Add optional SRAC safety-relevance sidecar correlation pipeline

Đang mở
  • Có gì không ổn?
#2,244 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức phù hợp với người mới
35/100
Loại issue
Tính năng
Độ rõ ràng
Cần làm rõ
Mức độ hoạt động
Sôi nổi
Công nghệ
python
Lĩnh vực
backend

Hướng nghiên cứu

Start by reading the existing load_sbom pipeline and the proposed load_srac behavior in this issue. Define how the pipeline would discover and validate one SRAC JSON sidecar, correlate it with SPDX or CycloneDX packages, and emit deterministic project output. Done requires maintainer agreement on the pipeline and output model, plus tests for matches, unmatched and ambiguous records, invalid integrity, broken references, and malformed input.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Summary

Would ScanCode.io consider an optional pipeline step for importing and correlating Safety Relevance Assertion Capability (SRAC) sidecars with packages loaded from SPDX or CycloneDX SBOMs?

SRAC is a format-neutral, externally authored record that associates a software component with safety-relevance metadata, supporting evidence, review state, and optional change-impact analysis. The integration would validate and correlate those records; ScanCode.io would not infer safety relevance or approve a safety decision.

This appears to fit ScanCode.io's pipeline model because load_sbom already imports SPDX and CycloneDX documents for further review and enrichment.

Proposed focused enhancement

Add an optional load_srac pipeline, or an optional step adjacent to load_sbom, that:

  1. discovers an SRAC JSON sidecar among project inputs;
  2. validates its schema, digest/integrity metadata, and internal references;
  3. correlates each assertion with an imported package using stable identifiers such as package URL, SBOM reference, version, or artifact digest;
  4. preserves the assertion, provenance, evidence references, review state, and optional change-impact data without altering their meaning; and
  5. writes a deterministic JSON report containing matched, unmatched, ambiguous, invalid, and stale assertions.

For an initial implementation, the results could remain project output data rather than requiring new UI or policy features. SPDX and CycloneDX exports could optionally retain a resolvable external reference to the integrity-protected sidecar where the selected format permits it.

Suggested acceptance criteria

  • The pipeline accepts one SBOM plus one clearly identified SRAC sidecar.
  • Assertions correlate deterministically with imported packages, recording the identifier used for each match.
  • Invalid, unmatched, ambiguous, and stale assertions are explicit and fail closed.
  • The original assertion and its digest remain available for audit.
  • The pipeline never creates or changes a safety classification, impact decision, or approval.
  • A clearly labeled synthetic safety-related example demonstrates the full flow.
  • Tests cover successful matches, unmatched and ambiguous records, invalid integrity, broken references, and malformed input.

Working prototype

The Eclipse S-CORE reference-integration prototype demonstrates schema validation, SPDX/CycloneDX correlation, integrity checks, enrichment reports, change-impact records, and fail-closed behavior:

Related ecosystem discussions:

Standards status

The mapping follows current SPDX 3.1-development FunctionalSafety concepts and explores a CycloneDX-compatible external assertion carrier. These are development/proposal references, not claims of released normative support.

Would maintainers consider a small load_srac pipeline proof of concept appropriate, and should its correlation result initially live in project output data or in a dedicated model?

Ngôn ngữ chính
Python
Star
223
Fork
214
Merge trung bình
2 ngày 3 giờ
Pull request đã merge (30 ngày)
13

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của aboutcode-org/scancode.io

Tất cả issue của aboutcode-org/scancode.io

Issue tương tự

Thêm issue về Python

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.