Best fit
A release owner reconciling normalized SBOM components, VEX statements and supplied artifact digests before a review or handoff—not scanning packages for vulnerabilities.
// Security & Compliance
SBOM & VEX Release Evidence Gate
Gate a release on consistent SBOM, VEX, identifier, relationship, and artifact-digest evidence.
We earn a commission on eligible purchases after a new Agensi signup through these links. We also sell our own skills on Agensi.Format: Agent skill, not a browser app. You need an AI agent that can load its instructions and use the required tools.
Package requirements: SKILL.md-compatible agents that can run a local Python helper. Python 3.10 or newer on Windows, macOS, or Linux using only the standard library. One documented UTF-8 JSON evidence packet; no API key or provider account.
You get: findings.csv with stable codes and evidence sources review-manifest.csv with every reviewed record
Licence and purchase details
Review the package licence at the destination.
Review the offer and access method at your chosen marketplace. Agensi provides connected-agent access, not a download. Buying a skill does not include an AI-agent subscription or setup service.
Agensi access: This product’s bundled-script workflow through Agensi has not been verified here. Tests of other products do not establish this package’s compatibility. Local setup examples apply to separately obtained downloadable packages.
What problem does SBOM & VEX Release Evidence Gate solve?
CycloneDX or SPDX SBOMs, VEX statements, release manifests, component identifiers, and artifact hashes are reviewed across separate tools before shipping.
Use it to
- Check release digests against SBOM evidence
- Find components missing purls or versions
- Catch orphaned or stale VEX statements before handoff
What it returns
- findings.csv with stable codes and evidence sources
- review-manifest.csv with every reviewed record
- result.json with READY, REVIEW, or BLOCK gate and SHA-256 receipt
- report.md with a human-review handoff
A representative input and result
input `as_of` is timezone-aware; `artifacts[]` uses `artifact_id`, `expected_digest`, and `sbom_digest`; `components[]` uses `component_id`, `purl`, `version`, and relationship; `vex_statements[]` uses `statement_id`, `component_id`, and `updated_at`.
result A deterministic READY, REVIEW, or BLOCK result with stable finding codes, a complete review manifest, a human-readable report, and a SHA-256 receipt.
Access and approval boundaries
- Terminal permission to run the bundled local Python reconciler.
- Read access to one user-selected normalized UTF-8 JSON packet.
- Write access only to one user-selected local output directory.
- No browser, network, credential, account, environment-variable, messaging, payment, deletion, access-change, filing, or publication permission.
Known limitations
- The package does not scan for vulnerabilities or decide whether a VEX status is substantively correct.
- It relies on owner-supplied normalized component and digest evidence.
- READY is not a legal, CRA, procurement, or security certification.
Run your first evidence check
Requires Python 3.10 or newer. Extract the complete ZIP, read references/input-contract.md, and prepare one owner-approved UTF-8 JSON evidence packet. From the extracted skill folder, run:
python scripts/run_reconciler.py input.json --output-dir evidence-outputReview findings.csv, review-manifest.csv, result.json and report.md before making a release decision.
What changed in package 1.0.1
Missing, blank and non-string artifact digests now produce BLOCK with RELEASE_DIGEST_INVALID. Valid digest comparisons are unchanged. The SHA-256 receipt is an unsigned checksum of normalized input and result, not authentication or proof of execution.
Also available on Gumroad for $29 USD. Gumroad delivery was hash-verified against the tested package. Agensi shows platform release 1.1 as current; its buyer download has not been independently hash-verified.
// choose with context
Is SBOM & VEX Release Evidence Gate the right skill?
It returns
findings.csv with stable codes and evidence sources; review-manifest.csv covering reviewed records; result.json with READY, REVIEW or BLOCK and an unsigned deterministic SHA-256 receipt; report.md for owner review.
Do not use it as
The package does not scan for vulnerabilities or decide whether a VEX status is substantively correct. It relies on owner-supplied normalized component and digest evidence. READY is not a legal, CRA, procurement, or security certification.
Compatibility, access, version, and licence
- Reads or accesses
- One owner-approved UTF-8 JSON packet with artifact digest strings, component IDs/purls/versions, relationships and dated VEX statements. The helper compares supplied digests; it does not recalculate artifact hashes or authenticate the evidence.
- Compatibility
- SKILL.md-compatible agents that can run a local Python helper. Python 3.10 or newer on Windows, macOS, or Linux using only the standard library. One documented UTF-8 JSON evidence packet; no API key or provider account.
- Version
- Package 1.0.1; Agensi platform release 1.1
- Licence
- Review the package licence and seller terms at the linked destination.
Questions
Does it connect to a live account or provider?
No. It reads one normalized local JSON packet and makes no network request.
Does it make the final decision or external change?
No. It produces evidence findings; the responsible owner makes every decision and action outside the package.
Is the result deterministic?
Yes. Stable finding codes, sorted records, and a SHA-256 receipt make repeated review inspectable.
What happens with malformed input?
Unreadable JSON, missing arrays, duplicate core identifiers, invalid timestamps, and invalid core numbers fail closed.
Does READY prove the underlying evidence is true?
No. READY means no automated finding appeared in the supplied normalized packet; source truth still requires human review.
SBOM & VEX Release Evidence Gate keeps proof and approval boundaries visible.
The listing includes the tested package, realistic samples, declared permissions, and known limitations.
Get SBOM & VEX Release Evidence Gate on Agensi