34 lines
1.2 KiB
Markdown
34 lines
1.2 KiB
Markdown
|
# Scope
|
||
|
|
|
||
|
|
## One-liner
|
||
|
|
|
||
|
|
SBOM Nexus captures, preserves, evaluates, and operationally refreshes
|
||
|
|
software-bill-of-materials evidence for managed repositories.
|
||
|
|
|
||
|
|
## In scope
|
||
|
|
|
||
|
|
- repository-source detection and parsing;
|
||
|
|
- immutable SBOM snapshots, entries, provenance, and history;
|
||
|
|
- latest-inventory and snapshot query APIs;
|
||
|
|
- licence inventory and qualified copyleft triage signals;
|
||
|
|
- freshness evaluation and bounded oldest-first catch-up;
|
||
|
|
- State Hub-compatible SBOM routes during migration;
|
||
|
|
- historical State Hub SBOM import and reconciliation;
|
||
|
|
- operator CLI, service packaging, tests, and operational documentation.
|
||
|
|
|
||
|
|
## Out of scope
|
||
|
|
|
||
|
|
- repository lifecycle and checkout control (Repo Manager);
|
||
|
|
- recurring scheduling (Activity Core);
|
||
|
|
- general work coordination (State Hub/hub-core/issue-core);
|
||
|
|
- artifact blob storage (Artifact Store);
|
||
|
|
- authentication policy ownership (Flex Auth);
|
||
|
|
- legal advice or a general vulnerability intelligence database;
|
||
|
|
- non-SBOM State Hub extraction.
|
||
|
|
|
||
|
|
## Current state
|
||
|
|
|
||
|
|
The repo is in its initial extraction milestone under `CUST-WP-0062` and
|
||
|
|
`SBOM-WP-0001`. State Hub compatibility and local SQLite operation are the first
|
||
|
|
vertical slice; PostgreSQL migration and production cutover remain gated work.
|