Trivy Container Image Scan Report (JSON)
A Trivy-shaped image report with three result blocks — OS packages, language packages and a Dockerfile misconfiguration — so a parser must handle a Results array whose members have different keys. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
{
"SchemaVersion": 2,
"CreatedAt": "2026-01-01T00:00:00Z",
"ArtifactName": "registry.orchard.example/orchard/gateway:4.2.0",
"ArtifactType": "container_image",
"Metadata": {
"OS": {
"Family": "example-linux",
"Name": "3.20"
},
"ImageID": "sha256:d09edb133f6122a6ada56f6e62db4a1d0a2fa4faef6aa8948b1aad1c9b49eb76",
"DiffIDs": [
"sha256:bd0e7eed492c370c64bbe5350623680eb433f858980a225d4ab53fc345a6f143",
"sha256:b644115ef371067688ed39896d1a798e5a7bf3a09ca10c0d94a3f6a9b4c1aae7"
],
"RepoTags": [
"registry.orchard.example/orchard/gateway:4.2.0"
]
},
"Results": [
{
"Target": "registry.orchard.example/orchard/gateway:4.2.0 (example-linux 3.20)",
"Class": "os-pkgs",
"Type": "example-linux",
"Vulnerabilities": [
{
"VulnerabilityID": "NOVUS-SAMPLE-2026-0001",
"PkgName": "example-logger",
"PkgIdentifier": {
"PURL": "pkg:npm/example-logger@3.4.1"
},
"InstalledVersion": "3.4.1",
"FixedVersion": "3.5.0",
"Status": "fixed",
"SeveritySource": "novus-sample",
"PrimaryURL": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0001",
"Title": "SAMPLE advisory: fabricated improper-input-validation issue in a fictional logging library.",
"Description": "SAMPLE advisory: fabricated improper-input-validation issue in a fictional logging library. Published only as a test fixture.",
"Severity": "HIGH",
"CweIDs": [
"CWE-20"
],
"VendorSeverity": {
"novus-sample": 3
},
"CVSS": {
"novus-sample": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 8.1
}Specifications
- Seed
- 51200
- Sample Only
- true
- Scanner
- Trivy-shaped
- Schema Version
- 2
- Results
- 3
- Classes
- os-pkgs, lang-pkgs, config
- Findings
- 4
- Misconfigurations
- 1
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Parse a multi-target scan report where some results carry Vulnerabilities and others carry Misconfigurations.
- Expected result
- Reader totals 4 vulnerabilities across two targets plus 1 misconfiguration, and does not crash on the result block that has no Vulnerabilities key.
What is a .json file?
JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.
How to use this file
Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.
How to use this file for testing
“Trivy Container Image Scan Report (JSON)” is a deterministic Novus Examples fixture for JSON parsing, Schema validation, Error handling. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.
Code examples
import json
with open("trivy-image-report.json") as f:
data = json.load(f)
print(type(data), len(data))Related files
- jsonOSV Record With Schema Violations — Intentionally InvalidAn intentionally invalid OSV record: the JSON parses, but the required id is missing, modified is not an RFC 3339 timestamp, the SEMVER range has a fixed event with no introduced event, and severity.score is a number where the schema demands a CVSS vector string. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
- jsonCycloneDX 1.6 Minimal SBOM (One Component)The smallest CycloneDX document that is still valid: required metadata, one fictional component, and no dependencies array — for testing that a reader handles an SBOM with nothing optional present. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonCycloneDX SBOM With Schema Violations — Intentionally InvalidAn intentionally invalid CycloneDX SBOM: the JSON parses, but bomFormat is missing, one component has no name, and a dependency references a bom-ref that no component declares. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonnpm Lockfile With Integrity Mismatch — Intentionally InvalidAn intentionally invalid npm lockfile: two fictional packages carry sha512 integrity strings that cannot match their resolved tarballs — one derived from the wrong version, one a padded placeholder. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonRekor Transparency-Log EntryA transparency-log entry keyed by its own UUID at the top level — a shape that breaks parsers expecting a fixed root key — with a base64 body that decodes to a dsse record. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
- jsonCSAF 2.0 VEX DocumentA CSAF 2.0 VEX advisory with the nested product tree that CSAF requires — vendor, product name, product version — and product_status buckets rather than a per-statement status field. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.