bompage 1.2.0__tar.gz → 1.2.2__tar.gz

{bompage-1.2.0 → bompage-1.2.2}/.gitlab-ci.yml

@@ -517,6 +517,10 @@ push-sbom:
       --branch main
       --sbom-version "${CI_COMMIT_TAG#v}"
       --sbom-format cyclonedx
+      --source-project "$CI_PROJECT_URL"
+      --source-commit "$CI_COMMIT_SHA"
+      --source-ref "$CI_COMMIT_TAG"
+      --ci-job-url "$CI_JOB_URL"
   # No $DISABLE_JOBS guard: the tag pipeline sets DISABLE_JOBS to switch off
   # lint/test (see `workflow:`), and the SBOM push must still run.
   rules:

{bompage-1.2.0 → bompage-1.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bompage
-Version: 1.2.0
+Version: 1.2.2
 Summary: A generic, server-less system to track SBOM history of N components and publish a static dashboard
 Project-URL: Homepage, https://gitlab.com/op_so/pages/bompage
 Project-URL: Documentation, https://op_so.gitlab.io/pages/bompage/

bompage-1.2.2/docs/dashboard.md

@@ -0,0 +1,49 @@
+# Reading the dashboard
+
+This page is for anyone browsing the published dashboard — not for `bompage`
+maintainers reading the source (see the other pages for that). It explains
+what each badge next to a component means.
+
+## The "Verified" badge
+
+Every push can carry a cryptographic attestation: an SSH signature proving
+the SBOM was produced and pushed by a trusted pipeline (see
+[`bompage verify`](verify.md)). The dashboard turns that into a "Verified"
+badge, shown both as a compact icon in the tab strip and as a clickable
+button on the component panel (click it to see the signer and public key).
+
+The badge has three states:
+
+| State                | Color                  | Meaning                                                                                                    |
+| --------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------ |
+| **Full**              | 🟢 Green                | The latest push is signed **and** every snapshot kept for this component (including any pruned-but-still-attested one) has always been signed. The whole visible history is trustworthy. |
+| **Partial**           | 🟠 Orange                | The latest push is signed and verified, but something earlier in this component's history is not — usually because those snapshots predate the attestation feature, or a past verification could not run (e.g. a temporary tooling issue). Click the badge for the exact reason. |
+| *(no badge)*          | —                        | Either the latest push itself isn't signed, or a real problem was found (a forged signature, a broken provenance chain, or an unusually slow push) — that case is flagged separately by the red attestation-problem badge instead, next to the same component. |
+
+A few things worth knowing:
+
+- **Orange is not a warning about the current push.** The snapshot you're
+  looking at right now is genuinely signed and verified; orange only means
+  the component's *older* history isn't fully covered. This is expected and
+  permanent for any component adopting signing partway through its life —
+  see the next point for when it clears.
+- **Orange clears on its own.** Once the old, never-signed snapshots age out
+  through the repository's normal retention/pruning, and every snapshot that
+  remains is properly signed, the badge turns green on the next dashboard
+  build — no action needed.
+- **A real problem (forged signature, broken chain) never self-clears this
+  way.** If a signed snapshot's payload is later found forged, that signal is
+  kept even after its raw SBOM is pruned, specifically so it can't be waited
+  out.
+
+### Provenance
+
+The component's metadata table can also show where its latest push came
+from — source repository, commit, ref, CI job, SBOM format/tool — when the
+pipeline that pushed it declared them (`bompage push --source-project`,
+`--source-commit`, `--source-ref`, `--ci-job-url`). It renders exactly like
+any other metadata row: URLs as clickable links, everything else as plain
+text — and it shows up whether or not the push ended up "Verified", so it's
+still there to help trace a signature problem back to its pipeline. It is
+never itself checked — a forged push could claim any origin it likes — so
+treat it as a hint, not as a second layer of verification.

