Vulnerability Suppression Policy (YAML)
A suppression policy that gives every waiver an owner, a reason and an expiry date: the fields that stop a suppression file becoming a permanent blindfold. All four entries are SAMPLE. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
# Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.
version: 1
policy: sample-suppressions
expiresAfterDays: 90
suppressions:
- id: NOVUS-SAMPLE-2026-0001
package: example-logger
version: 3.4.1
reason: triage-in-progress
approvedBy: sample-security-team@orchard.example
expires: 2026-04-01
note: "SAMPLE suppression. Upgrade path is 3.5.0."
- id: NOVUS-SAMPLE-2026-0002
package: example-cache
version: 0.9.2
reason: not-reachable
approvedBy: sample-security-team@orchard.example
expires: 2026-04-01
note: "SAMPLE suppression. Upgrade path is 0.9.5."
- id: NOVUS-SAMPLE-2026-0003
package: example-yaml-lite
version: 1.1.7
reason: fixed-in-next-release
approvedBy: sample-security-team@orchard.example
expires: 2026-04-01
note: "SAMPLE suppression. Upgrade path is 1.2.0."
- id: NOVUS-SAMPLE-2026-0004
package: example-json-path
version: 2.0.5
reason: accepted-risk
approvedBy: sample-security-team@orchard.example
expires: 2026-04-01
note: "SAMPLE suppression. Upgrade path is 2.1.0."
Specifications
- Seed
- 51200
- Sample Only
- true
- Format
- YAML
- Suppressions
- 4
- Expiry Policy Days
- 90
- Requires Approver
- true
- Line Endings
- LF
Testing contract
Expected to pass- Scenario
- Enforce that no suppression is open-ended.
- Expected result
- Policy checker accepts all four entries today and flags every one of them as expired when evaluated after 2026-04-01.
What is a .yaml file?
YAML (YAML Ain't Markup Language) is a human-readable data-serialization format using indentation, key-value pairs, and lists, and is a superset of JSON. It supports comments, anchors, and multiple documents per file, favoring readability for configuration. Its indentation sensitivity makes it error-prone to hand-edit.
How to use this file
Use an example YAML file to test config parsers, indentation and anchor handling, multi-document streams, and safe-loading to avoid arbitrary object construction.
How to use this file for testing
“Vulnerability Suppression Policy (YAML)” is a deterministic Testaroo fixture for Config parsing, Config testing, Schema validation. TOML and INI configuration files with nested sections and typed values, for testing config parsers and loaders.
Documented properties for this file: seed 51200 · LF · YAML. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such, expect parsers to fail loudly rather than silently accept them.
SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented, never treat a finding here as real.
Point your config loader at the file and assert it reads the documented sections and typed values, including any deliberately-tricky nesting or comments.
Code examples
import yaml # pip install pyyaml
with open("suppressions.yaml") as f:
data = yaml.safe_load(f)
print(data)Generated by generation/supply_chain.py. Free for any use, no attribution required, license.
Related files
- yamlAttestation Verification Policy (YAML)The policy an admission controller evaluates before an artifact is allowed through: required predicate types, an allowed-builder list, a minimum SLSA level, a transparency-log requirement and one dated exception. Every package, version, hash and licence is fictional: the tree describes nothing real.
- ymlGitHub Actions Over-Permissive Token (Policy Target)A schema-valid workflow that should still be rejected on review: permissions: write-all at the workflow level plus three unused write scopes on the job. Nothing here is an exploit; it is the least-privilege finding a policy engine is supposed to raise.
- lockCargo.lock (version 4)A Rust Cargo.lock in the version 4 format: TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional: the tree describes nothing real.
- jsonin-toto Layout (Supply-Chain Policy)The policy half of in-toto: a layout declaring which steps must run, which keys may sign them, and the MATCH/CREATE/DISALLOW artifact rules that bind each step's products to the next step's materials. Signatures, key ids and certificates here are SAMPLE placeholders: the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.
- txtpip requirements.txt With Pinned HashesA hash-pinned pip requirements file with two sha256 hashes per fictional package (wheel and sdist) and line continuations: the form `--require-hashes` installs demand. Every package, version, hash and licence is fictional: the tree describes nothing real.
- yamlpnpm-lock.yaml (lockfileVersion 9)A pnpm v9 lockfile with its three-section layout (importers for declared specifiers, packages for resolution metadata and snapshots for the resolved edges) pinning the same fictional tree. Every package, version, hash and licence is fictional: the tree describes nothing real.
