docs(backlog): file C11 for the SBOM's missing Node runtime component - #603
Merged
Conversation
#584 closes C7 by giving SECURITY.md a hand-maintained "Bundled Node.js runtime" table, which is exactly what C7's Done-when accepted: a sibling document, or a hand-maintained component entry. The residual is the half a scanner reads. The CycloneDX document the release job generates still has no component for the runtime, and its own verify step names the three ecosystems it expects, none of which is a shell script that curls a tarball. Filed as its own entry rather than folded back into C7, because narrowing a Done-when after the work that satisfies it has landed moves a pre-committed acceptance. C7 is the contributor's to delete on #584; this is the claim that outlives it. The index line moves with it, C3-C10 7 becomes C3-C11 8, and both halves are measured against tests/unit/backlog-structure.test.ts: leaving the count at 7 fails "counts its entries", leaving the extreme at C10 fails "names the real extremes".
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Files the residual of C7, which #584 closes.
#584 gives
SECURITY.mda hand-maintained Bundled Node.js runtime table: pinned version, dist URL, the three artefact filenames, both fetch scripts, the in-repo sha256 digests, the licence, and which artefacts ship it. That is what C7's Done-when accepted, in its own words: "a sibling document" or "a hand-maintained component entry". A person reading the policy now finds the runtime.A machine still does not. The
sbomjob in.github/workflows/release-artifacts.ymlrunstrivy fs --scanners licenseover the repository, and its own verify step names the three ecosystems it expects to find:bun.lock,packaging/windows/launcher/go.modanddesktop/src-tauri/Cargo.lock. A shell script that curls a tarball is not a lockfile and appears in none of them.Filed as its own entry rather than folded back into C7 by narrowing its Done-when. That acceptance was pre-committed, and moving it after the work satisfying it has landed is moving the goalpost. C7 stays the #584 contributor's to delete.
The entry names the two seams that already exist, so it can be picked up cold: the version and digests are machine-readable in
fetch-node.shand already read by #584's drift guard, and the job already patches the generated document with Node and asserts properties of it afterwards.Verification
tests/unit/backlog-structure.test.ts: 93 pass, 0 fail.format,chart:check,readme:check,security:check,channels:showcase:check: clean.