spdx7.4 KB

SPDX 2.3 SBOM Relationship Graph (Tag-Value)

An SPDX tag-value SBOM emphasising its relationship block: one DESCRIBES edge and ten DEPENDS_ON edges that form the same two diamonds as the CycloneDX graph fixture. Every package, version, hash and licence is fictional — the tree describes nothing real.

Config parsing Graph data Conversion testing

Preview — first 50 linesspdx

##### SPDX tag-value document — SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.

SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: orchard-gateway-4.2.0
DocumentNamespace: https://sbom.orchard.example/spdx/ca79c9ea-c5e4-41c5-ac7c-5244dc722e80
Creator: Organization: Example Softworks (fictional)
Creator: Tool: novus-sbom-fixture-1.0.0
Created: 2026-01-01T00:00:00Z
CreatorComment: <text>Fictional component tree. No package named here exists.</text>

##### Package: @orchard-example/gateway

PackageName: @orchard-example/gateway
SPDXID: SPDXRef-Package-orchard-example-gateway
PackageVersion: 4.2.0
PackageSupplier: Organization: Example Softworks (fictional)
PackageDownloadLocation: https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz
FilesAnalyzed: false
PackageChecksum: SHA256: cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f
PackageLicenseConcluded: Apache-2.0
PackageLicenseDeclared: Apache-2.0
PackageCopyrightText: NOASSERTION
ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/gateway@4.2.0

##### Package: @orchard-example/router

PackageName: @orchard-example/router
SPDXID: SPDXRef-Package-orchard-example-router
PackageVersion: 2.1.3
PackageSupplier: Organization: Example Softworks (fictional)
PackageDownloadLocation: https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz
FilesAnalyzed: false
PackageChecksum: SHA256: d17f0a5171a018c41cdaaa2701b6c32bf49f7404032fa45e5721e2b794cd2e51
PackageLicenseConcluded: Apache-2.0
PackageLicenseDeclared: Apache-2.0
PackageCopyrightText: NOASSERTION
ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/router@2.1.3

##### Package: @orchard-example/http-core

PackageName: @orchard-example/http-core
SPDXID: SPDXRef-Package-orchard-example-http-core
PackageVersion: 1.8.0
PackageSupplier: Organization: Example Softworks (fictional)
PackageDownloadLocation: https://registry.orchard.example/@orchard-example/http-core/-/http-core-1.8.0.tgz
FilesAnalyzed: false
PackageChecksum: SHA256: 05dc223ec1875dfd80d8c5873f8c29f036f98587f2fe2d02abc7c718bfb4b8bf
PackageLicenseConcluded: MIT

… 168 lines total — download for the full file.

Specifications

Seed: 51200
Sample Only: true
Format: SPDX
Spec Version: 2.3
Relationships: 11
Relationship Types: DESCRIBES, DEPENDS_ON
Diamonds: 2
Line Endings: LF

Testing contract

Expected to pass

Scenario: Build a graph from SPDX relationship lines rather than from a nested tree.
Expected result: example-logger is a single node with three DEPENDS_ON edges pointing at it, matching the CycloneDX diamond fixture exactly.

What is a .spdx file?

An .spdx file is an SPDX software bill of materials written in the specification's tag-value serialisation: plain-text `Tag: value` lines grouped into a document-creation block, one block per package, and optional file and relationship blocks. It records the document namespace and licence, package names, versions, suppliers, download locations, verification codes, declared and concluded licences, and the relationships that connect packages to each other.

How to use this file

Use an example .spdx file to test SBOM parsers, licence-compliance scanners, and converters to and from the SPDX JSON and CycloneDX serialisations, checking that relationships and licence expressions survive the round trip.

How to use this file for testing

“SPDX 2.3 SBOM Relationship Graph (Tag-Value)” is a deterministic Novus Examples fixture for Config parsing, Graph data, Conversion testing. TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.

Documented properties for this file: seed 51200 · LF · SPDX. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.

Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.

SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.

Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.