EdisonJwa
f1bc9a6c85
Imports the v0.9.2 documentation baseline and the bootstrap files required by docs/governance/repository-bootstrap-plan.md v0.1.0 §3, minus the justfile (added in the next commit). This commit establishes the git history for the project. All previous work lived only as filesystem state with no version control.
127 lines
4.0 KiB
Markdown
127 lines
4.0 KiB
Markdown
# Sec Dependency And Supply Chain Report V0.9.2.2.1
|
|
|
|
**Document type:** Security / Dependency and Supply Chain Report
|
|
**Version:** 0.9.2
|
|
**Status:** Baseline Candidate
|
|
**Language:** English
|
|
**Product:** Chanora
|
|
**Repo path:** `docs/security/dependency-and-supply-chain-report.md` ---
|
|
|
|
## 1. Purpose
|
|
|
|
This report records Chanora dependency inventory, license review, vulnerability review, SBOM status, and supply-chain release readiness.
|
|
|
|
## 2. Dependency Scope
|
|
|
|
| Ecosystem | In scope |
|
|
|---|---|
|
|
| Flutter / Dart | `pubspec.yaml`, transitive packages, Flutter SDK version |
|
|
| Rust | `Cargo.toml`, `Cargo.lock`, crates, features |
|
|
| Protocol library | `tsclientlib` and related crates/dependencies |
|
|
| Native audio | Platform audio libraries, native build dependencies, bindings |
|
|
| Build tooling | CI actions, build scripts, code generators |
|
|
| Packaging | Platform packaging tools and signing tools |
|
|
|
|
## 3. Required Outputs
|
|
|
|
| Output | Required before external release |
|
|
|---|---|
|
|
| Dependency inventory | Yes |
|
|
| License report | Yes |
|
|
| Vulnerability scan report | Yes |
|
|
| SBOM | Yes |
|
|
| Critical/high vulnerability disposition | Yes |
|
|
| Unknown license disposition | Yes |
|
|
| Build provenance record | Yes |
|
|
| Artifact hash record | Yes |
|
|
|
|
## 4. Dependency Inventory
|
|
|
|
| Component | Ecosystem | Version | License | Source | Risk | Notes |
|
|
|---|---|---|---|---|---|---|
|
|
| Flutter SDK | Flutter | TBD | TBD | TBD | TBD | TBD |
|
|
| Dart packages | Dart | TBD | TBD | TBD | TBD | TBD |
|
|
| Rust toolchain | Rust | TBD | TBD | TBD | TBD | TBD |
|
|
| Rust crates | Rust | TBD | TBD | TBD | TBD | TBD |
|
|
| `tsclientlib` | Rust/protocol | TBD | TBD | TBD | TBD | TBD |
|
|
| Native audio dependencies | Native | TBD | TBD | TBD | TBD | TBD |
|
|
| CI actions/tools | Build | TBD | TBD | TBD | TBD | TBD |
|
|
|
|
## 5. License Review
|
|
|
|
| License category | Policy |
|
|
|---|---|
|
|
| Permissive licenses | Generally acceptable after review |
|
|
| Copyleft licenses | Requires legal review before release |
|
|
| Unknown licenses | Release blocker until resolved |
|
|
| Proprietary dependencies | Requires explicit approval |
|
|
| Incompatible licenses | Release blocker unless removed or legal waiver approved |
|
|
|
|
## 6. Vulnerability Review
|
|
|
|
| Finding ID | Dependency | Severity | CVE / advisory | Status | Disposition |
|
|
|---|---|---|---|---|---|
|
|
| TBD | TBD | TBD | TBD | TBD | TBD |
|
|
|
|
## 7. SBOM
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| SBOM format | TBD: SPDX / CycloneDX / other |
|
|
| SBOM tool | TBD |
|
|
| SBOM file | TBD |
|
|
| SBOM generation date | TBD |
|
|
| SBOM reviewer | TBD |
|
|
|
|
## 8. Build Provenance
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| Git commit SHA | TBD |
|
|
| Git tag | TBD |
|
|
| CI pipeline ID | TBD |
|
|
| Build environment | TBD |
|
|
| Artifact hashes | TBD |
|
|
| Signing identity | TBD |
|
|
| Reproducibility status | TBD |
|
|
|
|
## 9. Release Gate
|
|
|
|
| Gate | Required result |
|
|
|---|---|
|
|
| Critical vulnerabilities | None open without approved waiver |
|
|
| High vulnerabilities | None open without approved waiver |
|
|
| Unknown licenses | None open without approved waiver |
|
|
| SBOM | Generated and archived |
|
|
| License report | Reviewed |
|
|
| Dependency report | Approved |
|
|
|
|
## 10. Approval
|
|
|
|
| Role | Name | Decision | Date |
|
|
|---|---|---|---|
|
|
| Security Reviewer | TBD | Pending | TBD |
|
|
| Legal Reviewer | TBD | Pending | TBD |
|
|
| Engineering Owner | TBD | Pending | TBD |
|
|
| Release Manager | TBD | Pending | TBD |
|
|
|
|
## 11. Change History
|
|
|
|
| Version | Date | Description |
|
|
|---|---|---|
|
|
| 0.9.0 | 2026-05-14 | Initial dependency and supply-chain report template. |
|
|
|
|
|
|
## Baseline Candidate 0.9.1 Update
|
|
|
|
| Version | Date | Description |
|
|
|---|---|---|
|
|
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
|
|
|
|
|
|
## Baseline Candidate 0.9.2 Update
|
|
|
|
| Version | Date | Description |
|
|
|---|---|---|
|
|
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
|