tegwick
4b497d9e7b
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
35 lines
1.6 KiB
Markdown
35 lines
1.6 KiB
Markdown
# SBOM-WP-0002 T05 — Repo Manager scanner handoff evidence
|
|
|
|
Date: 2026-08-22
|
|
|
|
Repo Manager commit `ad0ba6f` removes its duplicate SBOM scanner and leaves
|
|
SBOM Nexus as the single scanner/snapshot product owner.
|
|
|
|
Changes:
|
|
|
|
- deleted `src/repo_manager/sbom.py` (326 lines of parser, source detection,
|
|
licence triage, and snapshot rendering);
|
|
- replaced parser-specific tests with compatibility-delegation tests;
|
|
- retained `rmgr sbom scan` and `rmgr sbom licence-report` as thin aliases;
|
|
- invokes `sbom-nexus` directly with `shell=False`, discovered on `PATH` or via
|
|
`SBOM_NEXUS_CLI`;
|
|
- preserved scan output-file refusal and `--force` behavior;
|
|
- pinned authority in JSON with `schema=sbom-nexus.snapshot.v1`,
|
|
`product_owner=sbom-nexus`, and `delegated_by=repo-manager`;
|
|
- corrected Repo Manager's earlier interim-scanner workplan/evidence and placed
|
|
the direct `sbom-nexus scan` command first in operator documentation.
|
|
|
|
Verification:
|
|
|
|
- Repo Manager Ruff: passed;
|
|
- Repo Manager complete test suite: 87 passed;
|
|
- real `rmgr sbom scan` delegation: 39 entries, Git revision present, no errors;
|
|
- real `rmgr sbom licence-report` without an environment override: 39 entries,
|
|
copyleft direct count 0, no errors;
|
|
- the local SBOM Nexus package was installed as an operator tool so the
|
|
compatibility aliases work on the default PATH.
|
|
|
|
Repo Manager retains file-backed `sbom-inventory` register representation as a
|
|
repository concern, but it no longer evaluates sources or owns product
|
|
snapshots. Detailed owner-side evidence is in
|
|
`repo-manager/docs/evidence/RMGR-WP-0008-sbom-authority-handoff-2026-08-22.md`.
|