Files
VerseVDI-Data-Plane/openspec/changes/deterministic-gateway-sbom/tasks.md
T

15 lines
703 B
Markdown

## 1. Red deterministic contract
- [x] 1.1 Add a focused test requiring SPDX 2.3 fields, source/Protocol/module relationships, two architectures, and exact artifact hashes
- [x] 1.2 Prove current packaging cannot produce the required standard SBOM
## 2. Standard-library generator
- [x] 2.1 Implement bounded deterministic SPDX JSON generation from explicit build and Go module metadata
- [x] 2.2 Record truthful license fields, notices/provenance, unscanned status, and no signing claim
## 3. Verification
- [x] 3.1 Prove byte-stable regeneration and rejection of dirty, missing, mismatched, or ambiguous inputs
- [x] 3.2 Reconcile the deployment-artifact canonical spec and run strict validation