Podfile.lock (CocoaPods)
A CocoaPods lockfile: a YAML-subset document listing pods with their nested requirements, a SPEC CHECKSUMS block of SHA-1 values and the CocoaPods version that produced it. Every package, version, hash and licence is fictional — the tree describes nothing real.
PODS:
- ExampleCache (0.9.2):
- ExampleYamllite (~> 1.1)
- ExampleCrypto (1.2.0)
- ExampleHttpCore (1.8.0):
- ExampleLogger (~> 3.4)
- ExampleJsonpath (~> 2.0)
- ExampleJsonpath (2.0.5)
- ExampleLogger (3.4.1)
- ExampleMetrics (4.0.0):
- ExampleLogger (~> 3.4)
- ExampleRetry (1.0.4)
- ExampleRouter (2.1.3):
- ExampleLogger (~> 3.4)
- ExampleRetry (~> 1.0)
- ExampleYamllite (1.1.7):
- ExampleJsonpath (~> 2.0)
DEPENDENCIES:
- ExampleCache (~> 0.9)
- ExampleCrypto (~> 1.2)
- ExampleHttpCore (~> 1.8)
- ExampleMetrics (~> 4.0)
- ExampleRouter (~> 2.1)
SPEC CHECKSUMS:
ExampleCache: 71a42d61279f8164c3e201e51aba17a7cca95781
ExampleCrypto: b731da7462cfb4f74ab961ca678a9b0cd34020bd
ExampleHttpCore: 6140c408d6c2223c4b95770bebe9c4f305240242
ExampleJsonpath: 07501c942559b95eeaa039e077a54a49e0e27168
ExampleLogger: 1d435752fc6dc2a6763f4aa95bcacb00af98e16c
ExampleMetrics: 571a9adf257e58733e12e5573ecc227182d000e0
ExampleRetry: 6195725d924104227251623a9bb21d97c7c68c42
ExampleRouter: 7bd40b8567e9ece777af8bf488bb6a7baf6dce7e
ExampleYamllite: 486acf9bceb9993b82315d314cbde893d2f11678
PODFILE CHECKSUM: 83c64c4ee0c519275499b78e0455d318c3e6082e
COCOAPODS: 1.15.2
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- CocoaPods
- Pods
- 9
- Checksums
- SHA-1
- Syntax
- YAML subset
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Read a Podfile.lock as YAML and verify every pod has a spec checksum.
- Expected result
- Nine pods parse from the PODS block and each has a matching entry in SPEC CHECKSUMS — no pod is left unchecksummed.
What is a .lock file?
A .lock file pins the exact dependency graph a package manager resolved, so a later install reproduces it byte for byte. Cargo.lock and Poetry's poetry.lock use TOML, Gemfile.lock and yarn.lock use their own line-oriented grammars, and all of them record resolved versions, source registries, integrity hashes, and the transitive edges between packages. It is committed alongside the human-edited manifest, which states ranges rather than exact versions.
How to use this file
Use an example .lock file to test dependency parsers, SBOM generators, and vulnerability scanners, verifying that transitive dependencies and integrity hashes are read correctly and that a pinned version is never confused with the range declared in the manifest.
How to use this file for testing
“Podfile.lock (CocoaPods)” is a deterministic Novus Examples fixture for Config parsing, Conversion testing. TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Related files
- lockCargo.lock (version 3, Legacy)The same fictional Rust tree pinned by a version 3 Cargo.lock, for testing that a reader keys on the declared version rather than assuming the newest format. Every package, version, hash and licence is fictional — the tree describes nothing real.

- lockCargo.lock (version 4)A Rust Cargo.lock in the version 4 format — TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional — the tree describes nothing real.

- txtRelease SHA256SUMS ManifestThe oldest supply-chain artifact there is: a sha256sum manifest with the exact two-space separator the tool emits, listing a fictional release tarball and its nine dependency archives. Every package, version, hash and licence is fictional — the tree describes nothing real.

- spdxSPDX 2.2 Legacy SBOM (Tag-Value)The same fictional tree as an SPDX 2.2 tag-value document — the version still produced by older toolchains — for upgrade and compatibility tests against the 2.3 twin in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.

- spdxSPDX 2.3 Application SBOM (Tag-Value)The same SPDX 2.3 SBOM in the specification's plain-text tag-value form — the serialisation many licence-compliance tools still read first, and the exact twin of the JSON document in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.

- yamlSPDX 2.3 Application SBOM (YAML)The SPDX 2.3 SBOM in its YAML serialisation — the third form the specification defines alongside JSON and tag-value, and the one most often hand-edited in a repository. Every package, version, hash and licence is fictional — the tree describes nothing real.

Generated by generation/supply_chain.py. Free for any use, no attribution required — license.