13 lines
1.4 KiB
Markdown
13 lines
1.4 KiB
Markdown
## MODIFIED Requirements
|
|
|
|
### Requirement: Artifact evidence is inspected and truthful
|
|
Candidate evidence SHALL record exact source and immutable Protocol revisions/checksums, artifact hashes, architecture, embedded dependency inventory, container configuration when built, and the actual scanner/signing status. It SHALL include one byte-stable SPDX 2.3 JSON SBOM for the shipped Linux gateway artifacts containing the source package, resolved Go modules, dependency and generated-from relationships, artifact hashes and architectures, retained notices/provenance, and truthful license fields using `NOASSERTION` where evidence is unavailable. It MUST NOT claim a vulnerability result, signature, image architecture, deployment, or license conclusion that was not produced and inspected.
|
|
|
|
#### Scenario: Deterministic gateway SBOM
|
|
- **WHEN** the canonical SBOM command runs twice with the same clean source revision, Protocol module/checksum, module graph, source date, and Linux artifacts
|
|
- **THEN** both SPDX JSON outputs are byte-identical and every declared artifact/module relationship and hash matches the inspected inputs
|
|
|
|
#### Scenario: Supplemental scanner is unavailable
|
|
- **WHEN** no qualifying vulnerability scanner is available in the frozen environment
|
|
- **THEN** the artifact remains explicitly unscanned and unsigned, the deterministic SBOM/compiler/dependency/boundary evidence is retained, and no zero-finding security claim is emitted
|