stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 12 Releases Wiki Activity

docs: clarify sbom sample placeholders for vuln parity

Browse Source
This commit is contained in:
StellaOps Bot
2025-12-06 10:02:24 +00:00
parent 8948b1a3e2
commit 3954615e81
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/db/reports/vuln-parity-sbom-sample-20251209.md
View File

@@ -11,13 +11,12 @@ Use this list for PG-T5b.3–5b.4 parity runs (Mongo vs Postgres). Keep counts d
## SBOM sample set ## SBOM sample set
| # | SBOM path | Ecosystem | Size | Hash (SHA256) | Notes | | # | SBOM path | Ecosystem | Size | Hash (SHA256) | Notes |
|---|-----------|-----------|------|---------------|-------| |---|-----------|-----------|------|---------------|-------|
| 1 | <populate> | | | | | | 1 | docs/scripts/sbom-vex/sbom.json | npm | ~95 KB | <fill> | Deterministic compose sample used in sbom-vex proof. |
| 2 | <populate> | | | | | | 2 | <add> | go | <fill> | TODO: pick Go SBOM fixture; store under docs/db/reports/assets/vuln-parity-20251211/. |
| 3 | <populate> | | | | | | 3 | <add> | pypi | <fill> | TODO: pick Python SBOM fixture. |
| 4 | <populate> | | | | | | 4 | <add> | maven | <fill> | TODO: pick Java/Maven SBOM fixture. |
| 5 | <populate> | | | | | | 5 | <add> | rpm/deb | <fill> | TODO: pick OS package SBOM fixture (if available). |
## Determinism guardrails ## Determinism guardrails
- Do not change sample set after hashes recorded. - Do not change sample set after hashes recorded.
- Store exports under `docs/db/reports/assets/vuln-parity-20251211/` with hash manifest. - Store exports under `docs/db/reports/assets/vuln-parity-20251211/` with hash manifest.