{bompage-1.2.0 → bompage-1.2.2}/docs/index.md

@@ -1,6 +1,6 @@
 # Overview
 
-Version: 1.2.0
+Version: 1.2.2
 
 A generic, server-less system to centralise the SBOM history of **N components**
 in a dedicated Git repository and publish a static

{bompage-1.2.0 → bompage-1.2.2}/mkdocs.yml

@@ -18,6 +18,7 @@ markdown_extensions:
 
 nav:
   - 'index.md'
+  - 'dashboard.md'
   - 'cli.md'
   - 'bompage.md'
   - 'build.md'

{bompage-1.2.0 → bompage-1.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "bompage"
-version = "1.2.0"
+version = "1.2.2"
 description = "A generic, server-less system to track SBOM history of N components and publish a static dashboard"
 authors = [
     { name = "FX Soubirou", email = "soubirou@yahoo.fr" }

{bompage-1.2.0 → bompage-1.2.2}/scripts/gen-demo-data.py

@@ -739,6 +739,8 @@ def _sign_snapshot(
     minutes later, so ``lag`` reads ``ok``.
     """
     generated_at = datetime(scan.year, scan.month, scan.day, 4, 12, tzinfo=UTC)
+    rng = random.Random(f"{SEED}:commit:{component}:{scan.isoformat()}")
+    commit = "".join(rng.choices("0123456789abcdef", k=40))
     att, _sig = write_attestation(
         target,
         component=component,
@@ -746,6 +748,7 @@ def _sign_snapshot(
         generated_at=generated_at,
         provenance={
             "source_project": f"https://gitlab.example/acme/{component}",
+            "source_commit": commit,
             "source_ref": "main",
             "ci_job_url": f"https://gitlab.example/acme/{component}/-/jobs/{scan:%Y%m%d}",
         },

{bompage-1.2.0 → bompage-1.2.2}/src/bompage/bompage.py

@@ -37,7 +37,7 @@ from bompage.build import (
     UnsafeOutputError,
     build_site,
 )
-from bompage.metadata import parse_component, parse_global
+from bompage.metadata import parse_component, parse_global, parse_push
 from bompage.prune import prune_report
 from bompage.push import PushError, push_report
 
@@ -293,6 +293,17 @@ def push(
     ci_job_url: Annotated[
         str | None, typer.Option(help="CI job URL, recorded in the attestation.")
     ] = None,
+    metadata: Annotated[
+        list[str] | None,
+        typer.Option(
+            "--metadata",
+            help='Metadata row "key=value" for this component, written to its own '
+            "metadata.json (read back by build, overridable with "
+            "--metadata-component); repeatable. Omit to leave any existing "
+            "metadata untouched -- each call that passes it replaces the "
+            "file's whole content.",
+        ),
+    ] = None,
 ) -> None:
     """Publish one SBOM into the central repository.
 
@@ -309,6 +320,10 @@ def push(
         "ci_job_url": ci_job_url or "",
         "sbom_format": sbom_format or "",
     }
+    try:
+        metadata_rows = parse_push(metadata) if metadata is not None else None
+    except ValueError as err:
+        raise typer.BadParameter(str(err)) from err
     try:
         outcome = push_report(
             component=component,
@@ -322,6 +337,7 @@ def push(
             git_email=git_email,
             sign_key=sign_key or None,
             provenance=provenance,
+            metadata=metadata_rows,
         )
     except PushError as err:
         typer.echo(f"push: {err}", err=True)

{bompage-1.2.0 → bompage-1.2.2}/src/bompage/build.py

@@ -248,6 +248,15 @@ def _component_report(
     # dashboard showed a partial inventory with no sign a piece was missing.
     excluded = [(file_name, "undated name") for file_name in files.undated]
 
