Vulnerability Suppression Policy (YAML)
A suppression policy that gives every waiver an owner, a reason and an expiry date — the fields that stop a suppression file becoming a permanent blindfold. All four entries are SAMPLE. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
# Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
version: 1
policy: sample-suppressions
expiresAfterDays: 90
suppressions:
- id: NOVUS-SAMPLE-2026-0001
package: example-logger
version: 3.4.1
reason: triage-in-progress
approvedBy: sample-security-team@orchard.example
expires: 2026-04-01
note: "SAMPLE suppression. Upgrade path is 3.5.0."
- id: NOVUS-SAMPLE-2026-0002
package: example-cache
version: 0.9.2
reason: not-reachable
approvedBy: sample-security-team@orchard.example
expires: 2026-04-01
note: "SAMPLE suppression. Upgrade path is 0.9.5."
- id: NOVUS-SAMPLE-2026-0003
package: example-yaml-lite
version: 1.1.7
reason: fixed-in-next-release
approvedBy: sample-security-team@orchard.example
expires: 2026-04-01
note: "SAMPLE suppression. Upgrade path is 1.2.0."
- id: NOVUS-SAMPLE-2026-0004
package: example-json-path
version: 2.0.5
reason: accepted-risk
approvedBy: sample-security-team@orchard.example
expires: 2026-04-01
note: "SAMPLE suppression. Upgrade path is 2.1.0."
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- YAML
- Suppressions
- 4
- Expiry Policy Days
- 90
- Requires Approver
- true
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Enforce that no suppression is open-ended.
- Expected result
- Policy checker accepts all four entries today and flags every one of them as expired when evaluated after 2026-04-01.
What is a .yaml file?
YAML (YAML Ain't Markup Language) is a human-readable data-serialization format using indentation, key-value pairs, and lists, and is a superset of JSON. It supports comments, anchors, and multiple documents per file, favoring readability for configuration. Its indentation sensitivity makes it error-prone to hand-edit.
How to use this file
Use an example YAML file to test config parsers, indentation and anchor handling, multi-document streams, and safe-loading to avoid arbitrary object construction.
How to use this file for testing
“Vulnerability Suppression Policy (YAML)” is a deterministic Novus Examples fixture for Config parsing, Config testing, Schema validation. TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF · YAML. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Code examples
import yaml # pip install pyyaml
with open("suppressions.yaml") as f:
data = yaml.safe_load(f)
print(data)Related files
- yamlAttestation Verification Policy (YAML)The policy an admission controller evaluates before an artifact is allowed through: required predicate types, an allowed-builder list, a minimum SLSA level, a transparency-log requirement and one dated exception. Every package, version, hash and licence is fictional — the tree describes nothing real.
- ymlGitHub Actions Over-Permissive Token (Policy Target)A schema-valid workflow that should still be rejected on review: permissions: write-all at the workflow level plus three unused write scopes on the job. Nothing here is an exploit; it is the least-privilege finding a policy engine is supposed to raise.
- lockCargo.lock (version 4)A Rust Cargo.lock in the version 4 format — TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional — the tree describes nothing real.
- jsonin-toto Layout (Supply-Chain Policy)The policy half of in-toto: a layout declaring which steps must run, which keys may sign them, and the MATCH/CREATE/DISALLOW artifact rules that bind each step's products to the next step's materials. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
- txtpip requirements.txt With Pinned HashesA hash-pinned pip requirements file with two sha256 hashes per fictional package (wheel and sdist) and line continuations — the form `--require-hashes` installs demand. Every package, version, hash and licence is fictional — the tree describes nothing real.
- yamlpnpm-lock.yaml (lockfileVersion 9)A pnpm v9 lockfile with its three-section layout — importers for declared specifiers, packages for resolution metadata and snapshots for the resolved edges — pinning the same fictional tree. Every package, version, hash and licence is fictional — the tree describes nothing real.
Generated by generation/supply_chain.py. Free for any use, no attribution required — license.