SPDX 2.3 SBOM With Snippet Ranges
An SPDX 2.3 JSON SBOM that uses the snippet section to attribute a fictional vendored fragment inside a file to a different licence, with both byte-offset and line-number ranges. Every package, version, hash and licence is fictional — the tree describes nothing real.
{
"spdxVersion": "SPDX-2.3",
"dataLicense": "CC0-1.0",
"SPDXID": "SPDXRef-DOCUMENT",
"name": "orchard-gateway-4.2.0",
"documentNamespace": "https://sbom.orchard.example/spdx/9811ac3c-6be1-42b1-ac48-de93651066b3",
"creationInfo": {
"created": "2026-01-01T00:00:00Z",
"creators": [
"Organization: Example Softworks (fictional)",
"Tool: novus-sbom-fixture-1.0.0"
],
"licenseListVersion": "3.22",
"comment": "SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented."
},
"packages": [
{
"SPDXID": "SPDXRef-Package-orchard-example-gateway",
"name": "@orchard-example/gateway",
"versionInfo": "4.2.0",
"downloadLocation": "https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz",
"filesAnalyzed": false,
"supplier": "Organization: Example Softworks (fictional)",
"licenseConcluded": "Apache-2.0",
"licenseDeclared": "Apache-2.0",
"copyrightText": "NOASSERTION",
"checksums": [
{
"algorithm": "SHA256",
"checksumValue": "cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f"
}
],
"externalRefs": [
{
"referenceCategory": "PACKAGE-MANAGER",
"referenceType": "purl",
"referenceLocator": "pkg:npm/%40orchard-example/gateway@4.2.0"
}
]
},
{
"SPDXID": "SPDXRef-Package-orchard-example-router",
"name": "@orchard-example/router",
"versionInfo": "2.1.3",
"downloadLocation": "https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz",
"filesAnalyzed": false,
"supplier": "Organization: Example Softworks (fictional)",
"licenseConcluded": "Apache-2.0",
"licenseDeclared": "Apache-2.0",
"copyrightText": "NOASSERTION",Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- SPDX
- Spec Version
- 2.3
- Snippets
- 1
- Range Types
- byte + line
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Read SPDX snippet ranges and their per-snippet licence conclusions.
- Expected result
- The snippet resolves to MIT inside an Apache-2.0 file and both the byte range (310-420) and the line range (12-18) are preserved.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“SPDX 2.3 SBOM With Snippet Ranges” is a deterministic Novus Examples fixture for JSON parsing, Schema validation, Metadata testing. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.
Documented properties for this file: seed 51200 · LF · SPDX. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import json
with open("spdx-2.3-snippets.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonBuild Metadata Manifest (JSON)The plain build record a CI job writes next to its artifacts — source ref and commit, builder identity, timings, toolchain versions and output digests — from which a provenance statement can be generated. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonJSON-LD @graph with @id cross-referencesA single @graph holding four nodes wired together by @id rather than by nesting - the shape most CMS plugins emit - including a SearchAction, a breadcrumb whose last item has no URL, and one reference to a product node that lives on another page. For testing graph flattening and reference resolution.
- jsonJSON-LD Event with offers and a locationA valid Event record for a hybrid event: both a physical Place with a postal address and geo coordinates and a VirtualLocation, plus a free Offer and a capacity. For testing array-valued properties and event date/timezone handling.
- jsonJSON-LD LocalBusiness with opening hoursA valid LocalBusiness (as a SportingGoodsStore subtype) with a postal address, geo coordinates, weekday and Saturday opening hours, and a 00:00-00:00 specification marking a holiday closure. For testing opening-hours parsing and the closed-all-day convention.
- jsonJSON-LD missing required properties (deliberately invalid)A deliberately invalid Product record: no name, an Offer with a currency but no price, a brand with no @type, a Review with no rating, an AggregateRating with no ratingValue, and an availability given as a bare token instead of a schema.org URL. Valid JSON throughout, so the failure is semantic.
- jsonJSON-LD NewsArticle with author and publisherA valid NewsArticle with two authors, a publisher whose logo carries explicit pixel dimensions, three images at the aspect ratios news results expect, and both publication and modification timestamps. For testing article extraction and date normalisation.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.