+    # The component's own pushed metadata (`bompage push --metadata`), merged
+    # with `--metadata-component` -- the CLI wins per key so the central
+    # operator keeps the final word without coordinating with every
+    # component's own pipeline (see `metadata.merge_component`).
+    pushed_metadata = metadata_mod.read_component_file(
+        dated[0][0].parent / "metadata.json"
+    )
+    metadata = metadata_mod.merge_component(pushed_metadata, metadata)
+
     # One call per component (attestation spec section 8.1): every dated
     # snapshot's verdict is looked up from it by file name below, and its
     # `orphans` feed the component aggregate alongside the retained snapshots'

{bompage-1.2.0 → bompage-1.2.2}/src/bompage/metadata.py

@@ -20,7 +20,9 @@ rejected rather than rendered twice.
 
 from __future__ import annotations
 
+import json
 import logging
+from pathlib import Path
 
 from bompage.models import MetadataEntry
 
@@ -99,3 +101,75 @@ def parse_component(raw: list[str]) -> dict[str, list[MetadataEntry]]:
         _reject_reserved(key, reserved=_COMPONENT_RESERVED, table="component")
         grouped.setdefault(component, []).append((key, value))
     return {name: _collapse(pairs) for name, pairs in grouped.items()}
+
+
+def parse_push(raw: list[str]) -> list[MetadataEntry]:
+    """Ordered metadata rows for ``bompage push --metadata`` option strings.
+
+    One component's own rows, no ``component:`` prefix -- ``push`` already
+    knows which component it is writing for (spec section 4). Written to that
+    component's ``metadata.json`` sidecar, read back by :func:`build` via
+    :func:`read_component_file`.
+    """
+    pairs = [_split_pair(item) for item in raw]
+    for key, _value in pairs:
+        _reject_reserved(key, reserved=_COMPONENT_RESERVED, table="component")
+    return _collapse(pairs)
+
+
+def read_component_file(path: Path) -> list[MetadataEntry]:
+    """Ordered metadata rows from a pushed ``reports/<component>/metadata.json``.
+
+    Tolerant like every other read of data a *different* pipeline wrote
+    (parsers, attestation verification -- spec sections 6.2 / 11): a missing
+    file is the common case (most components never push metadata) and is not
+    even worth a warning; an unreadable or malformed one degrades to no rows
+    with a warning, never raises. A single bad entry (wrong value type, a
+    reserved key) is dropped with its own warning rather than voiding the
+    whole file -- one bad key must not hide every other key a component
+    declared.
+    """
+    if not path.is_file():
+        return []
+    try:
+        raw = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError, UnicodeDecodeError) as exc:
+        logger.warning("Unreadable metadata file %s: %s", path, exc)
+        return []
+    if not isinstance(raw, dict):
+        logger.warning("Ignoring %s: not a JSON object", path)
+        return []
+    entries: list[MetadataEntry] = []
+    for raw_key, value in raw.items():
+        if not isinstance(raw_key, str) or not isinstance(value, str):
+            logger.warning(
+                "Ignoring non-string metadata entry in %s: %r", path, raw_key
+            )
+            continue
+        key = raw_key.strip()
+        if not key:
+            logger.warning("Ignoring empty metadata key in %s", path)
+            continue
+        if key in _COMPONENT_RESERVED:
+            logger.warning("Ignoring reserved metadata key %r in %s", key, path)
+            continue
+        entries.append(MetadataEntry(key=key, value=value.strip()))
+    return entries
+
+
+def merge_component(
+    file_entries: list[MetadataEntry], cli_entries: list[MetadataEntry]
+) -> list[MetadataEntry]:
+    """Merge a component's pushed ``metadata.json`` with ``--metadata-component``.
+
+    The CLI wins per key -- the central operator keeps the final word without
+    coordinating with every component's own pipeline. A key only the file
+    declares keeps the file's position; a key only the CLI declares is
+    appended after every file-declared key (plain dict re-assignment already
+    has exactly this ordering behaviour: updating an existing key does not
+    move it, a new key is appended).
+    """
+    merged: dict[str, str] = {entry.key: entry.value for entry in file_entries}
+    for entry in cli_entries:
+        merged[entry.key] = entry.value
+    return [MetadataEntry(key=key, value=value) for key, value in merged.items()]

{bompage-1.2.0 → bompage-1.2.2}/src/bompage/push.py

@@ -9,6 +9,14 @@ filter effective across days, since the date-stamped file name changes daily.
 It shells out to the ``git`` binary (plumbing shared with :mod:`bompage.prune`
 via :mod:`bompage._git`); no VCS library is pulled in.
 
