Cargo.lock (version 3, Legacy)
The same fictional Rust tree pinned by a version 3 Cargo.lock, for testing that a reader keys on the declared version rather than assuming the newest format. Every package, version, hash and licence is fictional — the tree describes nothing real.
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
version = 3
[[package]]
name = "example-router"
version = "2.1.3"
source = "registry+https://crates.orchard.example/index"
checksum = "c1506ed5e4abdb25e6ad89e995bc6040c6eb12e323f63ff6798a6e8b816bb305"
dependencies = [
"example-logger",
"example-retry",
]
[[package]]
name = "example-http-core"
version = "1.8.0"
source = "registry+https://crates.orchard.example/index"
checksum = "7bc96c3b46df81a9f927b390b96669958efaa9c2496d7d3600344eb2025cb620"
dependencies = [
"example-logger",
"example-json-path",
]
[[package]]
name = "example-metrics"
version = "4.0.0"
source = "registry+https://crates.orchard.example/index"
checksum = "f3014c88643d6e5840a6a7741a7c9841c4fa3c9120465a593b97c30998bc7f1b"
dependencies = [
"example-logger",
]
[[package]]
name = "example-cache"
version = "0.9.2"
source = "registry+https://crates.orchard.example/index"
checksum = "ca8c65b32ceccf756566d16cd70f68aceddf73461beb416005fc1d3144ab8646"
dependencies = [
"example-yaml-lite",
]
[[package]]
name = "example-crypto-shim"
version = "1.2.0"
source = "registry+https://crates.orchard.example/index"
checksum = "f2d5dbe27cd5624b7c334c405f2f8c6ad047f6f086a61ac43127d6ce1d03ccb8"
[[package]]Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- Cargo
- Lock Version
- 3
- Packages
- 9
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Read both Cargo.lock format versions through one code path.
- Expected result
- The v3 and v4 files produce identical package sets and checksums; only the version integer differs.
What is a .lock file?
A .lock file pins the exact dependency graph a package manager resolved, so a later install reproduces it byte for byte. Cargo.lock and Poetry's poetry.lock use TOML, Gemfile.lock and yarn.lock use their own line-oriented grammars, and all of them record resolved versions, source registries, integrity hashes, and the transitive edges between packages. It is committed alongside the human-edited manifest, which states ranges rather than exact versions.
How to use this file
Use an example .lock file to test dependency parsers, SBOM generators, and vulnerability scanners, verifying that transitive dependencies and integrity hashes are read correctly and that a pinned version is never confused with the range declared in the manifest.
How to use this file for testing
“Cargo.lock (version 3, Legacy)” is a deterministic Novus Examples fixture for Config parsing, Conversion testing. TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Related files
- lockbun.lock (Text Lockfile)Bun's text lockfile, where each package is a positional array of descriptor, dependency map and integrity string rather than an object — a shape that breaks parsers assuming every lock entry is keyed. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockcomposer.lock (PHP)A PHP composer.lock in JSON, pinning each fictional package by both a git reference and a dist zip shasum, with a content-hash binding it to composer.json. Every package, version, hash and licence is fictional — the tree describes nothing real.
- txtconda Explicit Environment LockA conda explicit lock: an @EXPLICIT marker followed by one fully-resolved URL per fictional package with an md5 fragment — no solver involved, which is exactly what makes it a lockfile. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockGemfile.lock (Bundler)A Bundler lockfile in its indentation-significant block format — specs nested under GEM, transitive requirements nested one level deeper, and the BUNDLED WITH version on its own indented line. Every package, version, hash and licence is fictional — the tree describes nothing real.
- txtgo.mod Module Manifest (as .txt)A Go module manifest with separate direct and // indirect require blocks for the fictional tree. Served with a .txt extension because go.mod has no registered media type; the content is verbatim go.mod syntax. Every package, version, hash and licence is fictional — the tree describes nothing real.
- txtgo.sum Checksum Lines (as .txt)go.sum content: two h1: lines per fictional module — one for the module zip and one for its go.mod — which is the pairing a verifier must require. Served as .txt because go.sum has no registered media type. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.