Skip to content
Testaroo
json1.2 KB

Reproducible Build Comparison Report

Two independent builds of the same fictional artifact on different architectures, both producing one digest: the evidence a rebuilder publishes, with SOURCE_DATE_EPOCH recorded as the thing that made it possible. Every package, version, hash and licence is fictional: the tree describes nothing real.

JSON parsingVisual diff / regressionSchema validation
Preview, first 37 linesjson
{
  "schema": "novus-sample/reproducible-build/1",
  "artifact": {
    "name": "orchard-gateway-4.2.0.tgz",
    "sha256": "06af88e316cf889e0b72645f235f77c900d48972456b1ff6ba4df49ae24be734"
  },
  "builds": [
    {
      "builder": "https://build.orchard.example/builders/hosted/v1",
      "runId": "8814",
      "startedOn": "2026-01-01T00:00:00Z",
      "sha256": "06af88e316cf889e0b72645f235f77c900d48972456b1ff6ba4df49ae24be734",
      "environment": {
        "os": "example-linux 3.20",
        "arch": "x86_64",
        "tz": "UTC",
        "sourceDateEpoch": 1767225600
      }
    },
    {
      "builder": "https://build.orchard.example/builders/rebuilder/v1",
      "runId": "8815",
      "startedOn": "2026-01-02T00:00:00Z",
      "sha256": "06af88e316cf889e0b72645f235f77c900d48972456b1ff6ba4df49ae24be734",
      "environment": {
        "os": "example-linux 3.20",
        "arch": "aarch64",
        "tz": "UTC",
        "sourceDateEpoch": 1767225600
      }
    }
  ],
  "reproducible": true,
  "differences": [],
  "novus_sample_note": "SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented."
}

Specifications

Seed
51200
Sample Only
true
Builds
2
Reproducible
true
Differences
0
Source Date Epoch
1767225600
Line Endings
LF

Testing contract

Expected to pass
Scenario
Compare independent rebuild results and decide whether a build is reproducible.
Expected result
Both build records carry the same sha256, the differences array is empty, and flipping either digest must make reproducible evaluate false.

What is a .json file?

JSON (JavaScript Object Notation) is a lightweight, text-based data-interchange format representing objects, arrays, strings, numbers, booleans, and null. It is language-independent, human-readable, and the dominant format for web APIs and configuration. It requires a single well-formed root value.

How to use this file

Use an example JSON file to test parsers and serializers, schema validation, Unicode and number-precision handling, and API request or response processing.

How to use this file for testing

“Reproducible Build Comparison Report” is a deterministic Testaroo fixture for JSON parsing, Visual diff / regression, Schema validation. Flat, deeply nested, JSON Lines, and intentionally invalid JSON for testing parsers and error handling.

Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.

Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such, expect parsers to fail loudly rather than silently accept them.

SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented, never treat a finding here as real.

Feed the file to your parser and assert it handles the documented quirks, quoted delimiters, embedded newlines, ragged rows, or invalid syntax; the valid↔invalid distinction is labelled in the title.

Code examples

import json

with open("reproducible-build-report.json") as f:
    data = json.load(f)
print(type(data), len(data))

Generated by generation/supply_chain.py. Free for any use, no attribution required, license.

Related files