+Optionally also writes ``reports/<component>/metadata.json`` (``--metadata``,
+one component's own declared rows -- owner, tier, whatever a team wants on its
+dashboard entry), read back by ``build`` and merged with
+``--metadata-component`` (see :mod:`bompage.metadata`). Independent of the
+SBOM: a metadata-only change commits on its own, without fabricating a new
+dated snapshot to carry it, and omitting ``--metadata`` leaves any existing
+file untouched.
+
 The scoped token (spec section 5.3) is handed to git through a one-shot
 ``credential.helper`` that reads it from the child environment, so it never
 lands on a command line (visible to ``ps`` on a shared runner) nor in the
@@ -26,6 +34,7 @@ from __future__ import annotations
 
 import base64
 import contextlib
+import json
 import re
 import shutil
 import subprocess
@@ -46,6 +55,7 @@ from bompage._git import (
 from bompage._time import as_utc
 from bompage.attest import AttestError, att_path, write_attestation
 from bompage.discovery import snapshot_date
+from bompage.models import MetadataEntry
 from bompage.parsers.base import document_timestamp
 
 # This module historically raised ``PushError``; keep the name as an alias so
@@ -76,6 +86,92 @@ def _file_name(*, stamp: str, sbom_version: str | None) -> str:
     return f"sbom-{stamp}.json"
 
 
+def _metadata_bytes(entries: list[MetadataEntry]) -> bytes:
+    """Canonical ``metadata.json`` content: a flat ``{key: value}`` object.
+
+    ``sort_keys`` (matching ``write_attestation`` / ``render.data``) keeps the
+    byte comparison in :func:`push_report` stable regardless of the order
+    ``--metadata`` happened to be repeated in.
+    """
+    payload = {entry.key: entry.value for entry in entries}
+    return (json.dumps(payload, indent=2, sort_keys=True) + "\n").encode("utf-8")
+
+
+def _write_attestation_sidecar(
+    *,
+    target: Path,
+    work: Path,
+    tmp: str,
+    component: str,
+    previous: Path | None,
+    sign_key: str,
+    provenance: dict[str, str] | None,
+    sbom: Path,
+    now: datetime | None,
+) -> tuple[Path, list[str]]:
+    """Sign the just-written ``target`` SBOM; return the key file and the two
+    new relative paths (``.att`` / ``.att.sig``) for the caller to stage.
+
+    Split out of :func:`push_report` only to keep that function's own branch
+    count under the project's pylint limit -- no behaviour lives here that
+    callers should call directly.
+    """
+    # Support both raw OpenSSH private keys and base64-encoded keys (e.g. for
+    # GitLab CI Masked variables, which forbid whitespace and newlines).
+    # Command to generate the single-line base64 key:
+    #   macOS: base64 -i bompage-push | tr -d '\n'
+    #   Linux: base64 -w 0 bompage-push
+    key_content = sign_key.strip()
+    if not key_content.startswith("-----BEGIN"):
+        with contextlib.suppress(ValueError, UnicodeDecodeError):
+            key_content = base64.b64decode(key_content).decode("utf-8").strip()
+
+    # 0600 inside the TemporaryDirectory already open, gone with it. The key
+    # material is passed as CONTENT and written here: it must never reach
+    # argv, where `ps` on a shared runner would show it (SECURITY.md, same
+    # rule as the token).
+    key_file = Path(tmp) / "sign_key"
+    key_file.write_text(
+        key_content if key_content.endswith("\n") else key_content + "\n"
+    )
+    key_file.chmod(0o600)
+    # A same-day re-push (no --sbom-version) overwrites `target` in place, so
+    # `previous` (found before the copy) is `target` itself: chaining onto it
+    # would make the new attestation's `prev` self-reference the file it is
+    # replacing, permanently reading as a broken chain. Exclude it and chain
+    # onto whatever this component's snapshot before it was -- i.e. what the
+    # entry being replaced already chained onto.
+    chain_previous = previous
+    if chain_previous is not None and chain_previous == target:
+        chain_previous = _latest_snapshot(target.parent, exclude=target)
+    prev_att = None
+    if chain_previous is not None and att_path(chain_previous).is_file():
+        prev_att = att_path(chain_previous)
+    try:
+        att, sig = write_attestation(
+            target,
+            component=component,
+            prev_att=prev_att,
+            generated_at=document_timestamp(sbom),
+            provenance=provenance or {},
+            key_file=key_file,
+            now=as_utc(now),
+        )
+    except AttestError as exc:
+        # This block is the one place that runs with the key MATERIAL in
+        # scope. `exc`'s own message cannot carry it (`write_attestation` only
+        # ever hands `ssh-keygen` a file path -- see attest.py), but re-raise
+        # with `from None` regardless: no exception chain (`__cause__` /
+        # `__context__`) is left standing that a caller printing a full
+        # traceback, not just `str(err)`, could still surface the key
+        # material through (SECURITY.md, same rule as the token).
+        raise PushError(f"signing failed: {exc}") from None
+    return key_file, [
+        att.relative_to(work).as_posix(),
+        sig.relative_to(work).as_posix(),
+    ]
+
+
 def _latest_snapshot(
     component_dir: Path, *, exclude: Path | None = None
 ) -> Path | None:
@@ -119,6 +215,7 @@ def push_report(
     git_email: str = DEFAULT_GIT_EMAIL,
     sign_key: str | None = None,
     provenance: dict[str, str] | None = None,
+    metadata: list[MetadataEntry] | None = None,
     now: datetime | None = None,
 ) -> str:
     """Clone, drop the SBOM, commit iff changed, push.
@@ -130,6 +227,13 @@ def push_report(
     so it never has to appear on any command line (SECURITY.md, same rule as
     ``token``).
 
