services_hardening_advisory_snapshots.v1.json (35908B)
1 { 2 "schema": "radroots.services-hardening.advisory-snapshot-decisions.v1", 3 "contract_version": 1, 4 "decision_state": "active", 5 "owner": "tools/xtask", 6 "self_test_command": "cargo xtask advisory-snapshot-self-test", 7 "platform_scope": { 8 "implementation": [ 9 "macos_aarch64" 10 ], 11 "source_gate": [ 12 "macos_aarch64" 13 ], 14 "cross_platform_promotion_owner": "step-297" 15 }, 16 "scope": { 17 "claims": [ 18 "closed_advisory_workload_inventory", 19 "exact_step_287_tool_acquisition_binding", 20 "one_external_immutable_rustsec_snapshot_per_candidate", 21 "one_bounded_nvd_only_update_per_candidate", 22 "offline_no_update_analysis", 23 "digest_time_freshness", 24 "owned_exact_expiring_suppressions", 25 "descriptor_admitted_actual_scanner_outputs", 26 "deterministic_byte_canonical_snapshot_archives" 27 ], 28 "nonclaims": [ 29 "live_rustsec_snapshot_acquisition", 30 "live_nvd_update_or_provider_access_at_step_294", 31 "scanner_or_provider_current_availability_before_step_297", 32 "candidate_or_generation_instance_created", 33 "step_314_advisory_qualification_or_pass_evidence", 34 "oss_index_or_credential_authority", 35 "cross_platform_runtime_promotion_before_step_297", 36 "artifact_nix_oci_signing_notarization_publication_deployment_or_production_qualification" 37 ] 38 }, 39 "tool_binding": { 40 "authority": "exact_full_step_287_tool_acquisition_objects", 41 "required_ids": [ 42 "cargo_audit", 43 "owasp_dependency_check", 44 "java", 45 "gradle_wrapper" 46 ], 47 "comparison": "parse_the_complete_structured_row_require_exact_equality_then_digest_canonical_compact_utf8_json", 48 "free_digest_without_parsed_row": "reject", 49 "availability": "must_be_observed_and_bound_by_the_step_297_generation_scoped_tool_manifest_before_live_use", 50 "live_observation_authority": "exact_radroots_services_hardening_rshr_200_tool_observation_v1_rows_from_the_step_297_generation_scoped_tool_manifest_and_fresh_advisory_lane_observation", 51 "live_observation_binding": "candidate_generation_tool_manifest_snapshot_sha256_platform_observation_sha256_producer_request_sha256_and_canonical_ordered_required_tool_rows", 52 "copied_pin_or_observation_fields_without_the_resolved_manifest_and_observation_digests": "reject", 53 "tool_review_maximum_age_seconds": 86400, 54 "path_only_or_version_only_admission": "reject" 55 }, 56 "tool_acquisition": { 57 "cargo_audit": { 58 "distribution": "governed_binary", 59 "id": "cargo_audit", 60 "platform": [ 61 { 62 "executable_name": "cargo-audit", 63 "executable_resolution": "path_lookup", 64 "id": "macos_aarch64", 65 "normalized_version": "0.22.1", 66 "package_name": "cargo-audit", 67 "package_receipt_kind": "cargo_install_identity_projection_canonical_json_v1", 68 "package_receipt_projection": { 69 "acquisition_source_sha256": "2f4e27b0ab2d116c87c29db159ad42565cdcdccf77eb62ef0486ddd017a02da6", 70 "executable_sha256": "c5cd7c0da8a9d0dff338aa1a2a30b0c723fde8201c23481f49e75be0bb77fe74", 71 "identity": { 72 "cargo_crates_entry": { 73 "binaries": [ 74 "cargo-audit" 75 ], 76 "package": "cargo-audit", 77 "source": "registry+https://github.com/rust-lang/crates.io-index", 78 "version": "0.22.1" 79 }, 80 "crate_archive_exact_bytes_sha256": "2f4e27b0ab2d116c87c29db159ad42565cdcdccf77eb62ef0486ddd017a02da6" 81 }, 82 "kind": "cargo_install_identity_projection_canonical_json_v1", 83 "normalized_version": "0.22.1", 84 "package_name": "cargo-audit", 85 "platform": "macos_aarch64", 86 "provider": "pinned_archive", 87 "resolver_executable_name": "none", 88 "resolver_executable_sha256": "none", 89 "schema": "radroots.services-hardening.rshr-200-package-receipt-projection.v1", 90 "selected_executable": { 91 "exact_bytes_sha256": "c5cd7c0da8a9d0dff338aa1a2a30b0c723fde8201c23481f49e75be0bb77fe74", 92 "mode": "100755", 93 "path": "bin/cargo-audit" 94 } 95 }, 96 "package_receipt_sha256": "74196dcade966311e535813d2e3bda2f9515186c700f3074acdc2849abce1303", 97 "platform_image_sha256": "none", 98 "provider": "pinned_archive", 99 "repository": "none", 100 "repository_relative_path": "none", 101 "source_digest_kind": "source_artifact_exact_bytes_v1", 102 "source_identity": "cargo-audit", 103 "source_identity_projection": "source_locator_exact_artifact_bytes", 104 "source_locator": "https://static.crates.io/crates/cargo-audit/cargo-audit-0.22.1.crate", 105 "source_revision": "none", 106 "source_sha256": "2f4e27b0ab2d116c87c29db159ad42565cdcdccf77eb62ef0486ddd017a02da6", 107 "source_tree": "none", 108 "source_version": "0.22.1", 109 "version_argv": [ 110 "--version" 111 ], 112 "version_parser": "cargo_audit_version_v1", 113 "version_relation": "source_version_equals_normalized_version", 114 "version_stream": "stdout" 115 } 116 ], 117 "required_lane": [ 118 "advisory", 119 "aggregate" 120 ], 121 "resolution": "exact_name_path_source_digest_and_version_output", 122 "resolution_authority": "candidate-tool-contract", 123 "role": "advisory" 124 }, 125 "owasp_dependency_check": { 126 "distribution": "governed_binary", 127 "id": "owasp_dependency_check", 128 "platform": [ 129 { 130 "executable_name": "dependency-check", 131 "executable_resolution": "path_lookup", 132 "id": "macos_aarch64", 133 "normalized_version": "12.2.2", 134 "package_name": "dependency-check", 135 "package_receipt_kind": "archive_tree_identity_projection_canonical_json_v1", 136 "package_receipt_projection": { 137 "acquisition_source_sha256": "bf07fefd81af3094c5f6850423b014df44db62ce2dbad0f79079a90df675e44a", 138 "executable_sha256": "d683a49ec335eeca93d8707f3e8ce21d7ba63a1e619a325c6518f89c25efcdc4", 139 "identity": { 140 "archive_exact_bytes_sha256": "bf07fefd81af3094c5f6850423b014df44db62ce2dbad0f79079a90df675e44a", 141 "tree_projection": { 142 "canonical_json_sha256": "d1d4022193b0677fd200eb4d7b34842313a97e4d70ce0c2ce26928b784687790", 143 "canonicalization": "canonical_compact_utf8_json_sorted_keys_no_lf_array_entries_bytewise_ascii_path_order_resolved_root_relative_link_target_v1", 144 "entry_count": 86, 145 "entry_schema": "radroots.services-hardening.archive-tree-entry.v1", 146 "max_entry_count": 100000, 147 "max_member_uncompressed_bytes": 1073741824, 148 "max_total_uncompressed_bytes": 8589934592, 149 "schema": "radroots.services-hardening.archive-tree-entry-projection.v1", 150 "total_uncompressed_bytes": 32444859 151 } 152 }, 153 "kind": "archive_tree_identity_projection_canonical_json_v1", 154 "normalized_version": "12.2.2", 155 "package_name": "dependency-check", 156 "platform": "macos_aarch64", 157 "provider": "pinned_archive", 158 "resolver_executable_name": "none", 159 "resolver_executable_sha256": "none", 160 "schema": "radroots.services-hardening.rshr-200-package-receipt-projection.v1", 161 "selected_executable": { 162 "exact_bytes_sha256": "d683a49ec335eeca93d8707f3e8ce21d7ba63a1e619a325c6518f89c25efcdc4", 163 "mode": "100755", 164 "path": "bin/dependency-check" 165 } 166 }, 167 "package_receipt_sha256": "83d9a668179fb5e9ad6fd5c625a9ab58b8371a6d32b59808fc8d2973957f54a2", 168 "platform_image_sha256": "none", 169 "provider": "pinned_archive", 170 "repository": "none", 171 "repository_relative_path": "none", 172 "source_digest_kind": "source_artifact_exact_bytes_v1", 173 "source_identity": "dependency-check", 174 "source_identity_projection": "source_locator_exact_artifact_bytes", 175 "source_locator": "https://github.com/dependency-check/DependencyCheck/releases/download/v12.2.2/dependency-check-12.2.2-release.zip", 176 "source_revision": "none", 177 "source_sha256": "bf07fefd81af3094c5f6850423b014df44db62ce2dbad0f79079a90df675e44a", 178 "source_tree": "none", 179 "source_version": "12.2.2", 180 "version_argv": [ 181 "--version" 182 ], 183 "version_parser": "owasp_dependency_check_version_v1", 184 "version_relation": "source_version_equals_normalized_version", 185 "version_stream": "stdout" 186 } 187 ], 188 "required_lane": [ 189 "advisory", 190 "aggregate" 191 ], 192 "resolution": "exact_name_path_source_digest_and_version_output", 193 "resolution_authority": "candidate-tool-contract", 194 "role": "advisory" 195 }, 196 "java": { 197 "distribution": "governed_binary", 198 "id": "java", 199 "platform": [ 200 { 201 "executable_name": "java", 202 "executable_resolution": "path_lookup", 203 "id": "macos_aarch64", 204 "normalized_version": "21.0.12.1", 205 "package_name": "net.temurin.21.jdk", 206 "package_receipt_kind": "apple_pkgutil_identity_projection_canonical_json_v1", 207 "package_receipt_projection": { 208 "acquisition_source_sha256": "575bb8d9d604821d8f350325b28a35e49bcffd7ec33727b41edc8d709537dada", 209 "executable_sha256": "9be1d0a740ff6502df1a762145e62860f5de4b7e17658d9cb9498da3acf9d16c", 210 "identity": { 211 "pkg_info": { 212 "install_location": "", 213 "pkg_version": "21.0.12.1+1-LTS", 214 "pkgid": "net.temurin.21.jdk", 215 "receipt_plist_version": 1, 216 "volume": "/" 217 }, 218 "pkgutil_files_lc_all_c_stdout_exact_bytes_sha256": "4d176bdae561efa1653174389a961a798e67b208105268ccfefb6494f1f3bb15" 219 }, 220 "kind": "apple_pkgutil_identity_projection_canonical_json_v1", 221 "normalized_version": "21.0.12.1", 222 "package_name": "net.temurin.21.jdk", 223 "platform": "macos_aarch64", 224 "provider": "pinned_archive", 225 "resolver_executable_name": "none", 226 "resolver_executable_sha256": "none", 227 "schema": "radroots.services-hardening.rshr-200-package-receipt-projection.v1", 228 "selected_executable": { 229 "exact_bytes_sha256": "9be1d0a740ff6502df1a762145e62860f5de4b7e17658d9cb9498da3acf9d16c", 230 "mode": "100755", 231 "path": "bin/java" 232 } 233 }, 234 "package_receipt_sha256": "e7018157655e26443392ace45967e427aafa1dd98e2e67f94bdd04267d1d9296", 235 "platform_image_sha256": "none", 236 "provider": "pinned_archive", 237 "repository": "none", 238 "repository_relative_path": "none", 239 "source_digest_kind": "source_artifact_exact_bytes_v1", 240 "source_identity": "net.temurin.21.jdk", 241 "source_identity_projection": "source_locator_exact_artifact_bytes", 242 "source_locator": "https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-jdk_aarch64_mac_hotspot_21.0.12.1_1.pkg", 243 "source_revision": "none", 244 "source_sha256": "575bb8d9d604821d8f350325b28a35e49bcffd7ec33727b41edc8d709537dada", 245 "source_tree": "none", 246 "source_version": "21.0.12.1", 247 "version_argv": [ 248 "-version" 249 ], 250 "version_parser": "java_version_v1", 251 "version_relation": "source_version_equals_normalized_version", 252 "version_stream": "stderr" 253 } 254 ], 255 "required_lane": [ 256 "advisory", 257 "macos_artifacts", 258 "package_install", 259 "release_evidence", 260 "reproducibility", 261 "aggregate" 262 ], 263 "resolution": "exact_name_path_source_digest_and_version_output", 264 "resolution_authority": "candidate-tool-contract", 265 "role": "runtime" 266 }, 267 "gradle_wrapper": { 268 "distribution": "gradle_wrapper", 269 "id": "gradle_wrapper", 270 "platform": [ 271 { 272 "executable_name": "gradlew", 273 "executable_resolution": "repository_relative", 274 "id": "macos_aarch64", 275 "normalized_version": "9.5.0", 276 "package_name": "gradle", 277 "package_receipt_kind": "gradle_distribution_identity_projection_canonical_json_v1", 278 "package_receipt_projection": { 279 "acquisition_source_sha256": "553c78f50dafcd54d65b9a444649057857469edf836431389695608536d6b746", 280 "executable_sha256": "ab5c0cad16305af2e619c159c1f58dd68d07fab9c11e36701e109c0277407f7a", 281 "identity": { 282 "distribution_archive_exact_bytes_sha256": "553c78f50dafcd54d65b9a444649057857469edf836431389695608536d6b746", 283 "wrapper_jar_exact_bytes_sha256": "497c8c2a7e5031f6aa847f88104aa80a93532ec32ee17bdb8d1d2f67a194a9c7" 284 }, 285 "kind": "gradle_distribution_identity_projection_canonical_json_v1", 286 "normalized_version": "9.5.0", 287 "package_name": "gradle", 288 "platform": "macos_aarch64", 289 "provider": "gradle_distribution", 290 "resolver_executable_name": "none", 291 "resolver_executable_sha256": "none", 292 "schema": "radroots.services-hardening.rshr-200-package-receipt-projection.v1", 293 "selected_executable": { 294 "exact_bytes_sha256": "ab5c0cad16305af2e619c159c1f58dd68d07fab9c11e36701e109c0277407f7a", 295 "mode": "100755", 296 "path": "bin/gradlew" 297 } 298 }, 299 "package_receipt_sha256": "a6538aaef9f5e2510cf4bbfe6d560e64ae4065e64a5c8ba0807d7448f6a89610", 300 "platform_image_sha256": "none", 301 "provider": "gradle_distribution", 302 "repository": "oss/harvestcircle", 303 "repository_relative_path": "gradlew", 304 "source_digest_kind": "source_artifact_exact_bytes_v1", 305 "source_identity": "gradle", 306 "source_identity_projection": "source_locator_exact_artifact_bytes", 307 "source_locator": "https://services.gradle.org/distributions/gradle-9.5.0-bin.zip", 308 "source_revision": "none", 309 "source_sha256": "553c78f50dafcd54d65b9a444649057857469edf836431389695608536d6b746", 310 "source_tree": "none", 311 "source_version": "9.5.0", 312 "version_argv": [ 313 "--version" 314 ], 315 "version_parser": "gradle_wrapper_version_v1", 316 "version_relation": "source_version_equals_normalized_version", 317 "version_stream": "stdout" 318 } 319 ], 320 "required_lane": [ 321 "advisory", 322 "macos_artifacts", 323 "package_install", 324 "release_evidence", 325 "reproducibility", 326 "aggregate" 327 ], 328 "resolution": "exact_name_path_source_digest_and_version_output", 329 "resolution_authority": "gradle-wrapper-lock", 330 "role": "build" 331 } 332 }, 333 "workload_inventory": { 334 "ordering": "cargo_then_gradle_kotlin_within_each_class_exact_list_order", 335 "completeness": "exact_presence_unique_no_unexpected_no_reordered_and_every_workload_emits_one_result_even_when_zero_findings", 336 "per_workload_input_binding": "candidate_source_identity_exact_dependency_input_bytes_and_sha256_dependency_count_scanner_argv_and_raw_report_bytes_and_sha256", 337 "cargo": [ 338 { 339 "id": "cli", 340 "repository": "oss/cli", 341 "workdir": ".", 342 "manifest_path": "Cargo.toml", 343 "lockfile_path": "Cargo.lock" 344 }, 345 { 346 "id": "harvest_core", 347 "repository": "oss/harvestcircle", 348 "workdir": "core", 349 "manifest_path": "core/Cargo.toml", 350 "lockfile_path": "core/Cargo.lock" 351 }, 352 { 353 "id": "harvest_xtask", 354 "repository": "oss/harvestcircle", 355 "workdir": "tools/xtask", 356 "manifest_path": "tools/xtask/Cargo.toml", 357 "lockfile_path": "tools/xtask/Cargo.lock" 358 }, 359 { 360 "id": "ios_ffi", 361 "repository": "oss/ios_app", 362 "workdir": "RadrootsFFI", 363 "manifest_path": "Cargo.toml", 364 "lockfile_path": "Cargo.lock" 365 }, 366 { 367 "id": "lib", 368 "repository": "oss/lib", 369 "workdir": ".", 370 "manifest_path": "Cargo.toml", 371 "lockfile_path": "Cargo.lock" 372 }, 373 { 374 "id": "myc", 375 "repository": "oss/myc", 376 "workdir": ".", 377 "manifest_path": "Cargo.toml", 378 "lockfile_path": "Cargo.lock" 379 }, 380 { 381 "id": "radrootsd", 382 "repository": "oss/radrootsd", 383 "workdir": ".", 384 "manifest_path": "Cargo.toml", 385 "lockfile_path": "Cargo.lock" 386 }, 387 { 388 "id": "rhi", 389 "repository": "oss/rhi", 390 "workdir": ".", 391 "manifest_path": "Cargo.toml", 392 "lockfile_path": "Cargo.lock" 393 }, 394 { 395 "id": "root", 396 "repository": "_radroots", 397 "workdir": ".", 398 "manifest_path": "Cargo.toml", 399 "lockfile_path": "Cargo.lock" 400 }, 401 { 402 "id": "sdk", 403 "repository": "oss/sdk", 404 "workdir": ".", 405 "manifest_path": "Cargo.toml", 406 "lockfile_path": "Cargo.lock" 407 } 408 ], 409 "gradle_kotlin": [ 410 { 411 "id": "app_design_system", 412 "repository": "oss/harvestcircle", 413 "build_root": ".", 414 "project_path": ":app:design_system", 415 "configuration": "desktopRuntimeClasspath" 416 }, 417 { 418 "id": "app_desktop", 419 "repository": "oss/harvestcircle", 420 "build_root": ".", 421 "project_path": ":app:desktop", 422 "configuration": "runtimeClasspath" 423 }, 424 { 425 "id": "app_shared", 426 "repository": "oss/harvestcircle", 427 "build_root": ".", 428 "project_path": ":app:shared", 429 "configuration": "desktopRuntimeClasspath" 430 }, 431 { 432 "id": "tools_design_catalog", 433 "repository": "oss/harvestcircle", 434 "build_root": ".", 435 "project_path": ":tools:design_catalog", 436 "configuration": "desktopRuntimeClasspath" 437 }, 438 { 439 "id": "build_logic_contracts", 440 "repository": "oss/harvestcircle", 441 "build_root": "build-logic", 442 "project_path": ":contracts", 443 "configuration": "runtimeClasspath" 444 }, 445 { 446 "id": "build_logic_plugins", 447 "repository": "oss/harvestcircle", 448 "build_root": "build-logic", 449 "project_path": ":plugins", 450 "configuration": "runtimeClasspath" 451 } 452 ] 453 }, 454 "gradle_dependency_graph": { 455 "projection_count": 6, 456 "projection_order": "exact_workload_inventory_gradle_kotlin_order", 457 "projection_owner": "tools_xtask_decision_bound_ephemeral_gradle_init_script", 458 "init_script_identity": "exact_embedded_utf8_bytes_sha256_4c51de29877813dd679c970507602940fdf8c38a586f8d2f6d101b6a93a8b598_compiled_into_the_step_294_implementation_and_bound_into_every_projection_input_digest", 459 "init_script_lifecycle": "materialize_create_new_0600_in_a_fresh_private_directory_read_with_evidence_before_invocation_and_revalidate_after_use", 460 "init_script_authority": "read_only_resolution_and_projection_only_no_repository_source_or_build_script_mutation", 461 "wrapper_tool_id": "gradle_wrapper", 462 "runner": "step_292_bounded_process_runner", 463 "execution": "sequential_one_module_configuration_per_invocation_no_parallel_full_graphs", 464 "working_directory": "exact_retained_candidate_oss_harvestcircle_repository_root_with_pre_and_post_entry_count_and_tree_digest_equality", 465 "argv_template": [ 466 "--offline", 467 "--no-daemon", 468 "--no-parallel", 469 "--no-configuration-cache", 470 "--project-dir", 471 "{exact_build_root}", 472 "--init-script", 473 "{private_evidenced_init_script}", 474 "{exact_project_path}:rshrAdvisoryGraph", 475 "-PrshrAdvisoryConfiguration={exact_configuration}", 476 "-PrshrAdvisoryOutput={private_create_new_projection}" 477 ], 478 "gradle_state": "fresh_private_gradle_user_home_seeded_only_from_digest_verified_governed_wrapper_and_dependency_cache_inputs_with_network_disabled_and_no_ambient_user_or_project_cache_admitted", 479 "environment": "replace_allowlist_with_private_gradle_user_home_java_home_locale_timezone_tmpdir_and_step_292_required_process_fields", 480 "configuration_selection": "exact_named_configuration_from_the_workload_row_exists_is_resolvable_and_no_other_configuration_is_resolved", 481 "unresolved_component_or_artifact": "nonpass_without_partial_projection", 482 "graph_completeness": "resolution_root_all_selected_components_all_dependency_edges_all_resolved_artifacts_and_one_explicit_project_root_row_even_when_the_external_artifact_set_is_empty", 483 "component_identity": "canonical_module_group_name_version_or_build_root_and_project_path_with_selected_variant_attributes_no_display_string_as_sole_identity", 484 "artifact_identity": "component_identity_artifact_name_artifact_type_classifier_byte_length_and_sha256_from_the_exact_safely_read_bytes", 485 "canonical_projection": "canonical_compact_utf8_json_sorted_keys_with_components_edges_and_artifacts_each_sorted_by_their_complete_identity_and_no_host_paths", 486 "raw_projection_maximum_bytes_each": 8388608, 487 "artifact_source_roots": "each_source_path_is_descriptor_resolved_relative_to_exactly_one_governed_candidate_build_output_or_seed_cache_root_and_each_root_role_and_opaque_identity_digest_is_bound_into_the_projection_input_and_normalization_receipt", 488 "input_digest": "domain_separated_sha256_of_candidate_generation_harvest_source_revision_and_tree_workload_row_init_script_sha256_wrapper_tool_manifest_row_fresh_wrapper_observation_gradle_dependency_control_snapshot_and_seed_cache_inventory", 489 "result_digest": "sha256_of_the_exact_canonical_projection_bytes_observed_through_step_293_evidenced_io", 490 "scan_materialization": "fresh_private_create_new_projection_with_one_regular_file_per_resolved_artifact_named_by_lowercase_sha256_plus_validated_original_extension_and_revalidated_against_the_canonical_graph", 491 "scan_materialization_duplicates": "identical_digest_and_extension_coalesce_only_when_all_bound_artifact_identities_are_retained_in_the_graph_every_other_collision_is_nonpass", 492 "odc_scan_count": "exactly_one_per_projection_in_exact_projection_order", 493 "odc_nvd_state": "one_unique_fresh_private_materialized_copy_per_scan_with_source_pre_scan_and_post_scan_tree_digests_equal_to_the_single_accepted_candidate_nvd_snapshot", 494 "odc_argv_template": [ 495 "--noupdate", 496 "--data", 497 "{private_materialized_nvd_snapshot}", 498 "--scan", 499 "{private_materialized_graph_projection}", 500 "--project", 501 "{exact_workload_id}", 502 "--format", 503 "JSON", 504 "--out", 505 "{private_create_new_report}", 506 "--disableKnownExploited", 507 "--disableRetireJs", 508 "--disableHostedSuppressions", 509 "--disableVersionCheck", 510 "--disableOssIndex", 511 "--disableCentral", 512 "--disableNodeAudit", 513 "--disableYarnAudit", 514 "--disablePnpmAudit" 515 ], 516 "result_binding": "one_complete_dependency_check_12_2_2_json_report_per_workload_even_with_zero_findings_bound_to_candidate_generation_workload_input_digest_graph_digest_nvd_digest_exact_argv_exit_status_process_evidence_report_byte_length_and_report_sha256", 517 "private_provider_evidence": "actual_raw_scanner_report_bytes_and_exact_argv_may_retain_attempt_local_absolute_paths_inside_access_controlled_candidate_evidence_so_the_output_file_and_argument_bindings_remain_independently_verifiable", 518 "normalized_outputs": "finding_inventory_result_digests_and_diagnostics_are_path_free_and_credential_free" 519 }, 520 "snapshot_model": { 521 "providers": [ 522 "rustsec", 523 "owasp_nvd" 524 ], 525 "accepted_snapshots_per_provider_per_candidate": 1, 526 "source_admission": "one_exact_bounded_traversal_snapshot_retained_while_every_member_is_read_with_read_evidenced_then_final_revalidation", 527 "evidence_origin": "byte_length_and_sha256_are_computed_from_the_exact_bytes_actually_read_not_accepted_from_caller_fields", 528 "archive_encoding": "deterministic_single_member_gzip_of_canonical_tar", 529 "archive_member_order": "raw_relative_path_bytes_ascending", 530 "archive_metadata": "mtime_zero_uid_zero_gid_zero_uname_empty_gname_empty_directories_0755_files_0644", 531 "archive_admission": "step_293_descriptor_bound_parser_plus_step_294_deterministic_header_member_order_and_full_byte_reencoding_equality_before_snapshot_acceptance", 532 "archive_evidence": "compressed_length_sha256_expanded_length_member_count_and_payload_length_from_the_admitted_bytes_plus_exact_reencoded_compressed_length_and_sha256_equality", 533 "archive_reencoding_backend": { 534 "compression_level": 6, 535 "flate2": "1.1.9", 536 "flate2_checksum": "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c", 537 "miniz_oxide": "0.8.9", 538 "miniz_oxide_checksum": "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316", 539 "golden_fixture_byte_length": 147, 540 "golden_fixture_sha256": "6073c70a98ff9ab610085ed74b7886811da3fe64e9ec2771464300a94befd0fb" 541 }, 542 "archive_materialization": "fresh_private_0700_directory_create_new_0644_members_descriptor_bound_to_the_archive_and_parent_then_exact_membership_and_tree_revalidated_before_and_after_scanner_use", 543 "creation": "create_new_only_no_overwrite_no_rollback_and_failed_output_is_untrusted", 544 "immutability": "snapshot_identity_and_digest_are_fixed_once_adopted_and_every_later_use_revalidates_the_exact_snapshot", 545 "temporal_order": "acquisition_completion_epoch_less_than_or_equal_to_digest_finalization_epoch_less_than_or_equal_to_analysis_completion_epoch_less_than_or_equal_to_evaluation_epoch", 546 "logical_storage": "digest_addressed_normalized_identity_without_host_paths_while_access_controlled_raw_provider_evidence_retains_the_actual_report_and_argument_bindings", 547 "logical_uri_template": "extbuild-cas://sha256/{sha256}", 548 "logical_reference_fields": [ 549 "logical_uri", 550 "sha256", 551 "size_bytes", 552 "media_type", 553 "logical_role" 554 ], 555 "logical_reference_validation": "uri_digest_equals_sha256_and_resolved_exact_bytes_size_and_digest_are_revalidated_under_the_step_286_cas_policy" 556 }, 557 "rustsec": { 558 "provider": "rustsec", 559 "snapshot_acquisition": "external_to_cargo_audit_then_boundedly_admitted_as_one_immutable_candidate_snapshot", 560 "scanner_network_actions": 0, 561 "analysis_tool_id": "cargo_audit", 562 "analysis_count": "exactly_once_for_each_of_the_ten_cargo_workloads", 563 "analysis_network": "disabled", 564 "analysis_working_directory": "fresh_empty_config_free_directory", 565 "analysis_home": "fresh_empty_directory", 566 "analysis_cargo_home": "fresh_empty_directory", 567 "analysis_argv_policy": [ 568 "audit", 569 "--db", 570 "exact_snapshot_directory", 571 "--no-fetch", 572 "--json", 573 "--file", 574 "exact_workload_lockfile" 575 ], 576 "fetch_or_update_arguments": "forbidden", 577 "yanked_registry_policy": "no_registry_network_or_update_no_ambient_cached_registry_index_admitted_and_no_yanked_result_accepted_the_pinned_tool_has_no_no_yank_argument", 