Skip to content
Novus Examples
json6.4 KB

Trivy Filesystem Scan Report (JSON)

A Trivy-shaped filesystem scan report with four SAMPLE findings against a fictional npm lockfile, one per severity band, each with a CVSS v3.1 vector, CWE class and fixed version. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

JSON parsingSchema validationConversion testing
Preview — first 50 linesjson
{
  "SchemaVersion": 2,
  "CreatedAt": "2026-01-01T00:00:00Z",
  "ArtifactName": ".",
  "ArtifactType": "filesystem",
  "Metadata": {
    "ImageConfig": {}
  },
  "Results": [
    {
      "Target": "package-lock.json",
      "Class": "lang-pkgs",
      "Type": "npm",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "NOVUS-SAMPLE-2026-0001",
          "PkgName": "example-logger",
          "PkgIdentifier": {
            "PURL": "pkg:npm/example-logger@3.4.1"
          },
          "InstalledVersion": "3.4.1",
          "FixedVersion": "3.5.0",
          "Status": "fixed",
          "SeveritySource": "novus-sample",
          "PrimaryURL": "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0001",
          "Title": "SAMPLE advisory: fabricated improper-input-validation issue in a fictional logging library.",
          "Description": "SAMPLE advisory: fabricated improper-input-validation issue in a fictional logging library. Published only as a test fixture.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-20"
          ],
          "VendorSeverity": {
            "novus-sample": 3
          },
          "CVSS": {
            "novus-sample": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "V3Score": 8.1
            }
          },
          "References": [
            "https://advisories.orchard.example/NOVUS-SAMPLE-2026-0001",
            "https://git.orchard.example/logger/releases/3.5.0"
          ],
          "PublishedDate": "2026-01-05T00:00:00Z",
          "LastModifiedDate": "2026-01-10T00:00:00Z",
          "DataSource": {
            "ID": "novus-sample",
            "Name": "Novus SAMPLE advisory feed",
            "URL": "https://advisories.orchard.example"
… 172 lines total — download for the full file.

Specifications

Seed
51200
Sample Only
true
Scanner
Trivy-shaped
Schema Version
2
Results
1
Findings
4
Severities
CRITICAL, HIGH, MEDIUM, LOW
Line Endings
LF

Testing contract

Expected to pass
Scenario
Ingest a Trivy JSON report into a dashboard or a CI severity gate.
Expected result
Reader finds exactly one CRITICAL, one HIGH, one MEDIUM and one LOW finding, each carrying a FixedVersion so an auto-upgrade path can be computed.

What is a .json file?

JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.

How to use this file

Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.

How to use this file for testing

“Trivy Filesystem Scan Report (JSON)” is a deterministic Novus Examples fixture for JSON parsing, Schema validation, Conversion testing. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.

Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.

Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.

SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.

Feed the file to your parser and assert it handles the documented quirks — quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.

Code examples

import json

with open("trivy-filesystem-report.json") as f:
    data = json.load(f)
print(type(data), len(data))

Related files

Generated by generation/supply_chain.py. Free for any use, no attribution required — license.