feat(build): embed auditable Rust dependency metadata - #2734
Open
alangou wants to merge 1 commit into
Open
Conversation
alangou
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
August 13, 2026 09:25
2 tasks
|
🌿 Preview your docs: https://nvidia-preview-pr-2734.docs.buildwithfern.com/openshell |
Contributor
Author
alangou
force-pushed
the
alangou/2686-feat-embed-linked-rust-dependency-tree-cargo-auditable-in-release-binaries
branch
from
August 13, 2026 12:47
2f5c0d6 to
b36255d
Compare
alangou
enabled auto-merge
August 13, 2026 12:48
4 tasks
alangou
force-pushed
the
alangou/2686-feat-embed-linked-rust-dependency-tree-cargo-auditable-in-release-binaries
branch
from
August 19, 2026 13:52
b36255d to
e29224a
Compare
Signed-off-by: Adrien Langou <alangou@nvidia.com>
alangou
force-pushed
the
alangou/2686-feat-embed-linked-rust-dependency-tree-cargo-auditable-in-release-binaries
branch
from
August 20, 2026 09:07
e29224a to
158b724
Compare
6 tasks
SDAChess
approved these changes
Aug 20, 2026
Comment on lines
+12
to
+20
| The OpenShell SBOM tooling produces source-tree CycloneDX JSON SBOMs using Syft, resolves missing or hash-based licenses by querying public registries (crates.io, npm, PyPI), and exports the results to CSV for stakeholder review. | ||
|
|
||
| SBOMs are **release artifacts only** -- they are generated on demand and not committed to the repository. Output lands in `deploy/sbom/output/` (gitignored). | ||
|
|
||
| Release Dev and Release Tag image builds separately embed cargo-auditable | ||
| metadata in the staged gateway and supervisor binaries. This metadata describes | ||
| the binary's Rust dependency graph and lets Syft discover Cargo packages from | ||
| the binary itself. It is not a complete image SBOM and is not an OCI SBOM | ||
| attestation; publishing such an attestation remains separate work. |
Collaborator
There was a problem hiding this comment.
Top line is not wrapped but the bottom paragraph is. Is that expected?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Embed the linked Rust dependency graph in gateway and supervisor binaries used by Release Dev and Release Tag images. This makes shipped binaries directly inspectable by Syft and other cargo-auditable consumers while keeping PR, E2E, and standalone artifact builds unchanged by default.
Related Issue
Closes #2686
Changes
auditableinput through the Docker and native Rust build workflowsOPENSHELL_AUDITABLE=1for equivalent local prebuilt stagingTesting
mise run pre-commitmise run testChecklist
Coordination
PR #2677 also updates
mise.tomlandmise.lock; if it merges first, the lockfile should be regenerated with both tools present.