1.1 KiB
1.1 KiB
Why
The gateway has reproducible Linux binaries and a dependency inventory but no deterministic standard SBOM, while OPS-009 and the Phase 3C gateway plan require one for engineering exit.
What Changes
- Generate byte-stable SPDX 2.3 JSON using repository, Go module, and artifact metadata.
- Record exact source revision, immutable Protocol version/checksum, module relationships, Linux artifact hashes and architectures, and truthful license fields.
- Retain notices/provenance and use
NOASSERTIONwhere license evidence is unavailable. - Keep vulnerability scanning, signing, and Phase 3C-C image remediation explicitly separate.
Capabilities
New Capabilities
None.
Modified Capabilities
gateway-deployment-artifact: Require an inspected deterministic standard SBOM for shipped gateway binaries.
Impact
Data Plane packaging tooling, deterministic tests, Makefile targets, canonical deployment-artifact OpenSpec, and evidence records. Uses Go standard library only; no new dependency. Requirements: SYS-019, P3C-002, P3C-035, OPS-009, VER-015, VER-017.