Release SHA256SUMS Manifest
The oldest supply-chain artifact there is: a sha256sum manifest with the exact two-space separator the tool emits, listing a fictional release tarball and its nine dependency archives. Every package, version, hash and licence is fictional: the tree describes nothing real.
# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.
06af88e316cf889e0b72645f235f77c900d48972456b1ff6ba4df49ae24be734 orchard-gateway-4.2.0.tgz
d17f0a5171a018c41cdaaa2701b6c32bf49f7404032fa45e5721e2b794cd2e51 router-2.1.3.tgz
05dc223ec1875dfd80d8c5873f8c29f036f98587f2fe2d02abc7c718bfb4b8bf http-core-1.8.0.tgz
4a8930c617fd12bb99d26e868224d9918e4a3e00f8dd26b876ed19eb6e664f73 example-metrics-4.0.0.tgz
f7af2ad2d3c3daaa5991b0eae38ffa151a2e2f3bf0f2bdd7333adc3a1dc860f7 example-cache-0.9.2.tgz
25b4571f3faedb8df3979d9e509e331b6b88503d8d0057e6414e936e084a56cb example-crypto-shim-1.2.0.tgz
7fb72ea58987e5327259b66384f96f5e657c3ce5225b8891c567cac6b58430ec example-logger-3.4.1.tgz
4f2a78f8fb4883a2efd6b73b447f632599790c08e25bb7184f501b5f2b9af33f example-retry-1.0.4.tgz
74e30e4812a0cc92bd7c1a965e6f953f5d92b9eaf3cd77d90663a7344e939b63 example-json-path-2.0.5.tgz
d7094de3c8e15621381e5f9f02c0eecb9977d249a8a06ab2b0a34f5344a039af example-yaml-lite-1.1.7.tgz
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- sha256sum output
- Entries
- 10
- Separator
- two spaces
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Parse sha256sum output, where the separator is two spaces and not a tab.
- Expected result
- Ten entries split into a 64-character hex digest and a filename, and the release tarball's digest matches the provenance statement's subject.
What is a .txt file?
TXT is a plain-text file containing unformatted character data with no styling or structure beyond line breaks. Its interpretation depends on character encoding, most commonly UTF-8, and on line-ending convention. It is the most universal and portable text container.
How to use this file
Use an example TXT to test encoding detection, line-ending (LF versus CRLF) handling, and any tool that reads or streams raw text input.
How to use this file for testing
“Release SHA256SUMS Manifest” is a deterministic Testaroo fixture for Config parsing, Conversion testing, Error handling. TOML and INI configuration files with nested sections and typed values, for testing config parsers and loaders.
Documented properties for this file: seed 51200 · 10 entries · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such, expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented, never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Generated by generation/supply_chain.py. Free for any use, no attribution required, license.
Related files
- lockGemfile.lock (Bundler)A Bundler lockfile in its indentation-significant block format: specs nested under GEM, transitive requirements nested one level deeper, and the BUNDLED WITH version on its own indented line. Every package, version, hash and licence is fictional: the tree describes nothing real.
- txtgo.sum Checksum Lines (as .txt)go.sum content: two h1: lines per fictional module (one for the module zip and one for its go.mod), which is the pairing a verifier must require. Served as .txt because go.sum has no registered media type. Every package, version, hash and licence is fictional: the tree describes nothing real.
- lockmix.lock (Elixir)An Elixir mix.lock: a literal Elixir map whose values are tuples of atoms, strings and lists. It is neither JSON nor TOML, so a generic lockfile reader has to special-case it. Every package, version, hash and licence is fictional: the tree describes nothing real.
- lockyarn.lock (Berry, __metadata version 8)A modern Yarn Berry lockfile: YAML-shaped with an __metadata header, npm: protocol resolutions and cache-key-prefixed checksums, deliberately different from the Classic file in the same family. Every package, version, hash and licence is fictional: the tree describes nothing real.
- txtDetached Signature, ASCII Armor: SAMPLE ShapeAn ASCII-armored detached signature block of the shape that accompanies a SHA256SUMS file. It is a SAMPLE placeholder, not a valid OpenPGP signature: armor detectors will find it, verifiers must reject it. Signatures, key ids and certificates here are SAMPLE placeholders: the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
- lockbun.lock (Text Lockfile)Bun's text lockfile, where each package is a positional array of descriptor, dependency map and integrity string rather than an object: a shape that breaks parsers assuming every lock entry is keyed. Every package, version, hash and licence is fictional: the tree describes nothing real.
