coulomb/sbom-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
sbom-nexus/docs/evidence/SBOM-WP-0002-T05-repo-manager-handoff-2026-08-22.md
tegwick 4b497d9e7b docs: close SBOM-WP-0002 T05 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
2026-08-22 20:24:06 +02:00

1.6 KiB
Raw Blame History

SBOM-WP-0002 T05 — Repo Manager scanner handoff evidence

Date: 2026-08-22

Repo Manager commit ad0ba6f removes its duplicate SBOM scanner and leaves SBOM Nexus as the single scanner/snapshot product owner.

Changes:

  • deleted src/repo_manager/sbom.py (326 lines of parser, source detection, licence triage, and snapshot rendering);
  • replaced parser-specific tests with compatibility-delegation tests;
  • retained rmgr sbom scan and rmgr sbom licence-report as thin aliases;
  • invokes sbom-nexus directly with shell=False, discovered on PATH or via SBOM_NEXUS_CLI;
  • preserved scan output-file refusal and --force behavior;
  • pinned authority in JSON with schema=sbom-nexus.snapshot.v1, product_owner=sbom-nexus, and delegated_by=repo-manager;
  • corrected Repo Manager's earlier interim-scanner workplan/evidence and placed the direct sbom-nexus scan command first in operator documentation.

Verification:

  • Repo Manager Ruff: passed;
  • Repo Manager complete test suite: 87 passed;
  • real rmgr sbom scan delegation: 39 entries, Git revision present, no errors;
  • real rmgr sbom licence-report without an environment override: 39 entries, copyleft direct count 0, no errors;
  • the local SBOM Nexus package was installed as an operator tool so the compatibility aliases work on the default PATH.

Repo Manager retains file-backed sbom-inventory register representation as a repository concern, but it no longer evaluates sources or owns product snapshots. Detailed owner-side evidence is in repo-manager/docs/evidence/RMGR-WP-0008-sbom-authority-handoff-2026-08-22.md.