conda Explicit Environment Lock
A conda explicit lock: an @EXPLICIT marker followed by one fully-resolved URL per fictional package with an md5 fragment — no solver involved, which is exactly what makes it a lockfile. Every package, version, hash and licence is fictional — the tree describes nothing real.
# This file may be used to create an environment using:
# $ conda create --name <env> --file <this file>
# platform: linux-64
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
@EXPLICIT
https://conda.orchard.example/linux-64/example-router-2.1.3-py312_0.conda#b5cb9a6cd060260f048cc1c65610291e
https://conda.orchard.example/linux-64/example-http-core-1.8.0-py312_0.conda#100ee7f503fd8a2194be6dcade138564
https://conda.orchard.example/linux-64/example-metrics-4.0.0-py312_0.conda#01ab170c0b27055c493c8d3c5d989fc0
https://conda.orchard.example/linux-64/example-cache-0.9.2-py312_0.conda#dcafb8bbc5136a688d8a9c305da2c1f8
https://conda.orchard.example/linux-64/example-crypto-shim-1.2.0-py312_0.conda#6fe1b644d0046b1aff9cb68ab5187b06
https://conda.orchard.example/linux-64/example-logger-3.4.1-py312_0.conda#722e22bff5fe892a503cad9e72434139
https://conda.orchard.example/linux-64/example-retry-1.0.4-py312_0.conda#28cce700a5f944715c3dec893013ef72
https://conda.orchard.example/linux-64/example-json-path-2.0.5-py312_0.conda#08b596a659369a62fa0cc01f5830e82a
https://conda.orchard.example/linux-64/example-yaml-lite-1.1.7-py312_0.conda#7005c484193f2c1cea4ebf4083092a39
Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- conda
- Mode
- @EXPLICIT
- Packages
- 9
- Checksum
- md5 fragment
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Read a conda explicit lock and extract package coordinates from URLs.
- Expected result
- Nine URLs parse into name, version, build string and md5, and the @EXPLICIT marker is recognised rather than treated as a package line.
What is a .txt file?
TXT is a plain-text file containing unformatted character data with no styling or structure beyond line breaks. Its interpretation depends on character encoding, most commonly UTF-8, and on line-ending convention. It is the most universal and portable text container.
How to use this file
Use an example TXT to test encoding detection, line-ending (LF versus CRLF) handling, and any tool that reads or streams raw text input.
How to use this file for testing
“conda Explicit Environment Lock” is a deterministic Novus Examples fixture for Config parsing, Conversion testing. TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Related files
- lockCargo.lock (version 3, Legacy)The same fictional Rust tree pinned by a version 3 Cargo.lock, for testing that a reader keys on the declared version rather than assuming the newest format. Every package, version, hash and licence is fictional — the tree describes nothing real.

- lockCargo.lock (version 4)A Rust Cargo.lock in the version 4 format — TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional — the tree describes nothing real.

- txtRelease SHA256SUMS ManifestThe oldest supply-chain artifact there is: a sha256sum manifest with the exact two-space separator the tool emits, listing a fictional release tarball and its nine dependency archives. Every package, version, hash and licence is fictional — the tree describes nothing real.

- spdxSPDX 2.2 Legacy SBOM (Tag-Value)The same fictional tree as an SPDX 2.2 tag-value document — the version still produced by older toolchains — for upgrade and compatibility tests against the 2.3 twin in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.

- spdxSPDX 2.3 Application SBOM (Tag-Value)The same SPDX 2.3 SBOM in the specification's plain-text tag-value form — the serialisation many licence-compliance tools still read first, and the exact twin of the JSON document in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.

- yamlSPDX 2.3 Application SBOM (YAML)The SPDX 2.3 SBOM in its YAML serialisation — the third form the specification defines alongside JSON and tag-value, and the one most often hand-edited in a repository. Every package, version, hash and licence is fictional — the tree describes nothing real.

Generated by generation/supply_chain.py. Free for any use, no attribution required — license.