gateway-deployment-artifact Specification

Purpose

Define the reproducible Linux gateway artifacts and truthful inspection evidence required for a deterministic Phase 3C engineering candidate.

Requirements

Requirement: Reproducible pure-Go Linux gateway artifacts

The candidate SHALL build the gateway with the normal immutable Protocol module boundary for Linux amd64 and arm64 using CGO_ENABLED=0, deterministic path/VCS/build-ID settings, and no sidecar. Two independent builds of each architecture MUST be byte-identical.

Scenario: Both Linux architectures are built

WHEN the canonical gateway Linux target runs twice from the same frozen source and dependency inputs
THEN both amd64 and arm64 outputs are byte-identical pure-Go ELF executables with matching embedded GOOS, GOARCH, and cgo settings

Requirement: Artifact evidence is inspected and truthful

Candidate evidence SHALL record exact source and immutable Protocol revisions/checksums, artifact hashes, architecture, embedded dependency inventory, container configuration when built, and the actual scanner/signing status. It SHALL include one byte-stable SPDX 2.3 JSON SBOM for the shipped Linux gateway artifacts containing the source package, resolved Go modules, dependency and generated-from relationships, artifact hashes and architectures, retained notices/provenance, and truthful license fields using NOASSERTION where evidence is unavailable. It MUST NOT claim a vulnerability result, signature, image architecture, deployment, or license conclusion that was not produced and inspected.

Scenario: Deterministic gateway SBOM

WHEN the canonical SBOM command runs twice with the same clean source revision, Protocol module/checksum, module graph, source date, and Linux artifacts
THEN both SPDX JSON outputs are byte-identical and every declared artifact/module relationship and hash matches the inspected inputs

Scenario: Supplemental scanner is unavailable

WHEN no qualifying vulnerability scanner is available in the frozen environment
THEN the artifact remains explicitly unscanned and unsigned, the deterministic SBOM/compiler/dependency/boundary evidence is retained, and no zero-finding security claim is emitted

2.2 KiB Raw Blame History