Skip to content
Novus Examples
xml6 KB

CycloneDX 1.6 Application SBOM (XML)

The same fictional CycloneDX 1.6 SBOM serialised as XML against the cyclonedx.org/schema/bom/1.6 namespace — the JSON twin of this file carries identical components and edges, so a converter can be diffed exactly. Every package, version, hash and licence is fictional — the tree describes nothing real.

Conversion testingSchema validationEditor testing
Preview — first 50 linesxml
<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.6" serialNumber="urn:uuid:2bae4ff9-6a91-404d-a46c-839ce60bc29a" version="1">
  <metadata>
    <timestamp>2026-01-01T00:00:00Z</timestamp>
    <authors>
      <author><name>Orchard SBOM Team (fictional)</name><email>sbom@orchard.example</email></author>
    </authors>
    <component type="application" bom-ref="pkg:npm/%40orchard-example/gateway@4.2.0">
      <name>@orchard-example/gateway</name>
      <version>4.2.0</version>
      <purl>pkg:npm/%40orchard-example/gateway@4.2.0</purl>
    </component>
    <properties>
      <property name="novus:sample">SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.</property>
    </properties>
  </metadata>
  <components>
    <component type="library" bom-ref="pkg:npm/%40orchard-example/router@2.1.3">
      <name>@orchard-example/router</name>
      <version>2.1.3</version>
      <purl>pkg:npm/%40orchard-example/router@2.1.3</purl>
      <licenses>
        <license><id>Apache-2.0</id></license>
      </licenses>
      <hashes>
        <hash alg="SHA-256">d17f0a5171a018c41cdaaa2701b6c32bf49f7404032fa45e5721e2b794cd2e51</hash>
      </hashes>
    </component>
    <component type="library" bom-ref="pkg:npm/%40orchard-example/http-core@1.8.0">
      <name>@orchard-example/http-core</name>
      <version>1.8.0</version>
      <purl>pkg:npm/%40orchard-example/http-core@1.8.0</purl>
      <licenses>
        <license><id>MIT</id></license>
      </licenses>
      <hashes>
        <hash alg="SHA-256">05dc223ec1875dfd80d8c5873f8c29f036f98587f2fe2d02abc7c718bfb4b8bf</hash>
      </hashes>
    </component>
    <component type="library" bom-ref="pkg:npm/example-metrics@4.0.0">
      <name>example-metrics</name>
      <version>4.0.0</version>
      <purl>pkg:npm/example-metrics@4.0.0</purl>
      <licenses>
        <license><id>MIT</id></license>
      </licenses>
      <hashes>
        <hash alg="SHA-256">4a8930c617fd12bb99d26e868224d9918e4a3e00f8dd26b876ed19eb6e664f73</hash>
      </hashes>
    </component>
… 153 lines total — download for the full file.

Specifications

Seed
51200
Sample Only
true
Format
CycloneDX
Spec Version
1.6
Serialisation
XML
Components
9
Line Endings
LF

Testing contract

Reference control
Scenario
Convert a CycloneDX XML SBOM to JSON, or validate it against the 1.6 schema.
Expected result
Output matches the JSON twin component-for-component: same 9 purls, same SHA-256 values, same 10 dependency refs.

What is a .xml file?

XML (Extensible Markup Language) is a verbose, self-describing markup language using nested tags, attributes, and namespaces to represent structured, hierarchical data. It supports schemas, entities, and validation and underlies many document and data formats. It remains common in enterprise, publishing, and interchange contexts.

How to use this file

Use an example XML file to test parsers, namespace and schema validation, XPath queries, and protection against entity-expansion and external-entity attacks.

How to use this file for testing

“CycloneDX 1.6 Application SBOM (XML)” is a deterministic Novus Examples fixture for Conversion testing, Schema validation, Editor testing. The same content exported across many formats and linked as a group, so you can convert one and diff against the expected twin.

Documented properties for this file: seed 51200 · LF · CycloneDX. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.

Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.

SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.

Code examples

import xml.etree.ElementTree as ET

tree = ET.parse("cyclonedx-1.6-application.xml")
root = tree.getroot()
print(root.tag, [c.tag for c in root][:5])

Related files

Generated by generation/supply_chain.py. Free for any use, no attribution required — license.