build(gateway): generate deterministic SPDX SBOM

2026-07-30 22:47:55 +07:00
parent 786c96b110
commit 08eb6dc36c
10 changed files with 570 additions and 3 deletions
@@ -0,0 +1,24 @@
+## Why
+
+The gateway has reproducible Linux binaries and a dependency inventory but no deterministic standard SBOM, while OPS-009 and the Phase 3C gateway plan require one for engineering exit.
+
+## What Changes
+
+- Generate byte-stable SPDX 2.3 JSON using repository, Go module, and artifact metadata.
+- Record exact source revision, immutable Protocol version/checksum, module relationships, Linux artifact hashes and architectures, and truthful license fields.
+- Retain notices/provenance and use `NOASSERTION` where license evidence is unavailable.
+- Keep vulnerability scanning, signing, and Phase 3C-C image remediation explicitly separate.
+
+## Capabilities
+
+### New Capabilities
+
+None.
+
+### Modified Capabilities
+
+- `gateway-deployment-artifact`: Require an inspected deterministic standard SBOM for shipped gateway binaries.
+
+## Impact
+
+Data Plane packaging tooling, deterministic tests, Makefile targets, canonical deployment-artifact OpenSpec, and evidence records. Uses Go standard library only; no new dependency. Requirements: SYS-019, P3C-002, P3C-035, OPS-009, VER-015, VER-017.