CycloneDX SBOM With Unicode Metadata (Edge Case)
A CycloneDX SBOM whose author names and properties contain accented Latin, CJK, right-to-left Hebrew, emoji and a deliberately long property value — for testing encoding handling and field-width assumptions. Every package, version, hash and licence is fictional — the tree describes nothing real.
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:89503d73-a715-440e-abd4-5cca04f2b200",
"version": 1,
"metadata": {
"timestamp": "2026-01-01T00:00:00Z",
"tools": {
"components": [
{
"type": "application",
"name": "novus-sbom-fixture",
"version": "1.0.0"
}
]
},
"authors": [
{
"name": "Ørchard Ståhl-Bäcker (fictional)",
"email": "sbom@orchard.example"
},
{
"name": "梨園 サンプル (fictional)",
"email": "sample@orchard.example"
}
],
"component": {
"type": "application",
"bom-ref": "pkg:npm/%40orchard-example/gateway@4.2.0",
"name": "@orchard-example/gateway",
"version": "4.2.0",
"purl": "pkg:npm/%40orchard-example/gateway@4.2.0",
"licenses": [
{
"license": {
"id": "Apache-2.0"
}
}
],
"hashes": [
{
"alg": "SHA-256",
"content": "cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f"
}
],
"supplier": {
"name": "Example Softworks (fictional)",
"url": [
"https://sbom.orchard.example/supplier"
]Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- CycloneDX
- Spec Version
- 1.6
- Encoding
- UTF-8 (no BOM)
- Scripts
- Latin, CJK, Hebrew, Emoji
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Render or re-serialise an SBOM containing non-ASCII metadata.
- Expected result
- All author names survive a parse/serialise round trip byte-for-byte as UTF-8, with no mojibake, escaping loss or truncation of the long property value.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“CycloneDX SBOM With Unicode Metadata (Edge Case)” is a deterministic Novus Examples fixture for JSON parsing, Encoding detection, Error handling. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.
Documented properties for this file: seed 51200 · UTF-8 (no BOM) · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import json
with open("cyclonedx-1.6-unicode-metadata.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonCycloneDX SBOM With Schema Violations — Intentionally InvalidAn intentionally invalid CycloneDX SBOM: the JSON parses, but bomFormat is missing, one component has no name, and a dependency references a bom-ref that no component declares. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonCycloneDX SBOM, Truncated — Intentionally CorruptAn intentionally corrupt CycloneDX SBOM: a valid 1.6 document cut off mid-object so the JSON never closes. Small on purpose — it exists to check that a reader fails cleanly instead of half-loading a component list. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonDependency Alerts Feed (JSON)The shape a hosted dependency-alert API returns: alerts with lifecycle state, a nested advisory, a patched-version pointer and an explicitly null dismissed_reason on the alerts that were not dismissed. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonDependency Graph With a Cycle (JSON)A dependency graph containing a genuine three-node cycle between fictional plugins — the fixture that makes a naive recursive walker hang or blow the stack, with the cycle path stated so the expected answer is unambiguous. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonDSSE Envelope With Undecodable Payload — Intentionally CorruptAn intentionally corrupt DSSE envelope: the JSON parses and the signature block looks complete, but the payload is truncated and contains characters outside the base64 alphabet. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
- jsonnpm audit Report (v1, Legacy Shape)The legacy npm audit shape — numeric advisory ids, a separate actions array and dependency paths written with '>' — which tools built for the v2 report silently read as zero findings. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.