tegwick
d63f8b27e7
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c
35 lines
1.7 KiB
Markdown
35 lines
1.7 KiB
Markdown
# RMGR-WP-0011 production SBOM Nexus client proof
|
|
|
|
Date: 2026-08-31
|
|
|
|
The owning coordination workplan `CUST-WP-0064` is finished. Production SBOM
|
|
Nexus is healthy on immutable digest
|
|
`sha256:1da0f4f008643a0dec3f00bbad15f287103aa4b469577b78cfe1d67f8b3cbe31`
|
|
with migration `0002`; controlled `forgejo-archive-v1` scans and an unassisted
|
|
scheduled authoritative snapshot are evidenced by that plan.
|
|
|
|
Against a temporary operator-only port-forward to the internal Nexus Service,
|
|
Repo Manager's own command completed successfully:
|
|
|
|
```text
|
|
SBOM_NEXUS_URL=http://127.0.0.1:18010 uv run rmgr sbom source-ref \
|
|
--path . --slug repo-manager --project --confirm-authoritative
|
|
```
|
|
|
|
It resolved `coulomb/repo-manager` at exact public Forge revision
|
|
`e8e2747313f1f041062980a962466a7a39daa98d`, projected
|
|
`kind: forgejo-archive-v1` with `checkout_path: null`, and Nexus echoed the
|
|
structured source reference unchanged. The response was explicitly
|
|
`mode: authoritative-service`, `authoritative: true`,
|
|
`product_owner: sbom-nexus`, and `writes_state: true`.
|
|
|
|
The same production client read the latest-snapshot and licence-report routes.
|
|
Both returned the authoritative-service context; the fleet licence report had
|
|
19 groups and 4 direct copyleft production findings. Repo Manager's own
|
|
repository currently has no persisted snapshot (`snapshot_id: null`, zero
|
|
entries), which is truthful Nexus state rather than a local preview.
|
|
|
|
Source inspection finds SBOM behavior only in the bounded Nexus client,
|
|
controlled source-reference resolver, and deprecated local-preview delegate.
|
|
Repo Manager contains no scanner, snapshot store, freshness/catch-up policy, or
|
|
licence classifier. The temporary port-forward was stopped after the proof.
|