+    ``metadata`` is likewise opt-in and independent of the SBOM: ``None`` (the
+    default) leaves any existing ``reports/<component>/metadata.json``
+    untouched; given, it *replaces* that file's whole content (read back by
+    ``build`` -- see ``bompage.metadata``). A metadata-only change commits on
+    its own, without fabricating a new dated SBOM snapshot to carry it, and
+    is never covered by ``sign_key`` -- there is no new SBOM to attest.
+
     Returns ``"committed"`` or ``"unchanged"``; raises :class:`PushError` on any
     git failure or a missing SBOM.
     """
@@ -145,6 +249,7 @@ def push_report(
     rel_path = (
         f"reports/{component}/{_file_name(stamp=stamp, sbom_version=sbom_version)}"
     )
+    metadata_rel_path = f"reports/{component}/metadata.json"
 
     # Declared before the `if sign_key:` block below so it is always bound --
     # an unsigned push (the default, every existing deployment) must not raise
@@ -158,73 +263,48 @@ def push_report(
         )
 
         previous = _latest_snapshot(work / "reports" / component)
-        if previous is not None and previous.read_bytes() == sbom.read_bytes():
-            return "unchanged"  # identical to the last snapshot -> anti-noise
+        sbom_unchanged = (
+            previous is not None and previous.read_bytes() == sbom.read_bytes()
+        )
+
+        metadata_path = work / metadata_rel_path
+        new_metadata_bytes: bytes | None = None
+        metadata_changed = False
+        if metadata is not None:
+            new_metadata_bytes = _metadata_bytes(metadata)
+            existing_metadata = (
+                metadata_path.read_bytes() if metadata_path.is_file() else None
+            )
+            metadata_changed = existing_metadata != new_metadata_bytes
+
+        if sbom_unchanged and not metadata_changed:
+            return "unchanged"  # nothing this push carries actually differs
 
