Low Severity
Published: Oct 26, 2026
Multi-ecosystem SCA benchmark: real OSS packages at CVE-affected versions, for comparing syft/grype, trivy, Snyk, Black Duck
# SCA Tool Benchmark Sample Tree
> **Public copy.** This repository is the GitHub mirror of the benchmark folder, meant for
> manifest-based scanners such as Snyk. Compared with the full local tree it leaves out:
> `binaries/` (compiled files with no package data), `_baseline/` and `_evidence/` (raw tool
> output), `MANIFEST.sha256`, `golang/gobinary/gitea-1.16.0-linux-amd64` (101 MB) and
> `debian/plain_rootfs.tar` (96 MB). Sections below that mention those paths describe the full tree.
## Purpose
This tree is a test target for comparing software composition analysis (SCA) tools:
- **Black Duck SCA** — signature scan plus package-manager scan (BDSA/CVE feed)
- **syft** 1.44.0 + **grype** 0.118.0
- **trivy** 0.74.0
Every package in it is a **real** release fetched from its real registry, pinned to a version
that has published security findings. Nothing is a stub. Manifest and lock files carry the real
integrity hashes wherever the hash could be fetched or computed; where it could not, the field is
left out and the omission is recorded in [Known gaps](#known-gaps) rather than filled with an
invented value.
Each ecosystem folder holds up to four **forms** of the same information, because tools differ in
which form they read:
| Form | Meaning |
|---|---|
| manifest | What a developer asked for (`package.json`, `pom.xml`, `Cargo.toml`) |
| lock | What the resolver picked, with hashes (`package-lock.json`, `Cargo.lock`) |
| installed | What the package manager wrote to disk (`site-packages/`, `node_modules/`, `var/lib/dpkg/status`) |
| archive | The package file itself (`.whl`, `.jar`, `.deb`, `.crate`, `.nupkg`) |
| binary | A compiled file with no package data next to it |
## Total size
**789 MB** in 14,227 files: 33 ecosystem folders plus `compliance/` (631 MB), `_baseline/` (139 MB, raw tool output, timing, scorecard), `_evidence/` (9 MB, Snyk), `sbom/` (5.5 MB), `README.md` and `MANIFEST.sha256`.
## Layout
```
blackduck_sca_samples/
├── README.md