Package Manager Manifest Examples

A collection of manifest and lockfile examples from package managers across different programming language ecosystems. This repository serves as documentation and reference for understanding the structure and features of various package management formats.

Who is this for?

• Tool developers building parsers, SBOM generators, or dependency analyzers
• Security researchers analyzing software supply chains
• Package manager maintainers understanding other ecosystems' approaches
• Developers learning about manifest formats and best practices

Purpose

You might want to use this repository for:

• Real-world examples of package manifest and lockfile formats
• Documentation of package manager features and specifications
• Reference material for tool developers working with package metadata
• Comparative analysis across different ecosystem approaches

Ecosystems

• actions - GitHub Actions (action.yml, workflow.yml)
• alpm - Arch Linux (PKGBUILD)
• apk - Alpine Linux (APKBUILD)
• bower - JavaScript package manager, deprecated (bower.json)
• bun - Bun JavaScript runtime (bun.lock)
• cargo - Rust package manager (Cargo.toml, Cargo.lock)
• carthage - iOS/macOS dependency manager (Cartfile, Cartfile.resolved)
• clojars - Clojure packages (project.clj, deps.edn)
• cocoapods - iOS/macOS (Podfile, Podfile.lock, .podspec)
• composer - PHP packages (composer.json, composer.lock)
• conan - C++ packages (conanfile.txt, conanfile.py, conan.lock)
• conda - Conda packages (environment.yml)
• cpan - Perl modules (META.json, META.yml, cpanfile, Build.PL)
• cran - R packages (DESCRIPTION, renv.lock)
• deb - Debian packages (control file)
• deno - Deno JavaScript runtime (deno.json, deno.lock)
• docker - Container images (Dockerfile, docker-compose.yml)
• dub - D language (dub.json, dub.sdl, dub.selections.json)
• elm - Elm language (elm-package.json)
• gem - Ruby gems (Gemfile, Gemfile.lock, .gemspec)
• gleam - Gleam language for BEAM VM (gleam.toml)
• golang - Go modules (go.mod, go.sum)
• hackage - Haskell (*.cabal, stack.yaml, stack.yaml.lock)
• haxelib - Haxe packages (haxelib.json)
• hex - Elixir (mix.exs, mix.lock)
• homebrew - macOS package manager (Brewfile, Brewfile.lock.json)
• ivy - Apache Ivy for Java (ivy.xml)
• julia - Julia packages (Project.toml, Manifest.toml)
• luarocks - Lua packages (*.rockspec)
• maven - Java/JVM build tools (pom.xml, build.gradle, build.gradle.kts)
• nimble - Nim packages (*.nimble)
• nix - Nix flakes (flake.nix, flake.lock)
• npm - Node.js package manager (package.json, lockfiles for npm/yarn/pnpm)
• nuget - .NET packages (.csproj, packages.config, packages.lock.json)
• paket - .NET/F# package manager (paket.lock)
• pub - Dart/Flutter (pubspec.yaml, pubspec.lock)
• pypi - Python packages (requirements.txt, pyproject.toml, Pipfile, poetry.lock, pdm.lock, uv.lock)
• rebar - Erlang/OTP (rebar.lock)
• rpm - Red Hat packages (.spec file)
• sbt - Scala Build Tool (build.sbt)
• shards - Crystal packages (shard.yml, shard.lock)
• swift - Swift Package Manager (Package.swift, Package.resolved)
• vcpkg - C++ package manager (vcpkg.json)

Structure

The repository is organized by PURL (Package URL) type, with each ecosystem in its own directory:

npm/           - Node.js packages
pypi/          - Python packages
maven/         - Java/JVM packages
cargo/         - Rust packages
gem/           - Ruby gems
composer/      - PHP packages
nuget/         - .NET packages
golang/        - Go modules
... and more

Each directory contains:

• README.md - Overview of the ecosystem, package manager details, and a table documenting all example files
• Example files - Various manifest and lockfile formats with different features and edge cases

Example File Documentation

For each example file, we document:

• Filename - Original filename as it appears in projects
• Type - Whether it's a manifest, lockfile, or other metadata file
• Source - Where the example came from (specific project/repository)
• Features - Notable aspects demonstrated (workspaces, peer dependencies, etc.)

Contributing

We welcome contributions of additional examples, especially those demonstrating:

• Edge cases and complex dependency scenarios
• Different versions of manifest formats
• Platform-specific or environment-specific configurations
• Monorepo/workspace setups
• Examples from well-known projects

Please ensure examples are properly attributed to their source projects.

Sources

Examples are sourced from:

• Bibliothecary - Ecosyste.ms dependency parser library
• Trivy - Aqua Security's vulnerability scanner
• Syft - Anchore's SBOM generation tool
• OSV-Scanner - Google's vulnerability scanner
• Grype - Anchore's vulnerability scanner

License

CC0 1.0 Universal

Individual example files retain their original licenses from their source projects.