CycloneDX Container Image SBOM
A CycloneDX SBOM whose root component is an OCI container image rather than an application, mixing a fictional operating-system package with language packages — the shape an image scanner emits. Every package, version, hash and licence is fictional — the tree describes nothing real.
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:4774f2b0-0c20-4925-ae08-3f2374534893",
"version": 1,
"metadata": {
"timestamp": "2026-01-01T00:00:00Z",
"tools": {
"components": [
{
"type": "application",
"name": "novus-sbom-fixture",
"version": "1.0.0"
}
]
},
"authors": [
{
"name": "Orchard SBOM Team (fictional)",
"email": "sbom@orchard.example"
}
],
"component": {
"type": "container",
"bom-ref": "pkg:oci/orchard-gateway@sha256%3Ad09edb133f6122a6ada56f6e62db4a1d0a2fa4faef6aa8948b1aad1c9b49eb76",
"name": "registry.orchard.example/orchard/gateway",
"version": "sha256:d09edb133f6122a6ada56f6e62db4a1d0a2fa4faef6aa8948b1aad1c9b49eb76",
"purl": "pkg:oci/orchard-gateway@sha256%3Ad09edb133f6122a6ada56f6e62db4a1d0a2fa4faef6aa8948b1aad1c9b49eb76",
"properties": [
{
"name": "novus:sample",
"value": "SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented."
}
]
},
"properties": [
{
"name": "novus:sample",
"value": "SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented."
}
]
},
"components": [
{
"type": "operating-system",
"bom-ref": "os-sample",
"name": "example-linux",
"version": "3.20"
},
{Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- CycloneDX
- Spec Version
- 1.6
- Root Type
- container
- Os Packages
- 1
- App Packages
- 4
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Distinguish OS-level from language-level components in a container SBOM.
- Expected result
- The root resolves as type container with a pkg:oci purl, one operating-system component and four library components beneath it.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“CycloneDX Container Image SBOM” is a deterministic Novus Examples fixture for JSON parsing, Conversion testing, Metadata testing. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.
Documented properties for this file: seed 51200 · LF · CycloneDX. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import json
with open("cyclonedx-1.6-container-image.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonAttestation With a Full SPDX PredicateAn in-toto statement whose predicate is an entire SPDX 2.3 document — the nesting that makes attestation payloads large and that a size-limited verifier has to cope with. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonBuild Metadata Manifest (JSON)The plain build record a CI job writes next to its artifacts — source ref and commit, builder identity, timings, toolchain versions and output digests — from which a provenance statement can be generated. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockbun.lock (Text Lockfile)Bun's text lockfile, where each package is a positional array of descriptor, dependency map and integrity string rather than an object — a shape that breaks parsers assuming every lock entry is keyed. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsoncargo-audit Report (JSON)A cargo-audit report that shows three findings while a fourth is on the ignore list, plus an unmaintained-crate warning — so a gate must decide whether warnings count against it. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- lockcomposer.lock (PHP)A PHP composer.lock in JSON, pinning each fictional package by both a git reference and a dist zip shasum, with a content-hash binding it to composer.json. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonCSAF 2.0 VEX DocumentA CSAF 2.0 VEX advisory with the nested product tree that CSAF requires — vendor, product name, product version — and product_status buckets rather than a per-statement status field. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.