         target = work / rel_path
-        target.parent.mkdir(parents=True, exist_ok=True)
-        shutil.copyfile(sbom, target)
-        paths = [rel_path]
-
-        if sign_key:
-            # Support both raw OpenSSH private keys and base64-encoded keys (e.g.
-            # for GitLab CI Masked variables, which forbid whitespace and newlines).
-            # Command to generate the single-line base64 key:
-            #   macOS: base64 -i bompage-push | tr -d '\n'
-            #   Linux: base64 -w 0 bompage-push
-            key_content = sign_key.strip()
-            if not key_content.startswith("-----BEGIN"):
-                with contextlib.suppress(ValueError, UnicodeDecodeError):
-                    key_content = base64.b64decode(key_content).decode("utf-8").strip()
-
-            # 0600 inside the TemporaryDirectory already open, gone with it. The
-            # key material is passed as CONTENT and written here: it must never
-            # reach argv, where `ps` on a shared runner would show it
-            # (SECURITY.md, same rule as the token).
-            key_file = Path(tmp) / "sign_key"
-            key_file.write_text(
-                key_content if key_content.endswith("\n") else key_content + "\n"
+        paths: list[str] = []
+        if not sbom_unchanged:
+            target.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copyfile(sbom, target)
+            paths.append(rel_path)
+
+        if metadata_changed and new_metadata_bytes is not None:
+            metadata_path.parent.mkdir(parents=True, exist_ok=True)
+            metadata_path.write_bytes(new_metadata_bytes)
+            paths.append(metadata_rel_path)
+
+        if sign_key and not sbom_unchanged:
+            key_file, sidecar_paths = _write_attestation_sidecar(
+                target=target,
+                work=work,
+                tmp=tmp,
+                component=component,
+                previous=previous,
+                sign_key=sign_key,
+                provenance=provenance,
+                sbom=sbom,
+                now=now,
             )
-            key_file.chmod(0o600)
-            # A same-day re-push (no --sbom-version) overwrites `target` in
-            # place, so `previous` (found before the copy above) is `target`
-            # itself: chaining onto it would make the new attestation's `prev`
-            # self-reference the file it is replacing, permanently reading as
-            # a broken chain. Exclude it and chain onto whatever this
-            # component's snapshot before it was -- i.e. what the entry being
-            # replaced already chained onto.
-            chain_previous = previous
-            if chain_previous is not None and chain_previous == target:
-                chain_previous = _latest_snapshot(
-                    work / "reports" / component, exclude=target
-                )
-            prev_att = None
-            if chain_previous is not None and att_path(chain_previous).is_file():
-                prev_att = att_path(chain_previous)
-            try:
-                att, sig = write_attestation(
-                    target,
-                    component=component,
-                    prev_att=prev_att,
-                    generated_at=document_timestamp(sbom),
-                    provenance=provenance or {},
-                    key_file=key_file,
-                    now=as_utc(now),
-                )
-            except AttestError as exc:
-                # This block is the one place that runs with the key MATERIAL
-                # in scope. `exc`'s own message cannot carry it (`write_attestation`
-                # only ever hands `ssh-keygen` a file path -- see attest.py), but
-                # re-raise with `from None` regardless: no exception chain
-                # (`__cause__`/`__context__`) is left standing that a caller
-                # printing a full traceback, not just `str(err)`, could still
-                # surface the key material through (SECURITY.md, same rule as
-                # the token).
-                raise PushError(f"signing failed: {exc}") from None
-            paths += [
-                att.relative_to(work).as_posix(),
-                sig.relative_to(work).as_posix(),
-            ]
+            paths += sidecar_paths
 
         _run_git(["add", *paths], cwd=work, token=token)
 
@@ -237,8 +317,15 @@ def push_report(
         if staged.returncode == 0:  # same-named file, unchanged -> anti-noise
             return "unchanged"
 
