Files

T

EdisonJwa f1bc9a6c85 chore(repo): initial baseline import (docs v0.9.2 + bootstrap)

Imports the v0.9.2 documentation baseline and the bootstrap files
required by docs/governance/repository-bootstrap-plan.md v0.1.0 §3,
minus the justfile (added in the next commit).

This commit establishes the git history for the project. All previous
work lived only as filesystem state with no version control.

2026-05-14 12:25:33 +08:00

4.0 KiB

Raw Blame History

Sec Dependency And Supply Chain Report V0.9.2.2.1

Document type: Security / Dependency and Supply Chain Report
Version: 0.9.2
Status: Baseline Candidate
Language: English
Product: Chanora
Repo path: docs/security/dependency-and-supply-chain-report.md ---

1. Purpose

This report records Chanora dependency inventory, license review, vulnerability review, SBOM status, and supply-chain release readiness.

2. Dependency Scope

Ecosystem	In scope
Flutter / Dart	`pubspec.yaml`, transitive packages, Flutter SDK version
Rust	`Cargo.toml`, `Cargo.lock`, crates, features
Protocol library	`tsclientlib` and related crates/dependencies
Native audio	Platform audio libraries, native build dependencies, bindings
Build tooling	CI actions, build scripts, code generators
Packaging	Platform packaging tools and signing tools

3. Required Outputs

Output	Required before external release
Dependency inventory	Yes
License report	Yes
Vulnerability scan report	Yes
SBOM	Yes
Critical/high vulnerability disposition	Yes
Unknown license disposition	Yes
Build provenance record	Yes
Artifact hash record	Yes

4. Dependency Inventory

Component	Ecosystem	Version	License	Source	Risk	Notes
Flutter SDK	Flutter	TBD	TBD	TBD	TBD	TBD
Dart packages	Dart	TBD	TBD	TBD	TBD	TBD
Rust toolchain	Rust	TBD	TBD	TBD	TBD	TBD
Rust crates	Rust	TBD	TBD	TBD	TBD	TBD
`tsclientlib`	Rust/protocol	TBD	TBD	TBD	TBD	TBD
Native audio dependencies	Native	TBD	TBD	TBD	TBD	TBD
CI actions/tools	Build	TBD	TBD	TBD	TBD	TBD

5. License Review

License category	Policy
Permissive licenses	Generally acceptable after review
Copyleft licenses	Requires legal review before release
Unknown licenses	Release blocker until resolved
Proprietary dependencies	Requires explicit approval
Incompatible licenses	Release blocker unless removed or legal waiver approved

6. Vulnerability Review

Finding ID	Dependency	Severity	CVE / advisory	Status	Disposition
TBD	TBD	TBD	TBD	TBD	TBD

7. SBOM

Field	Value
SBOM format	TBD: SPDX / CycloneDX / other
SBOM tool	TBD
SBOM file	TBD
SBOM generation date	TBD
SBOM reviewer	TBD

8. Build Provenance

Field	Value
Git commit SHA	TBD
Git tag	TBD
CI pipeline ID	TBD
Build environment	TBD
Artifact hashes	TBD
Signing identity	TBD
Reproducibility status	TBD

9. Release Gate

Gate	Required result
Critical vulnerabilities	None open without approved waiver
High vulnerabilities	None open without approved waiver
Unknown licenses	None open without approved waiver
SBOM	Generated and archived
License report	Reviewed
Dependency report	Approved

10. Approval

Role	Name	Decision	Date
Security Reviewer	TBD	Pending	TBD
Legal Reviewer	TBD	Pending	TBD
Engineering Owner	TBD	Pending	TBD
Release Manager	TBD	Pending	TBD

11. Change History

Version	Date	Description
0.9.0	2026-05-14	Initial dependency and supply-chain report template.

Baseline Candidate 0.9.1 Update

Version	Date	Description
0.9.1	2026-05-14	Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set.

Baseline Candidate 0.9.2 Update

Version	Date	Description
0.9.2	2026-05-14	Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage.

4.0 KiB Raw Blame History