sechmachine/VerseVDI-Data-Plane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

build(gateway): generate deterministic SPDX SBOM

Browse Source
This commit is contained in:
sechmachine
2026-07-30 22:47:55 +07:00
parent 786c96b110
commit 08eb6dc36c
10 changed files with 570 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openspec/specs/gateway-deployment-artifact/spec.md
+20 -2
View File
@@ -12,8 +12,26 @@ The candidate SHALL build the gateway with the normal immutable Protocol module
- **THEN** both amd64 and arm64 outputs are byte-identical pure-Go ELF executables with matching embedded GOOS, GOARCH, and cgo settings
### Requirement: Artifact evidence is inspected and truthful
Candidate evidence SHALL record exact source and Protocol revisions, artifact hashes, architecture, embedded dependency inventory, container configuration when built, and the actual scanner/signing status. It MUST NOT claim an SBOM, vulnerability result, signature, image architecture, or deployment that was not produced and inspected.
Candidate evidence SHALL record exact source and immutable Protocol
revisions/checksums, artifact hashes, architecture, embedded dependency
inventory, container configuration when built, and the actual scanner/signing
status. It SHALL include one byte-stable SPDX 2.3 JSON SBOM for the shipped Linux
gateway artifacts containing the source package, resolved Go modules, dependency
and generated-from relationships, artifact hashes and architectures, retained
notices/provenance, and truthful license fields using `NOASSERTION` where
evidence is unavailable. It MUST NOT claim a vulnerability result, signature,
image architecture, deployment, or license conclusion that was not produced and
inspected.
#### Scenario: Deterministic gateway SBOM
- **WHEN** the canonical SBOM command runs twice with the same clean source
revision, Protocol module/checksum, module graph, source date, and Linux
artifacts
- **THEN** both SPDX JSON outputs are byte-identical and every declared
artifact/module relationship and hash matches the inspected inputs
#### Scenario: Supplemental scanner is unavailable
- **WHEN** no qualifying vulnerability scanner is available in the frozen environment
- **THEN** the artifact remains explicitly unscanned, deterministic compiler/dependency/boundary evidence is retained, and no zero-finding security claim is emitted
- **THEN** the artifact remains explicitly unscanned and unsigned, the
deterministic SBOM/compiler/dependency/boundary evidence is retained, and no
zero-finding security claim is emitted