// Security & Compliance

SBOM & VEX Release Evidence Gate

Gate a release on consistent SBOM, VEX, identifier, relationship, and artifact-digest evidence.

Get it on Agensi Browse all skills $29 one-time

What problem does SBOM & VEX Release Evidence Gate solve?

CycloneDX or SPDX SBOMs, VEX statements, release manifests, component identifiers, and artifact hashes are reviewed across separate tools before shipping.

Use it to

Check release digests against SBOM evidence
Find components missing purls or versions
Catch orphaned or stale VEX statements before handoff

What it returns

findings.csv with stable codes and evidence sources
review-manifest.csv with every reviewed record
result.json with READY, REVIEW, or BLOCK gate and SHA-256 receipt
report.md with a human-review handoff

A representative input and result

fixture-backed sample

input `as_of` is timezone-aware; `artifacts[]` uses `artifact_id`, `expected_digest`, and `sbom_digest`; `components[]` uses `component_id`, `purl`, `version`, and relationship; `vex_statements[]` uses `statement_id`, `component_id`, and `updated_at`.

result A deterministic READY, REVIEW, or BLOCK result with stable finding codes, a complete review manifest, a human-readable report, and a SHA-256 receipt.

Access and approval boundaries

Terminal permission to run the bundled local Python reconciler.
Read access to one user-selected normalized UTF-8 JSON packet.
Write access only to one user-selected local output directory.
No browser, network, credential, account, environment-variable, messaging, payment, deletion, access-change, filing, or publication permission.

Known limitations

The package does not scan for vulnerabilities or decide whether a VEX status is substantively correct.
It relies on owner-supplied normalized component and digest evidence.
READY is not a legal, CRA, procurement, or security certification.

Questions

Does it connect to a live account or provider?

No. It reads one normalized local JSON packet and makes no network request.

Does it make the final decision or external change?

No. It produces evidence findings; the responsible owner makes every decision and action outside the package.

Is the result deterministic?

Yes. Stable finding codes, sorted records, and a SHA-256 receipt make repeated review inspectable.

What happens with malformed input?

Unreadable JSON, missing arrays, duplicate core identifiers, invalid timestamps, and invalid core numbers fail closed.

Does READY prove the underlying evidence is true?

No. READY means no automated finding appeared in the supplied normalized packet; source truth still requires human review.

SBOM & VEX Release Evidence Gate keeps proof and approval boundaries visible.

The listing includes the tested package, realistic samples, declared permissions, and known limitations.

Get SBOM & VEX Release Evidence Gate on Agensi