SPDX Tag-Value SBOM, Truncated — Intentionally Corrupt
An intentionally corrupt SPDX tag-value document, cut off part-way through a tag name so the final line has no colon or value. Kept small on purpose. Every package, version, hash and licence is fictional — the tree describes nothing real.
##### SPDX tag-value document — SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: orchard-gateway-4.2.0
DocumentNamespace: https://sbom.orchard.example/spdx/606ea3ac-261b-482c-a69b-0eb119b287ad
Creator: Organization: Example Softworks (fictional)
Creator: Tool: novus-sbom-fixture-1.0.0
Created: 2026-01-01T00:00:00Z
CreatorComment: <text>Fictional component tree. No package named here exists.</text>
##### Package: @orchard-example/gateway
PackageName: @orchard-example/gateway
SPDXID: SPDXRef-Package-orchard-example-gateway
PackageVersion: 4.2.0
PackageSupplier: Organization: Example Softworks (fictional)
PackageDownloadLocation: https://registry.orchard.example/@orchard-example/gateway/-/gateway-4.2.0.tgz
FilesAnalyzed: false
PackageChecksum: SHA256: cde01f0c8ff9d62ef958a3de288a2f1084db14bd47e1e10ff39a52412cca613f
PackageLicenseConcluded: Apache-2.0
PackageLicenseDeclared: Apache-2.0
PackageCopyrightText: NOASSERTION
ExternalRef: PACKAGE-MANAGER purl pkg:npm/%40orchard-example/gateway@4.2.0
##### Package: @orchard-example/router
PackageName: @orchard-example/router
SPDXID: SPDXRef-Package-orchard-example-router
PackageVersion: 2.1.3
PackageSupplier: Organization: Example Softworks (fictional)
PackageDownloadLocation: https://registry.orchard.example/@orchard-example/router/-/router-2.1.3.tgz
PackageLicenseConclude
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- SPDX
- Spec Version
- 2.3
- Damage
- truncated mid-tag
- Intentionally Corrupt
- true
- Line Endings
- LF
Testing contract
Expected to fail- Scenario
- Parse an SPDX tag-value file whose last line is an incomplete tag.
- Expected result
- Parser reports a malformed-tag error naming the final line and does not treat the partial package as complete.
What is a .spdx file?
An .spdx file is an SPDX software bill of materials written in the specification's tag-value serialisation: plain-text `Tag: value` lines grouped into a document-creation block, one block per package, and optional file and relationship blocks. It records the document namespace and licence, package names, versions, suppliers, download locations, verification codes, declared and concluded licences, and the relationships that connect packages to each other.
How to use this file
Use an example .spdx file to test SBOM parsers, licence-compliance scanners, and converters to and from the SPDX JSON and CycloneDX serialisations, checking that relationships and licence expressions survive the round trip.
How to use this file for testing
“SPDX Tag-Value SBOM, Truncated — Intentionally Corrupt” is a deterministic Novus Examples fixture for Error handling, Config parsing. Deliberately corrupt and invalid files, clearly labelled, for testing how your tool fails.
Documented properties for this file: seed 51200 · damage: truncated mid-tag · LF · intentionally corrupt. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Related files
- spdxSPDX 2.3 Minimal SBOM (Tag-Value)An SPDX 2.3 tag-value document with only the mandatory document header and a single fictional package — no relationships, no files — for testing that a parser accepts a document with every optional block absent. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockCargo.lock, Truncated — Intentionally CorruptAn intentionally corrupt Cargo.lock: a valid version 4 lockfile cut off inside a [[package]] table so the final key/value pair is incomplete. Small on purpose. Every package, version, hash and licence is fictional — the tree describes nothing real.
- txtDetached Signature, ASCII Armor — SAMPLE ShapeAn ASCII-armored detached signature block of the shape that accompanies a SHA256SUMS file. It is a SAMPLE placeholder, not a valid OpenPGP signature — armor detectors will find it, verifiers must reject it. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
- lockGemfile.lock (Bundler)A Bundler lockfile in its indentation-significant block format — specs nested under GEM, transitive requirements nested one level deeper, and the BUNDLED WITH version on its own indented line. Every package, version, hash and licence is fictional — the tree describes nothing real.
- txtgo.sum Checksum Lines (as .txt)go.sum content: two h1: lines per fictional module — one for the module zip and one for its go.mod — which is the pairing a verifier must require. Served as .txt because go.sum has no registered media type. Every package, version, hash and licence is fictional — the tree describes nothing real.
- lockmix.lock (Elixir)An Elixir mix.lock: a literal Elixir map whose values are tuples of atoms, strings and lists. It is neither JSON nor TOML, so a generic lockfile reader has to special-case it. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.