SLSA Build Level Matrix (CSV)
How the nine fictional dependencies distribute across SLSA build levels, with the policy outcome for each band — the table that turns the VSA's dependencyLevels object into something reviewable. Every package, version, hash and licence is fictional — the tree describes nothing real.
level,requirement,dependencies_at_this_level,policy_outcome
SLSA_BUILD_LEVEL_0,no provenance,2,not permitted for release
SLSA_BUILD_LEVEL_1,provenance exists,0,warn
SLSA_BUILD_LEVEL_2,signed provenance, hosted build,3,warn
SLSA_BUILD_LEVEL_3,hardened builder, non-falsifiable,4,pass
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- CSV
- Columns
- 4
- Rows
- 4
- Total Dependencies
- 9
- Line Endings
- LF (documented, not RFC 4180 CRLF)
Testing contract
Reference control- Scenario
- Reconcile a level matrix with the dependencyLevels object in a VSA.
- Expected result
- Row counts 2, 0, 3 and 4 sum to the 9 dependencies, and the level-0 bucket is the one the policy refuses.
What is a .csv file?
CSV (Comma-Separated Values) is a plain-text tabular format where rows are lines and fields are separated by commas, with quoting rules for values that contain delimiters, quotes, or newlines. It has no formal type system and depends on encoding and dialect conventions. It is the most portable format for tabular data exchange.
How to use this file
Use an example CSV to test parsers against quoting and embedded-delimiter edge cases, header handling, encoding detection, and import pipelines into databases or spreadsheets.
How to use this file for testing
“SLSA Build Level Matrix (CSV)” is a deterministic Novus Examples fixture for CSV parsing, Data import, Config testing. Clean and deliberately messy CSVs — quoted commas, embedded newlines, ragged rows, odd delimiters, and encodings.
Documented properties for this file: seed 51200 · 4 rows · 4 columns · LF (documented, not RFC 4180 CRLF). Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import pandas as pd
df = pd.read_csv("slsa-level-matrix.csv")
print(df.head())
print(df.dtypes)Related files
- csvSeverity Scoring and SLA Matrix (CSV)A severity-band table mapping CVSS ranges to remediation SLAs and gate actions, with the finding count each band has in this fixture set — so a policy engine can be tested end to end. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- csvLockfile Pin Summary (CSV)Declared range against resolved version for every fictional package pinned by the lockfiles in this category — the table a review needs to see which pins drifted from their manifest ranges. Every package, version, hash and licence is fictional — the tree describes nothing real.
- csvSBOM Component Inventory (CSV)The same fictional component tree flattened to a spreadsheet-friendly CSV — name, version, licence, depth, purl and a SHA-256 prefix — for testing the export path SBOM tools offer alongside JSON. Every package, version, hash and licence is fictional — the tree describes nothing real.
- csvTransitive Dependency Closure (CSV)Every edge in the fictional dependency graph as one row — parent, child, declared range, resolved version, depth and whether the edge is direct — the form a spreadsheet or SQL import can aggregate. Every package, version, hash and licence is fictional — the tree describes nothing real.
- csvVulnerability Summary (CSV)The four SAMPLE advisories flattened to one row each — the export a security review circulates, and the reference answer for any converter run against the Trivy, Grype or OSV reports here. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- csv10,000-Row CSVA CSV with 10,000 data rows — for testing streaming parsers, memory handling, and import performance.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.