feat(sbom): mark only entry-point packages as directly attackable - #332

Merged

reyreavman merged 17 commits into

mainfrom

feat/sbom/gost-attack-surface-roots

Oct 1, 2026

Commits on Sep 30, 2026

feat(sbom): mark only entry-point packages as directly attackable
reyreavman
committed
cc38903
test(sbom), docs(sbom): cover the attack surface split along the dependency tree
reyreavman
committed
4aafd8d
fix(sbom): keep entry-point packages attackable when the image lists them all
reyreavman
committed
dfa684b
test(sbom): run merged product SBOMs through the checker in both formats
reyreavman
committed
efafd78
fix(sbom): reject indirect as a security function value
reyreavman
committed
abe8467
fix(sbom): keep mutually dependent packages attackable when nothing pulls them in
reyreavman
committed
0b4582f
docs(sbom), test(sbom): stop advertising indirect as a security function value
reyreavman
committed
d2ca3be
fix(sbom): regenerate cached SBOMs so every image gets the split attack surface
reyreavman
committed
1e17936
fix(sbom): keep packages attackable when a service lists them as dependencies
reyreavman
committed
3c0d94d
fix(sbom): stop marking the wrong package attackable when merged SBOMs reuse a bom-ref
reyreavman
committed
111d742
fix(sbom): reject `security_function: indirect` in the images `sbom merge` combines
reyreavman
committed
bd4f178
fix(sbom): keep merge-internal prefixes out of vulnerability, composition and annotation refs
reyreavman
committed
53d45a3
docs(sbom): state that sbom merge rejects out-of-domain GOST values
reyreavman
committed
90e8ade
refactor(sbom): split ref derivation and Tarjan traversal into helpers
reyreavman
committed
981de73
fix(sbom): keep every undeclared reference of a merged SBOM inside its own document
reyreavman
committed
1431684
fix(sbom): tell how to recover when a base or imported SBOM fails GOST validation
reyreavman
committed
1fc3a83

Commits on Oct 1, 2026

fix(sbom): drop vulnerability references to packages no input declares
reyreavman
committed
b08ceaa

Navigation Menu

feat(sbom): mark only entry-point packages as directly attackable - #332

feat(sbom): mark only entry-point packages as directly attackable#332
reyreavman merged 17 commits into
mainfrom
feat/sbom/gost-attack-surface-roots

Commits on Sep 30, 2026

feat(sbom): mark only entry-point packages as directly attackable

test(sbom), docs(sbom): cover the attack surface split along the dependency tree

fix(sbom): keep entry-point packages attackable when the image lists them all

test(sbom): run merged product SBOMs through the checker in both formats

fix(sbom): reject indirect as a security function value

fix(sbom): keep mutually dependent packages attackable when nothing pulls them in

docs(sbom), test(sbom): stop advertising indirect as a security function value

fix(sbom): regenerate cached SBOMs so every image gets the split attack surface

fix(sbom): keep packages attackable when a service lists them as dependencies

fix(sbom): stop marking the wrong package attackable when merged SBOMs reuse a bom-ref

fix(sbom): reject `security_function: indirect` in the images `sbom merge` combines

fix(sbom): keep merge-internal prefixes out of vulnerability, composition and annotation refs

docs(sbom): state that sbom merge rejects out-of-domain GOST values

refactor(sbom): split ref derivation and Tarjan traversal into helpers

fix(sbom): keep every undeclared reference of a merged SBOM inside its own document

fix(sbom): tell how to recover when a base or imported SBOM fails GOST validation

Commits on Oct 1, 2026

fix(sbom): drop vulnerability references to packages no input declares