38 lines
2.2 KiB
Markdown
38 lines
2.2 KiB
Markdown
# gateway-deployment-artifact Specification
|
|
|
|
## Purpose
|
|
Define the reproducible Linux gateway artifacts and truthful inspection evidence required for a deterministic Phase 3C engineering candidate.
|
|
|
|
## Requirements
|
|
### Requirement: Reproducible pure-Go Linux gateway artifacts
|
|
The candidate SHALL build the gateway with the normal immutable Protocol module boundary for Linux amd64 and arm64 using `CGO_ENABLED=0`, deterministic path/VCS/build-ID settings, and no sidecar. Two independent builds of each architecture MUST be byte-identical.
|
|
|
|
#### Scenario: Both Linux architectures are built
|
|
- **WHEN** the canonical gateway Linux target runs twice from the same frozen source and dependency inputs
|
|
- **THEN** both amd64 and arm64 outputs are byte-identical pure-Go ELF executables with matching embedded GOOS, GOARCH, and cgo settings
|
|
|
|
### Requirement: Artifact evidence is inspected and truthful
|
|
Candidate evidence SHALL record exact source and immutable Protocol
|
|
revisions/checksums, artifact hashes, architecture, embedded dependency
|
|
inventory, container configuration when built, and the actual scanner/signing
|
|
status. It SHALL include one byte-stable SPDX 2.3 JSON SBOM for the shipped Linux
|
|
gateway artifacts containing the source package, resolved Go modules, dependency
|
|
and generated-from relationships, artifact hashes and architectures, retained
|
|
notices/provenance, and truthful license fields using `NOASSERTION` where
|
|
evidence is unavailable. It MUST NOT claim a vulnerability result, signature,
|
|
image architecture, deployment, or license conclusion that was not produced and
|
|
inspected.
|
|
|
|
#### Scenario: Deterministic gateway SBOM
|
|
- **WHEN** the canonical SBOM command runs twice with the same clean source
|
|
revision, Protocol module/checksum, module graph, source date, and Linux
|
|
artifacts
|
|
- **THEN** both SPDX JSON outputs are byte-identical and every declared
|
|
artifact/module relationship and hash matches the inspected inputs
|
|
|
|
#### Scenario: Supplemental scanner is unavailable
|
|
- **WHEN** no qualifying vulnerability scanner is available in the frozen environment
|
|
- **THEN** the artifact remains explicitly unscanned and unsigned, the
|
|
deterministic SBOM/compiler/dependency/boundary evidence is retained, and no
|
|
zero-finding security claim is emitted
|