SPDX 2.3 Minimal SBOM (Tag-Value)
An SPDX 2.3 tag-value document with only the mandatory document header and a single fictional package — no relationships, no files — for testing that a parser accepts a document with every optional block absent. Every package, version, hash and licence is fictional — the tree describes nothing real.
##### SPDX tag-value document — SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: orchard-gateway-4.2.0
DocumentNamespace: https://sbom.orchard.example/spdx/6362629a-9610-44b1-ae95-f5dc11a51b30
Creator: Organization: Example Softworks (fictional)
Creator: Tool: novus-sbom-fixture-1.0.0
Created: 2026-01-01T00:00:00Z
CreatorComment: <text>Fictional component tree. No package named here exists.</text>
##### Package: @orchard-example/gateway
PackageName: @orchard-example/gateway
SPDXID: SPDXRef-Package-orchard-example-gateway
PackageVersion: 4.2.0
PackageSupplier: Organization: Example Softworks (fictional)
PackageDownloadLocation: https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz
FilesAnalyzed: false
PackageChecksum: SHA256: cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f
PackageLicenseConcluded: Apache-2.0
PackageLicenseDeclared: Apache-2.0
PackageCopyrightText: NOASSERTION
ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/gateway@4.2.0
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- SPDX
- Spec Version
- 2.3
- Packages
- 1
- Relationships
- 0
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Load an SPDX tag-value document that omits the relationships section.
- Expected result
- Parser returns one package and an empty relationship list instead of failing on the missing block.
What is a .spdx file?
An .spdx file is an SPDX software bill of materials written in the specification's tag-value serialisation: plain-text `Tag: value` lines grouped into a document-creation block, one block per package, and optional file and relationship blocks. It records the document namespace and licence, package names, versions, suppliers, download locations, verification codes, declared and concluded licences, and the relationships that connect packages to each other.
How to use this file
Use an example .spdx file to test SBOM parsers, licence-compliance scanners, and converters to and from the SPDX JSON and CycloneDX serialisations, checking that relationships and licence expressions survive the round trip.
How to use this file for testing
“SPDX 2.3 Minimal SBOM (Tag-Value)” is a deterministic Novus Examples fixture for Config parsing, Schema validation, Error handling. TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF · SPDX. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Related files
- ymlAzure Pipelines, Intentionally InvalidAn intentionally invalid Azure Pipelines file: valid YAML that mixes top-level steps with a stages block, depends on an undeclared stage, and gives `pool` a bare string. For testing that a validator rejects it and reports all three faults.
- ymlCircleCI Config, Intentionally InvalidAn intentionally invalid CircleCI config: an unquoted `version: 2.10` that YAML loads as the float 2.1, a workflow referencing an undefined job, and a job with no execution environment. For testing that a validator rejects it and explains each fault.
- cwlCWL Workflow, Intentionally InvalidAn intentionally invalid CWL document: a nonexistent cwlVersion, an unknown class, a step consuming an output no step produces, and outputs given as a bare string. Four documented faults for a CWL validator to report.
- yamlDocker Compose File, Intentionally InvalidAn intentionally invalid Compose file: services as a list, a service with both image and an empty build, an unquoted 8080:8080 port that YAML 1.1 reads as a base-60 integer, and a depends_on naming an undefined service.
- ymlGitHub Actions Workflow, Intentionally InvalidAn intentionally invalid GitHub Actions workflow: well-formed YAML that breaks the workflow schema in four documented ways — no jobs mapping, a scalar `on`, a mapping `runs-on`, and a step carrying both uses and run. For testing that a validator rejects, and reports why.
- ymlGitLab CI Config, Intentionally InvalidAn intentionally invalid GitLab CI config: valid YAML with a misspelled `stagess` key, a job naming an undeclared stage, a job with no script, and an `only:` given a bare scalar. For testing that a linter rejects it and names each fault.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.