edison/chanora
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(p0): compact MVP spec for Android Oboe focus

Browse Source
This commit is contained in:
Edison Jwa
2026-05-20 14:52:33 +09:00
parent 8c253f1d4d
commit 7d6d56e330
63 changed files with 8000 additions and 46507 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security/dependency-and-supply-chain-report.md
-126
View File
@@ -1,126 +0,0 @@
# Sec Dependency And Supply Chain Report V0.9.2.2.1
**Document type:** Security / Dependency and Supply Chain Report
**Version:** 0.9.2
**Status:** Baseline Candidate
**Language:** English
**Product:** Chanora
**Repo path:** `docs/security/dependency-and-supply-chain-report.md` ---
## 1. Purpose
This report records Chanora dependency inventory, license review, vulnerability review, SBOM status, and supply-chain release readiness.
## 2. Dependency Scope
| Ecosystem | In scope |
|---|---|
| Flutter / Dart | `pubspec.yaml`, transitive packages, Flutter SDK version |
| Rust | `Cargo.toml`, `Cargo.lock`, crates, features |
| Protocol library | `tsclientlib` and related crates/dependencies |
| Native audio | Platform audio libraries, native build dependencies, bindings |
| Build tooling | CI actions, build scripts, code generators |
| Packaging | Platform packaging tools and signing tools |
## 3. Required Outputs
| Output | Required before external release |
|---|---|
| Dependency inventory | Yes |
| License report | Yes |
| Vulnerability scan report | Yes |
| SBOM | Yes |
| Critical/high vulnerability disposition | Yes |
| Unknown license disposition | Yes |
| Build provenance record | Yes |
| Artifact hash record | Yes |
## 4. Dependency Inventory
| Component | Ecosystem | Version | License | Source | Risk | Notes |
|---|---|---|---|---|---|---|
| Flutter SDK | Flutter | TBD | TBD | TBD | TBD | TBD |
| Dart packages | Dart | TBD | TBD | TBD | TBD | TBD |
| Rust toolchain | Rust | TBD | TBD | TBD | TBD | TBD |
| Rust crates | Rust | TBD | TBD | TBD | TBD | TBD |
| `tsclientlib` | Rust/protocol | TBD | TBD | TBD | TBD | TBD |
| Native audio dependencies | Native | TBD | TBD | TBD | TBD | TBD |
| CI actions/tools | Build | TBD | TBD | TBD | TBD | TBD |
## 5. License Review
| License category | Policy |
|---|---|
| Permissive licenses | Generally acceptable after review |
| Copyleft licenses | Requires legal review before release |
| Unknown licenses | Release blocker until resolved |
| Proprietary dependencies | Requires explicit approval |
| Incompatible licenses | Release blocker unless removed or legal waiver approved |
## 6. Vulnerability Review
| Finding ID | Dependency | Severity | CVE / advisory | Status | Disposition |
|---|---|---|---|---|---|
| TBD | TBD | TBD | TBD | TBD | TBD |
## 7. SBOM
| Field | Value |
|---|---|
| SBOM format | TBD: SPDX / CycloneDX / other |
| SBOM tool | TBD |
| SBOM file | TBD |
| SBOM generation date | TBD |
| SBOM reviewer | TBD |
## 8. Build Provenance
| Field | Value |
|---|---|
| Git commit SHA | TBD |
| Git tag | TBD |
| CI pipeline ID | TBD |
| Build environment | TBD |
| Artifact hashes | TBD |
| Signing identity | TBD |
| Reproducibility status | TBD |
## 9. Release Gate
| Gate | Required result |
|---|---|
| Critical vulnerabilities | None open without approved waiver |
| High vulnerabilities | None open without approved waiver |
| Unknown licenses | None open without approved waiver |
| SBOM | Generated and archived |
| License report | Reviewed |
| Dependency report | Approved |
## 10. Approval
| Role | Name | Decision | Date |
|---|---|---|---|
| Security Reviewer | TBD | Pending | TBD |
| Legal Reviewer | TBD | Pending | TBD |
| Engineering Owner | TBD | Pending | TBD |
| Release Manager | TBD | Pending | TBD |
## 11. Change History
| Version | Date | Description |
|---|---|---|
| 0.9.0 | 2026-05-14 | Initial dependency and supply-chain report template. |
## Baseline Candidate 0.9.1 Update
| Version | Date | Description |
|---|---|---|
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
## Baseline Candidate 0.9.2 Update
| Version | Date | Description |
|---|---|---|
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |