SBOM Component Inventory (CSV)
The same fictional component tree flattened to a spreadsheet-friendly CSV — name, version, licence, depth, purl and a SHA-256 prefix — for testing the export path SBOM tools offer alongside JSON. Every package, version, hash and licence is fictional — the tree describes nothing real.
name,version,license,depth,purl,sha256_prefix
@orchard-example/gateway,4.2.0,Apache-2.0,root,pkg:npm/%40orchard-example/gateway@4.2.0,cde01f0c8ff9d62e
@orchard-example/router,2.1.3,Apache-2.0,direct,pkg:npm/%40orchard-example/router@2.1.3,d17f0a5171a018c4
@orchard-example/http-core,1.8.0,MIT,direct,pkg:npm/%40orchard-example/http-core@1.8.0,05dc223ec1875dfd
example-metrics,4.0.0,MIT,direct,pkg:npm/example-metrics@4.0.0,4a8930c617fd12bb
example-cache,0.9.2,BSD-3-Clause,direct,pkg:npm/example-cache@0.9.2,f7af2ad2d3c3daaa
example-crypto-shim,1.2.0,MIT,direct,pkg:npm/example-crypto-shim@1.2.0,25b4571f3faedb8d
example-logger,3.4.1,MIT,transitive,pkg:npm/example-logger@3.4.1,7fb72ea58987e532
example-retry,1.0.4,ISC,transitive,pkg:npm/example-retry@1.0.4,4f2a78f8fb4883a2
example-json-path,2.0.5,MIT,transitive,pkg:npm/example-json-path@2.0.5,74e30e4812a0cc92
example-yaml-lite,1.1.7,Apache-2.0,transitive,pkg:npm/example-yaml-lite@1.1.7,d7094de3c8e15621
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- CSV
- Columns
- 6
- Rows
- 10
- Delimiter
- ,
- Line Endings
- LF (documented, not RFC 4180 CRLF)
Testing contract
Expected to pass- Scenario
- Import an SBOM component inventory into a spreadsheet or licence review sheet.
- Expected result
- Ten rows load with one root, five direct dependencies and four transitive ones, matching the depth column against the JSON SBOM's graph.
What is a .csv file?
CSV (Comma-Separated Values) is a plain-text tabular format where rows are lines and fields are separated by commas, with quoting rules for values that contain delimiters, quotes, or newlines. It has no formal type system and depends on encoding and dialect conventions. It is the most portable format for tabular data exchange.
How to use this file
Use an example CSV to test parsers against quoting and embedded-delimiter edge cases, header handling, encoding detection, and import pipelines into databases or spreadsheets.
How to use this file for testing
“SBOM Component Inventory (CSV)” is a deterministic Novus Examples fixture for CSV parsing, Data import, Conversion testing. Clean and deliberately messy CSVs — quoted commas, embedded newlines, ragged rows, odd delimiters, and encodings.
Documented properties for this file: seed 51200 · 10 rows · 6 columns · LF (documented, not RFC 4180 CRLF). Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import pandas as pd
df = pd.read_csv("sbom-component-inventory.csv")
print(df.head())
print(df.dtypes)Related files
- csvLockfile Pin Summary (CSV)Declared range against resolved version for every fictional package pinned by the lockfiles in this category — the table a review needs to see which pins drifted from their manifest ranges. Every package, version, hash and licence is fictional — the tree describes nothing real.
- csvVulnerability Summary (CSV)The four SAMPLE advisories flattened to one row each — the export a security review circulates, and the reference answer for any converter run against the Trivy, Grype or OSV reports here. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- csvCoverage — Per-File Table (CSV)The same coverage as a flat table with a TOTAL row, for spreadsheets, trend charts and diffing two runs without an XML parser. The TOTAL row is the arithmetic sum of the four file rows, so it doubles as a checksum on any tool that regenerates it. Every file in this group describes the same four-file source tree and reports 127/140 lines, 17/24 branch outcomes and 18/20 functions, so a converter can be diffed against a known answer.
- csvTest Case Matrix — Twelve Documented Cases (CSV)Twelve test cases with level, priority, the requirement each covers, preconditions, steps and expected result — the table a test-management import expects. Eleven of the twelve are automated, and the requirement column joins this file to the traceability matrix next to it.
- graphmlDependency Graph (GraphML)The dependency graph in GraphML, with typed attribute keys for node version, licence and depth and for edge range — the interchange format graph databases and analysis tools import. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonlOSV Vulnerability Records (JSON Lines)All four SAMPLE advisories as newline-delimited OSV records — the bulk shape an advisory database is loaded from, where each line must parse independently. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.