]]
name = "example-router"
version = "2.1.3"
source = "registry+https://crates.orchard.example/index"
checksum = "c1506ed5e4abdb25e6ad89e995bc6040c6eb12e323f63ff6798a6e8b816bb305"
dependencies = [
"example-logger",
"example-retry",
]
[[package]]
name = "example-http-core"
version = "1.8.0"
source = "registry+https://crates.orchard.example/index"
checksum = "7bc96c3b46d
Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- Cargo
- Damage
- truncated mid-table
- Intentionally Corrupt
- true
- Line Endings
- LF
Testing contract
Expected to fail- Scenario
- Fail cleanly on a lockfile whose TOML is truncated mid-table.
- Expected result
- TOML parser raises a parse error naming the final line; no partially-read package is added to the resolved set.
What is a .lock file?
A .lock file pins the exact dependency graph a package manager resolved, so a later install reproduces it byte for byte. Cargo.lock and Poetry's poetry.lock use TOML, Gemfile.lock and yarn.lock use their own line-oriented grammars, and all of them record resolved versions, source registries, integrity hashes, and the transitive edges between packages. It is committed alongside the human-edited manifest, which states ranges rather than exact versions.
How to use this file
Use an example .lock file to test dependency parsers, SBOM generators, and vulnerability scanners, verifying that transitive dependencies and integrity hashes are read correctly and that a pinned version is never confused with the range declared in the manifest.
How to use this file for testing
“Cargo.lock, Truncated — Intentionally Corrupt” is a deterministic Novus Examples fixture for Error handling, Config parsing. Deliberately corrupt and invalid files, clearly labelled, for testing how your tool fails.
Documented properties for this file: seed 51200 · damage: truncated mid-table · LF · intentionally corrupt. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Related files
- lockGemfile.lock (Bundler)A Bundler lockfile in its indentation-significant block format — specs nested under GEM, transitive requirements nested one level deeper, and the BUNDLED WITH version on its own indented line. Every package, version, hash and licence is fictional — the tree describes nothing real.
- txtgo.sum Checksum Lines (as .txt)go.sum content: two h1: lines per fictional module — one for the module zip and one for its go.mod — which is the pairing a verifier must require. Served as .txt because go.sum has no registered media type. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockmix.lock (Elixir)An Elixir mix.lock: a literal Elixir map whose values are tuples of atoms, strings and lists. It is neither JSON nor TOML, so a generic lockfile reader has to special-case it. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockyarn.lock (Berry, __metadata version 8)A modern Yarn Berry lockfile: YAML-shaped with an __metadata header, npm: protocol resolutions and cache-key-prefixed checksums — deliberately different from the Classic file in the same family. Every package, version, hash and licence is fictional — the tree describes nothing real.
- txtDetached Signature, ASCII Armor — SAMPLE ShapeAn ASCII-armored detached signature block of the shape that accompanies a SHA256SUMS file. It is a SAMPLE placeholder, not a valid OpenPGP signature — armor detectors will find it, verifiers must reject it. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
- txtRelease SHA256SUMS ManifestThe oldest supply-chain artifact there is: a sha256sum manifest with the exact two-space separator the tool emits, listing a fictional release tarball and its nine dependency archives. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.