15 lines
703 B
Markdown
15 lines
703 B
Markdown
## 1. Red deterministic contract
|
|
|
|
- [x] 1.1 Add a focused test requiring SPDX 2.3 fields, source/Protocol/module relationships, two architectures, and exact artifact hashes
|
|
- [x] 1.2 Prove current packaging cannot produce the required standard SBOM
|
|
|
|
## 2. Standard-library generator
|
|
|
|
- [x] 2.1 Implement bounded deterministic SPDX JSON generation from explicit build and Go module metadata
|
|
- [x] 2.2 Record truthful license fields, notices/provenance, unscanned status, and no signing claim
|
|
|
|
## 3. Verification
|
|
|
|
- [x] 3.1 Prove byte-stable regeneration and rejection of dirty, missing, mismatched, or ambiguous inputs
|
|
- [x] 3.2 Reconcile the deployment-artifact canonical spec and run strict validation
|