mirror of
https://github.com/elder-plinius/OBLITERATUS.git
synced 2026-08-17 16:37:30 +02:00
62 lines
2.8 KiB
Markdown
62 lines
2.8 KiB
Markdown
# Supply-chain policy
|
||
|
||
The committed `uv.lock` is the reproducible dependency source for the supported
|
||
Python 3.10–3.12 test matrix. CI installs CPU-only PyTorch from PyTorch's
|
||
explicit package index and resolves every other package from PyPI. The lock
|
||
contains exact versions, source URLs, environment markers, and artifact hashes.
|
||
|
||
CI uses exact Python tool versions and checksum-pinned standalone binaries.
|
||
`ci/digests.txt` records executable and GitHub Action pins; build, test, and
|
||
license-tool transitive dependencies are covered by `uv.lock`.
|
||
|
||
## Required evidence
|
||
|
||
The Supply chain job retains these artifacts for 14 days:
|
||
|
||
- one redacted Gitleaks JSON report for the checkout;
|
||
- OSV audit JSON and scanner status for Python 3.10, 3.11, and 3.12 on Linux;
|
||
- a JSON license inventory for all packaged extras;
|
||
- a CycloneDX 1.5 SBOM bound to the built wheel by SHA-256;
|
||
- the policy decisions and built wheel used by those checks.
|
||
|
||
Every secret finding and every OSV vulnerability is blocking by default. OSV
|
||
does not provide a normalized severity for every advisory, so the policy treats
|
||
unknown, low, medium, high, and critical findings alike. This is stricter than
|
||
a high-only threshold and avoids silently passing advisories with missing
|
||
severity data.
|
||
|
||
License metadata must exactly match an expression in
|
||
`ci/supply-chain-policy.json`. OBLITERATUS itself is excluded from dependency
|
||
license evaluation because its AGPL license is the project license rather than
|
||
a third-party dependency decision.
|
||
|
||
## Exceptions
|
||
|
||
Exceptions live only in `ci/supply-chain-policy.json`; command-line ignores and
|
||
unconditional success conversion are forbidden.
|
||
|
||
- A vulnerability exception names an OSV/GHSA/CVE identifier, states a reason,
|
||
records `approved_on` and `expires`, and declares whether a fix is available.
|
||
Fixable findings may be excepted for at most 7 days; findings without a fix
|
||
may be excepted for at most 90 days.
|
||
- A secret exception names the redacted Gitleaks fingerprint, states a reason,
|
||
and records `approved_on` and `expires`. It may last at most 30 days.
|
||
- Expired, overlong, stale, malformed, or unused exceptions fail CI. A finding
|
||
that gains a fix cannot use an exception declared as unfixable.
|
||
- License exceptions are not supported. Add an exact expression only after a
|
||
maintainer verifies the package metadata and compatibility with AGPL-3.0-or-later.
|
||
|
||
## Updating the lock and tools
|
||
|
||
Use the version of uv recorded in `ci/digests.txt`:
|
||
|
||
```bash
|
||
uvx --from uv==0.12.4 uv lock --upgrade
|
||
uvx --from uv==0.12.4 uv lock --check
|
||
```
|
||
|
||
Review the complete lock diff, source indexes, new licenses, vulnerability
|
||
evidence, and SBOM diff. Update direct pins in `pyproject.toml` and executable
|
||
pins/checksums in `ci/digests.txt` in the same pull request. A normal dependency
|
||
or tool update must not add an exception merely to make CI green.
|