We should have a public redistributable repository of examples of SARIF data for use by consumers for interop testing, and for reference of implementers.
I've had a go at creating one here:
https://github.com/davidmalcolm/sarif-examples
It has examples of valid, invalid, and malformed files.
The README.rst there has some further notes.