# Supply-chain policy

The committed `uv.lock` is the reproducible dependency source for the supported
Python 3.10–3.12 test matrix. CI installs CPU-only PyTorch from PyTorch's
explicit package index and resolves every other package from PyPI. The lock
contains exact versions, source URLs, environment markers, and artifact hashes.

CI uses exact Python tool versions and checksum-pinned standalone binaries.
`ci/digests.txt` records executable and GitHub Action pins; build, test, and
license-tool transitive dependencies are covered by `uv.lock`.

## Required evidence

The Supply chain job retains these artifacts for 14 days:

- one redacted Gitleaks JSON report for the checkout;
- OSV audit JSON and scanner status for Python 3.10, 3.11, and 3.12 on Linux;
- a JSON license inventory for all packaged extras;
- a CycloneDX 1.5 SBOM bound to the built wheel by SHA-256;
- the policy decisions and built wheel used by those checks.

Every secret finding and every OSV vulnerability is blocking by default. OSV
does not provide a normalized severity for every advisory, so the policy treats
unknown, low, medium, high, and critical findings alike. This is stricter than
a high-only threshold and avoids silently passing advisories with missing
severity data.

License metadata must exactly match an expression in
`ci/supply-chain-policy.json`. OBLITERATUS itself is excluded from dependency
license evaluation because its AGPL license is the project license rather than
a third-party dependency decision.

## Exceptions

Exceptions live only in `ci/supply-chain-policy.json`; command-line ignores and
unconditional success conversion are forbidden.

- A vulnerability exception names an OSV/GHSA/CVE identifier, states a reason,
  records `approved_on` and `expires`, and declares whether a fix is available.
  Fixable findings may be excepted for at most 7 days; findings without a fix
  may be excepted for at most 90 days.
- A secret exception names the redacted Gitleaks fingerprint, states a reason,
  and records `approved_on` and `expires`. It may last at most 30 days.
- Expired, overlong, stale, malformed, or unused exceptions fail CI. A finding
  that gains a fix cannot use an exception declared as unfixable.
- License exceptions are not supported. Add an exact expression only after a
  maintainer verifies the package metadata and compatibility with AGPL-3.0-or-later.

## Updating the lock and tools

Use the version of uv recorded in `ci/digests.txt`:

```bash
uvx --from uv==0.12.4 uv lock --upgrade
uvx --from uv==0.12.4 uv lock --check
```

Review the complete lock diff, source indexes, new licenses, vulnerability
evidence, and SBOM diff. Update direct pins in `pyproject.toml` and executable
pins/checksums in `ci/digests.txt` in the same pull request. A normal dependency
or tool update must not add an exception merely to make CI green.