Skip to content
Novus Examples
xml6 KB

CycloneDX 1.4 Application SBOM (XML)

A CycloneDX 1.4 XML SBOM of the same fictional tree — the version most long-lived tooling emitted first, kept for backwards-compatibility tests against the 1.5 and 1.6 documents in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.

Conversion testingSchema validation
Preview — first 50 linesxml
<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.4" serialNumber="urn:uuid:0369e4af-8aac-4394-a6e4-e7b02a8a0ad1" version="1">
  <metadata>
    <timestamp>2026-01-01T00:00:00Z</timestamp>
    <authors>
      <author><name>Orchard SBOM Team (fictional)</name><email>sbom@orchard.example</email></author>
    </authors>
    <component type="application" bom-ref="pkg:npm/%40orchard-example/gateway@4.2.0">
      <name>@orchard-example/gateway</name>
      <version>4.2.0</version>
      <purl>pkg:npm/%40orchard-example/gateway@4.2.0</purl>
    </component>
    <properties>
      <property name="novus:sample">SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.</property>
    </properties>
  </metadata>
  <components>
    <component type="library" bom-ref="pkg:npm/%40orchard-example/router@2.1.3">
      <name>@orchard-example/router</name>
      <version>2.1.3</version>
      <purl>pkg:npm/%40orchard-example/router@2.1.3</purl>
      <licenses>
        <license><id>Apache-2.0</id></license>
      </licenses>
      <hashes>
        <hash alg="SHA-256">d17f0a5171a018c41cdaaa2701b6c32bf49f7404032fa45e5721e2b794cd2e51</hash>
      </hashes>
    </component>
    <component type="library" bom-ref="pkg:npm/%40orchard-example/http-core@1.8.0">
      <name>@orchard-example/http-core</name>
      <version>1.8.0</version>
      <purl>pkg:npm/%40orchard-example/http-core@1.8.0</purl>
      <licenses>
        <license><id>MIT</id></license>
      </licenses>
      <hashes>
        <hash alg="SHA-256">05dc223ec1875dfd80d8c5873f8c29f036f98587f2fe2d02abc7c718bfb4b8bf</hash>
      </hashes>
    </component>
    <component type="library" bom-ref="pkg:npm/example-metrics@4.0.0">
      <name>example-metrics</name>
      <version>4.0.0</version>
      <purl>pkg:npm/example-metrics@4.0.0</purl>
      <licenses>
        <license><id>MIT</id></license>
      </licenses>
      <hashes>
        <hash alg="SHA-256">4a8930c617fd12bb99d26e868224d9918e4a3e00f8dd26b876ed19eb6e664f73</hash>
      </hashes>
    </component>
… 153 lines total — download for the full file.

Specifications

Seed
51200
Sample Only
true
Format
CycloneDX
Spec Version
1.4
Serialisation
XML
Components
9
Line Endings
LF

Testing contract

Expected to pass
Scenario
Read a legacy CycloneDX 1.4 XML SBOM with a 1.6-era parser.
Expected result
All 9 components and their dependency refs load without error despite the older namespace URI.

What is a .xml file?

XML (Extensible Markup Language) is a verbose, self-describing markup language using nested tags, attributes, and namespaces to represent structured, hierarchical data. It supports schemas, entities, and validation and underlies many document and data formats. It remains common in enterprise, publishing, and interchange contexts.

How to use this file

Use an example XML file to test parsers, namespace and schema validation, XPath queries, and protection against entity-expansion and external-entity attacks.

How to use this file for testing

“CycloneDX 1.4 Application SBOM (XML)” is a deterministic Novus Examples fixture for Conversion testing, Schema validation. The same content exported across many formats and linked as a group, so you can convert one and diff against the expected twin.

Documented properties for this file: seed 51200 · LF · CycloneDX. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.

Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.

SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.

Code examples

import xml.etree.ElementTree as ET

tree = ET.parse("cyclonedx-1.4-application.xml")
root = tree.getroot()
print(root.tag, [c.tag for c in root][:5])

Related files

Generated by generation/supply_chain.py. Free for any use, no attribution required — license.