Cargo.lock (version 4)
A Rust Cargo.lock in the version 4 format — TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional — the tree describes nothing real.
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
version = 4
[[package]]
name = "example-router"
version = "2.1.3"
source = "registry+https://crates.orchard.example/index"
checksum = "c1506ed5e4abdb25e6ad89e995bc6040c6eb12e323f63ff6798a6e8b816bb305"
dependencies = [
"example-logger",
"example-retry",
]
[[package]]
name = "example-http-core"
version = "1.8.0"
source = "registry+https://crates.orchard.example/index"
checksum = "7bc96c3b46df81a9f927b390b96669958efaa9c2496d7d3600344eb2025cb620"
dependencies = [
"example-logger",
"example-json-path",
]
[[package]]
name = "example-metrics"
version = "4.0.0"
source = "registry+https://crates.orchard.example/index"
checksum = "f3014c88643d6e5840a6a7741a7c9841c4fa3c9120465a593b97c30998bc7f1b"
dependencies = [
"example-logger",
]
[[package]]
name = "example-cache"
version = "0.9.2"
source = "registry+https://crates.orchard.example/index"
checksum = "ca8c65b32ceccf756566d16cd70f68aceddf73461beb416005fc1d3144ab8646"
dependencies = [
"example-yaml-lite",
]
[[package]]
name = "example-crypto-shim"
version = "1.2.0"
source = "registry+https://crates.orchard.example/index"
checksum = "f2d5dbe27cd5624b7c334c405f2f8c6ad047f6f086a61ac43127d6ce1d03ccb8"
[[package]]Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- Cargo
- Lock Version
- 4
- Packages
- 9
- Syntax
- TOML
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Resolve Cargo.lock dependency entries, which name packages without versions.
- Expected result
- All 9 packages load and every dependency string resolves to exactly one [[package]] table — no unresolved or ambiguous names.
What is a .lock file?
A .lock file pins the exact dependency graph a package manager resolved, so a later install reproduces it byte for byte. Cargo.lock and Poetry's poetry.lock use TOML, Gemfile.lock and yarn.lock use their own line-oriented grammars, and all of them record resolved versions, source registries, integrity hashes, and the transitive edges between packages. It is committed alongside the human-edited manifest, which states ranges rather than exact versions.
How to use this file
Use an example .lock file to test dependency parsers, SBOM generators, and vulnerability scanners, verifying that transitive dependencies and integrity hashes are read correctly and that a pinned version is never confused with the range declared in the manifest.
How to use this file for testing
“Cargo.lock (version 4)” is a deterministic Novus Examples fixture for Config parsing, Conversion testing, Schema validation. TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Related files
- txtpip requirements.txt With Pinned HashesA hash-pinned pip requirements file with two sha256 hashes per fictional package (wheel and sdist) and line continuations — the form `--require-hashes` installs demand. Every package, version, hash and licence is fictional — the tree describes nothing real.
- yamlpnpm-lock.yaml (lockfileVersion 9)A pnpm v9 lockfile with its three-section layout — importers for declared specifiers, packages for resolution metadata and snapshots for the resolved edges — pinning the same fictional tree. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockpoetry.lock (TOML)A Poetry lockfile: TOML array-of-tables entries with per-artifact sha256 hashes, a [package.dependencies] table per package and the content-hash that binds the lock to pyproject.toml. Every package, version, hash and licence is fictional — the tree describes nothing real.
- spdxSPDX 2.2 Legacy SBOM (Tag-Value)The same fictional tree as an SPDX 2.2 tag-value document — the version still produced by older toolchains — for upgrade and compatibility tests against the 2.3 twin in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.
- yamlSPDX 2.3 Application SBOM (YAML)The SPDX 2.3 SBOM in its YAML serialisation — the third form the specification defines alongside JSON and tag-value, and the one most often hand-edited in a repository. Every package, version, hash and licence is fictional — the tree describes nothing real.
- spdxSPDX 2.3 SBOM With LicenseRef and Compound ExpressionsAn SPDX tag-value SBOM that declares a non-standard LicenseRef with its extracted text and uses it inside compound expressions — the case that breaks compliance tools which assume every licence is an SPDX id. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.