chanora/docs/security/dependency-and-supply-chain-report.md

Chanora Dependency and Supply Chain Report

Document status: DV meeting baseline candidate
Date: 2026-05-29
Scope: Dependency, license, advisory, and supply-chain evidence for DV review

1. Purpose

This report summarizes the current dependency and supply-chain controls visible in the repository. It is not the final DEC-012 legal sign-off.

2. Automated Controls

Control	Location	Current behavior
Rust license/advisory/bans/sources check	.github/workflows/ci.yml supply-chain job	Runs cargo deny check --workspace --all-features
Rust license inventory freshness	.github/workflows/ci.yml license-inventory job	Regenerates cargo-about inventory and diffs docs/security/license-inventory.md
Flutter license inventory freshness	.github/workflows/ci.yml flutter-license-inventory job	Runs tools/dump_flutter_licenses.sh and fails if docs/security/flutter-license-inventory.md is stale
Rust dependency lock enforcement	.github/workflows/ci.yml Rust job	Uses cargo check/test --locked
Flutter dependency resolution	.github/workflows/ci.yml Flutter job	Runs flutter pub get, analyze, and tests

3. Dependency Areas

Area	Examples from current repository	DV status
Rust workspace crates	chanora_protocol, chanora_audio, chanora_storage, chanora_diagnostics, chanora_bridge, chanora_resolver, chanora_prefetch, chanora_state, chanora_core	In workspace and covered by CI commands
Flutter app dependencies	flutter_rust_bridge, audio_session, flutter_foreground_task, package_info_plus, share_plus, shared_preferences	Covered by Flutter dependency resolution and license inventory job
Native/audio dependencies	Opus, platform audio stacks, Android/iOS audio services	Require platform build and license review evidence
Patched Rust dependency	cmake patched to a pinned git revision for Android build support	Requires DEC-032 tracking and periodic reevaluation
Pinned Android audio fork	oboe uses https://github.com/EdisonJwa/oboe-rs at a fixed revision	Removes machine-local path dependency while preserving reviewed Android callback/session fixes

4. Open Evidence Gaps

Gap	Impact	Required action
docs/security/license-inventory.md and Flutter inventory are referenced by CI but were not present in the current document listing	CI may fail or the repository may have untracked/missing inventory artifacts	Generate and commit inventories or update CI/documentation to the actual artifact location
DEC-012 remains open	Blocks public/store release	Complete legal/trademark/OSS review
Candidate CI run IDs are not recorded in release readiness	Reviewers cannot tie evidence to a specific release candidate	Attach latest passing run IDs to release-readiness record
Patched cmake dependency requires monitoring	Long-term supply-chain risk if fork remains pinned indefinitely	Reevaluate when upstream release includes the needed Android fix
audiopus_sys unmaintained advisory RUSTSEC-2026-0150 is explicitly ignored in deny.toml	Keeps current Opus path buildable but remains a supply-chain risk	Track replacement or upstream remediation before public release sign-off

5. DV Conclusion

Automated supply-chain controls are defined, but final dependency/legal approval is not complete. This supports DV documentation pass with a public-release blocker.