578 "informational_warning_policy": "complete_notice_unmaintained_and_unsound_rows_are_governed_findings_and_require_the_same_exact_suppression_decision_as_vulnerabilities", 579 "exit_status_policy": "zero_or_one_with_complete_valid_json_is_report_bearing_and_findings_are_evaluated_after_parse_all_other_statuses_are_nonpass", 580 "report_parsing": "bounded_strict_complete_cargo_audit_0_22_1_json_from_the_actual_captured_stdout_per_workload_no_caller_normalized_clean_wrapper", 581 "report_input_binding": "each_raw_report_binds_the_exact_workload_id_lockfile_sha256_dependency_count_database_identity_scanner_argv_exit_status_byte_length_and_sha256", 582 "raw_output_admission": "actual_stdout_is_written_create_new_0600_in_a_fresh_private_directory_then_admitted_as_the_only_regular_file_read_with_descriptor_evidence_and_revalidated_before_parse_after_parse_and_before_final_acceptance", 583 "known_vulnerability": "nonpass_unless_one_active_exact_owned_suppression_matches", 584 "non_waivable_advisory_ids": [ 585 "RUSTSEC-2026-0253" 586 ] 587 }, 588 "owasp_dependency_check_nvd": { 589 "provider": "owasp_nvd", 590 "update_tool_id": "owasp_dependency_check", 591 "runtime_tool_id": "java", 592 "gradle_tool_id": "gradle_wrapper", 593 "update_count_per_candidate": 1, 594 "update_operation": "bounded_dependency_check_updateonly_into_a_new_private_directory", 595 "update_argv_template": [ 596 "--updateonly", 597 "--data", 598 "{private_create_new_nvd_staging_directory}", 599 "--disableKnownExploited", 600 "--disableRetireJs", 601 "--disableHostedSuppressions", 602 "--disableVersionCheck", 603 "--disableOssIndex", 604 "--disableCentral", 605 "--disableNodeAudit", 606 "--disableYarnAudit", 607 "--disablePnpmAudit" 608 ], 609 "update_provider_allowlist": [ 610 "nvd" 611 ], 612 "update_endpoint_allowlist": [ 613 "https://services.nvd.nist.gov/rest/json/cves/2.0" 614 ], 615 "update_http_methods": [ 616 "GET" 617 ], 618 "non_nvd_updates": "disabled_and_rejected", 619 "update_network": "contracted_fetch_only", 620 "update_network_trace": "complete_canonical_bounded_request_response_trace_with_exact_enforcement_program_and_configuration_digests_proves_only_sequential_get_requests_to_the_exact_nvd_https_endpoint_with_clear_nonsecret_query_values_contiguous_pagination_and_response_metadata_then_is_digest_bound_without_credentials_or_response_bodies", 621 "update_network_trace_limits": { 622 "maximum_requests": 1024, 623 "maximum_response_bytes_each": 67108864, 624 "maximum_response_bytes_aggregate": 536870912, 625 "maximum_trace_bytes": 16777216 626 }, 627 "credential_environment": "absent", 628 "partial_or_failed_update": "untrusted_nonpass_and_never_adopted", 629 "analysis_count": "exactly_once_for_each_of_the_six_gradle_kotlin_modules", 630 "analysis_network": "disabled", 631 "analysis_update_mode": "no_update", 632 "gradle_network_mode": "offline", 633 "gradle_auto_update": false, 634 "analysis_failure_threshold_arguments": "forbidden_including_fail_on_cvss", 635 "exit_status_policy": "zero_with_complete_valid_json_is_report_bearing_and_findings_are_evaluated_after_parse_every_nonzero_status_is_nonpass", 636 "report_parsing": "bounded_strict_complete_dependency_check_12_2_2_json_from_the_actual_evidenced_output_file_per_workload_no_caller_normalized_clean_wrapper_and_vulnerability_ids_are_matched_software_identifiers_consistent_with_parsed_vulnerable_software_not_advisory_ids", 637 "report_input_binding": "each_raw_report_binds_the_exact_workload_id_dependency_graph_input_sha256_dependency_count_nvd_database_identity_scanner_argv_exit_status_byte_length_and_sha256", 638 "report_template_binding": { 639 "distribution_package_receipt_sha256": "83d9a668179fb5e9ad6fd5c625a9ab58b8371a6d32b59808fc8d2973957f54a2", 640 "dependency_check_core_jar_relative_identity": "dependency-check-core-12.2.2.jar", 641 "dependency_check_core_jar_sha256": "1ebe55e542b2f4d2727380395843922381447dc8b9a4f1633e77096f47ebfb48", 642 "template_member": "templates/jsonReport.vsl", 643 "template_member_byte_length": 34639, 644 "template_member_sha256": "35881409102304d5a91d08566c1d0fda6fa5f9ec8810994fcdd5106aed3729b5", 