conda Explicit Environment Lock
A conda explicit lock: an @EXPLICIT marker followed by one fully-resolved URL per fictional package with an md5 fragment, no solver involved, which is exactly what makes it a lockfile. Every package, version, hash and licence is fictional: the tree describes nothing real.
# This file may be used to create an environment using:
# $ conda create --name <env> --file <this file>
# platform: linux-64
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
@EXPLICIT
https://conda.orchard.example/linux-64/example-router-2.1.3-py312_0.conda#b5cb9a6cd060260f048cc1c65610291e
https://conda.orchard.example/linux-64/example-http-core-1.8.0-py312_0.conda#100ee7f503fd8a2194be6dcade138564
https://conda.orchard.example/linux-64/example-metrics-4.0.0-py312_0.conda#01ab170c0b27055c493c8d3c5d989fc0
https://conda.orchard.example/linux-64/example-cache-0.9.2-py312_0.conda#dcafb8bbc5136a688d8a9c305da2c1f8
https://conda.orchard.example/linux-64/example-crypto-shim-1.2.0-py312_0.conda#6fe1b644d0046b1aff9cb68ab5187b06
https://conda.orchard.example/linux-64/example-logger-3.4.1-py312_0.conda#722e22bff5fe892a503cad9e72434139
https://conda.orchard.example/linux-64/example-retry-1.0.4-py312_0.conda#28cce700a5f944715c3dec893013ef72
https://conda.orchard.example/linux-64/example-json-path-2.0.5-py312_0.conda#08b596a659369a62fa0cc01f5830e82a
https://conda.orchard.example/linux-64/example-yaml-lite-1.1.7-py312_0.conda#7005c484193f2c1cea4ebf4083092a39
Specifications
- Seed
- 51200
- Sample Only
- true
- Ecosystem
- conda
- Mode
- @EXPLICIT
- Packages
- 9
- Checksum
- md5 fragment
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Read a conda explicit lock and extract package coordinates from URLs.
- Expected result
- Nine URLs parse into name, version, build string and md5, and the @EXPLICIT marker is recognised rather than treated as a package line.
What is a .txt file?
TXT is a plain-text file containing unformatted character data with no styling or structure beyond line breaks. Its interpretation depends on character encoding, most commonly UTF-8, and on line-ending convention. It is the most universal and portable text container.
How to use this file
Use an example TXT to test encoding detection, line-ending (LF versus CRLF) handling, and any tool that reads or streams raw text input.
How to use this file for testing
“conda Explicit Environment Lock” is a deterministic Testaroo fixture for Config parsing, Conversion testing. TOML and INI configuration files with nested sections and typed values, for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such, expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented, never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Generated by generation/supply_chain.py. Free for any use, no attribution required, license.
Related files
- lockCargo.lock (version 3, Legacy)The same fictional Rust tree pinned by a version 3 Cargo.lock, for testing that a reader keys on the declared version rather than assuming the newest format. Every package, version, hash and licence is fictional: the tree describes nothing real.
- lockCargo.lock (version 4)A Rust Cargo.lock in the version 4 format: TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional: the tree describes nothing real.
- txtRelease SHA256SUMS ManifestThe oldest supply-chain artifact there is: a sha256sum manifest with the exact two-space separator the tool emits, listing a fictional release tarball and its nine dependency archives. Every package, version, hash and licence is fictional: the tree describes nothing real.
- spdxSPDX 2.2 Legacy SBOM (Tag-Value)The same fictional tree as an SPDX 2.2 tag-value document (the version still produced by older toolchains) for upgrade and compatibility tests against the 2.3 twin in this family. Every package, version, hash and licence is fictional: the tree describes nothing real.
- spdxSPDX 2.3 Application SBOM (Tag-Value)The same SPDX 2.3 SBOM in the specification's plain-text tag-value form: the serialisation many licence-compliance tools still read first, and the exact twin of the JSON document in this family. Every package, version, hash and licence is fictional: the tree describes nothing real.
- yamlSPDX 2.3 Application SBOM (YAML)The SPDX 2.3 SBOM in its YAML serialisation: the third form the specification defines alongside JSON and tag-value, and the one most often hand-edited in a repository. Every package, version, hash and licence is fictional: the tree describes nothing real.
