tegwick
9751927d38
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 38s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118
47 lines
2 KiB
Markdown
47 lines
2 KiB
Markdown
# sbom-nexus
|
|
|
|
SBOM Nexus is the dedicated software-bill-of-materials service for the Coulomb
|
|
fleet. It captures dependency evidence from repositories, keeps immutable
|
|
snapshots, evaluates licence risk and freshness, and provides a bounded catch-up
|
|
queue for automation.
|
|
|
|
The product direction is defined in [INTENT.md](INTENT.md). The first delivery
|
|
contract is in [ProductRequirementsDocument.md](ProductRequirementsDocument.md).
|
|
|
|
## Development
|
|
|
|
```bash
|
|
uv sync --dev
|
|
uv run pytest
|
|
uv run ruff check src tests
|
|
uv run sbom-nexus serve --reload
|
|
```
|
|
|
|
The default API listens on `http://127.0.0.1:8010`. Local development uses
|
|
SQLite through `SBOM_NEXUS_DATABASE_PATH`; production uses
|
|
`SBOM_NEXUS_DATABASE_URL_FILE=/var/run/secrets/.../url` and `make migrate`.
|
|
The direct `SBOM_NEXUS_DATABASE_URL` variable remains available for disposable
|
|
development environments; mounted secret files are preferred for production.
|
|
The runtime rereads the mounted file for every new database connection and
|
|
recycles pooled connections every 300 seconds by default, configurable with
|
|
`SBOM_NEXUS_DATABASE_POOL_RECYCLE_SECONDS`.
|
|
|
|
## Initial API surface
|
|
|
|
- `GET /state/health`
|
|
- `GET /state/live`
|
|
- `PUT /repositories/{repo_slug}`
|
|
- `GET /sbom/catch-up?limit=3`
|
|
- `POST /sbom/{repo_slug}/ingest`
|
|
- State Hub-compatible `/sbom/` snapshot, entry, repository, and licence routes
|
|
|
|
Authoritative automation may ingest a controlled `forgejo-archive-v1`
|
|
`source_ref` pinned to a full commit SHA. Nexus constructs the Forgejo URL,
|
|
streams and safely extracts the archive within configured limits, records the
|
|
archive and manifest provenance, and removes the transient directory. It does
|
|
not accept arbitrary source URLs. `Idempotency-Key` is durably enforced on
|
|
repository ingest and skip operations; a matching retry replays the original
|
|
snapshot outcome and conflicting key reuse returns HTTP 409.
|
|
|
|
See [docs/state-hub-sbom-extraction-review.md](docs/state-hub-sbom-extraction-review.md)
|
|
for the extraction inventory and cutover dispositions.
|