645 "parser": "strict_exact_schema_for_report_scan_project_dependency_evidence_identifier_related_dependency_vulnerability_cvss_reference_and_vulnerable_software_objects_with_unknown_fields_rejected" 646 }, 647 "raw_output_admission": "actual_output_file_is_create_new_0600_in_a_fresh_private_directory_then_admitted_as_the_only_regular_file_read_with_descriptor_evidence_and_revalidated_before_parse_after_parse_and_before_final_acceptance", 648 "known_vulnerability": "nonpass_unless_one_active_exact_owned_suppression_matches" 649 }, 650 "bounded_execution": { 651 "runner": "step_292_bounded_process_runner", 652 "environment": "replace_with_explicit_allowlist", 653 "stdin": "closed", 654 "deadline_clock": "monotonic", 655 "maximum_concurrent_top_level_operations": 1, 656 "required_process_receipts": 23, 657 "maximum_command_seconds": 3600, 658 "maximum_stdout_bytes": 67108864, 659 "maximum_stderr_bytes": 67108864, 660 "timeout_unavailable_interrupted_or_unparseable": "nonpass_without_fallback", 661 "exit_status_interpretation": "provider_specific_and_never_substitutes_for_complete_report_parsing", 662 "working_directories": "unique_opaque_identity_per_operation_with_kind_logical_uri_pre_and_post_entry_counts_and_tree_digests_cargo_audit_empty_config_free_gradle_retained_candidate_source_nvd_update_fresh_then_nonempty_and_odc_analysis_fresh_empty", 663 "environment_evidence": "exact_ordered_name_and_logical_role_allowlist_with_sha256_of_each_actual_replacement_value_fixed_C_and_UTC_values_shared_pinned_java_and_path_values_and_unique_private_roots_no_ambient_inheritance", 664 "authority_byte_limits": { 665 "snapshot_manifest": 67108864, 666 "producer_request": 1048576, 667 "tool_manifest": 16777216, 668 "tool_observation": 4194304, 669 "provider_execution_evidence": 67108864, 670 "raw_scanner_output_each": 33554432 671 } 672 }, 673 "freshness": { 674 "clock": "caller_supplied_positive_utc_epoch_seconds", 675 "snapshot_time": "provider_digest_finalization_epoch_bound_to_the_accepted_snapshot_digest", 676 "future_snapshot_time": "reject", 677 "age_arithmetic": "checked_nonnegative_seconds", 678 "qualification_maximum_age_seconds": 86400, 679 "development_reuse_maximum_age_seconds": 604800, 680 "boundary": "fresh_when_age_is_less_than_or_equal_to_the_selected_maximum", 681 "providers_evaluated_independently": true, 682 "stale_or_missing_provider": "nonpass" 683 }, 684 "suppressions": { 685 "inventory": "canonical_ordered_exact_rows_bound_into_the_candidate_advisory_input_digest", 686 "required_fields": [ 687 "id", 688 "provider", 689 "advisory_id", 690 "workload_id", 691 "package_ecosystem", 692 "package_namespace", 693 "package_name", 694 "package_version", 695 "owner", 696 "rationale", 697 "created_at_epoch", 698 "expires_at_epoch" 699 ], 700 "matching": "one_row_matches_one_finding_only_when_provider_advisory_id_workload_id_package_ecosystem_package_namespace_package_name_and_package_version_are_all_exact", 701 "wildcards_ranges_regex_and_lexical_patterns": "forbidden", 702 "owner_and_rationale": "nonempty_bounded_safe_text", 703 "expiry": "active_only_when_evaluation_epoch_is_strictly_less_than_expires_at_epoch", 704 "expiry_equality": "expired", 705 "future_creation_time": "reject", 706 "unused_duplicate_ambiguous_or_unknown_rows": "nonpass", 707 "non_waivable_advisory_ids": [ 708 "RUSTSEC-2026-0253" 709 ], 710 "non_waivable_match": "reject_even_when_a_suppression_row_is_otherwise_exact" 711 }, 712 "result_model": { 713 "pass": "both_provider_snapshots_fresh_all_sixteen_workloads_present_in_exact_order_all_scans_completed_and_every_finding_is_absent_or_exactly_suppressed", 714 "unavailable": "nonpass", 715 "timeout": "nonpass", 716 "stale": "nonpass", 717 "missing_duplicate_unexpected_or_reordered_inventory": "nonpass", 718 "unknown_scanner_fields_or_malformed_reports": "nonpass", 719 "diagnostics": "stable_bounded_path_free_member_free_source_free_and_credential_free_while_raw_access_controlled_provider_evidence_remains_separate" 720 }, 721 "required_vectors": [ 722 "known_vulnerable_fixture", 723 "missing_inventory", 724 "unavailable", 725 "stale", 726 "timeout", 727 "expired_suppression" 728 ] 729 }