25 lines
1.1 KiB
Markdown
25 lines
1.1 KiB
Markdown
## Why
|
|
|
|
The gateway has reproducible Linux binaries and a dependency inventory but no deterministic standard SBOM, while OPS-009 and the Phase 3C gateway plan require one for engineering exit.
|
|
|
|
## What Changes
|
|
|
|
- Generate byte-stable SPDX 2.3 JSON using repository, Go module, and artifact metadata.
|
|
- Record exact source revision, immutable Protocol version/checksum, module relationships, Linux artifact hashes and architectures, and truthful license fields.
|
|
- Retain notices/provenance and use `NOASSERTION` where license evidence is unavailable.
|
|
- Keep vulnerability scanning, signing, and Phase 3C-C image remediation explicitly separate.
|
|
|
|
## Capabilities
|
|
|
|
### New Capabilities
|
|
|
|
None.
|
|
|
|
### Modified Capabilities
|
|
|
|
- `gateway-deployment-artifact`: Require an inspected deterministic standard SBOM for shipped gateway binaries.
|
|
|
|
## Impact
|
|
|
|
Data Plane packaging tooling, deterministic tests, Makefile targets, canonical deployment-artifact OpenSpec, and evidence records. Uses Go standard library only; no new dependency. Requirements: SYS-019, P3C-002, P3C-035, OPS-009, VER-015, VER-017.
|