-        message = f"chore(sbom): {component} {Path(rel_path).name}"
-        if sbom_format:
+        # Named after what this push actually carries -- a metadata-only
+        # update (sbom unchanged) must not claim an SBOM change happened.
+        parts = []
+        if not sbom_unchanged:
+            parts.append(Path(rel_path).name)
+        if metadata_changed:
+            parts.append("metadata")
+        message = f"chore(sbom): {component} {' + '.join(parts)}"
+        if sbom_format and not sbom_unchanged:
             message += f" [{sbom_format}]"
         _run_git(
             [

{bompage-1.2.0 → bompage-1.2.2}/src/bompage/render/data.py

@@ -8,7 +8,8 @@ Layout under ``<output>/data/``::
     index.json            generated_at + bompage version + global metadata
                           table + global attestation aggregate + per component
                           {name, last_scan_date, package_count, is_stale,
-                          days_since_scan, drift_count, attestation}
+                          days_since_scan, drift_count, attestation,
+                          latest_attestation}
     components/<name>.json one component in full, including `snapshots`
     packages-index.json   inverted index name -> occurrences (spec section 7.3)
     drifts.json           active cross-component drifts (spec section 7.4)
@@ -69,6 +70,15 @@ def write_data(data: DashboardData, output_dir: Path) -> list[Path]:
                     "is_stale": component["freshness"]["is_stale"],
                     "days_since_scan": component["freshness"]["days_since_scan"],
                     "drift_count": drift_counts.get(component["name"], 0),
+                    # Distinct from the worst-of-history `attestation` aggregate:
+                    # the tab-strip icon needs the latest snapshot's own verdict
+                    # to tell "signed now, gap earlier" apart from "always signed"
+                    # (design doc section 9.3).
+                    "latest_attestation": (
+                        component["snapshots"][-1]["attestation"]
+                        if component["snapshots"]
+                        else None
+                    ),
                 }
                 for component in dumped["components"]
             ],

bompage-1.2.2/src/bompage/web/assets/index-CBZgukme.css

@@ -0,0 +1 @@
+@font-face{font-family:Roboto Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(./roboto-latin-ext-wght-normal-DYIxWhlt.woff2)format("woff2-variations");unicode-range:U+100-2BA,U+2BD-2C5,U+2C7-2CC,U+2CE-2D7,U+2DD-2FF,U+304,U+308,U+329,U+1D00-1DBF,U+1E00-1E9F,U+1EF2-1EFF,U+2020,U+20A0-20AB,U+20AD-20C0,U+2113,U+2C60-2C7F,U+A720-A7FF}@font-face{font-family:Roboto Variable;font-style:normal;font-display:swap;font-weight:100 900;src:url(./roboto-latin-wght-normal-ccAYIvAh.woff2)format("woff2-variations");unicode-range:U+??,U+131,U+152-153,U+2BB-2BC,U+2C6,U+2DA,U+2DC,U+304,U+308,U+329,U+2000-206F,U+20AC,U+2122,U+2191,U+2193,U+2212,U+2215,U+FEFF,U+FFFD}@font-face{font-family:Material Symbols Outlined;font-style:normal;font-weight:100 700;font-display:block;src:url(./material-symbols-outlined-CQbRTMbb.woff2)format("woff2")}.material-symbols-outlined{letter-spacing:normal;text-transform:none;white-space:nowrap;word-wrap:normal;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;text-rendering:optimizelegibility;font-feature-settings:"liga";direction:ltr;font-family:Material Symbols Outlined;font-size:24px;font-style:normal;font-weight:400;line-height:1;display:inline-block}:root{--lightningcss-light:initial;--lightningcss-dark: ;color-scheme:light dark;--md-sys-color-primary:#4b5bd7;--md-sys-color-on-primary:#fff;--md-sys-color-primary-container:#e0e1ff;--md-sys-color-on-primary-container:#00006e;--md-sys-color-surface:#fdfbff;--md-sys-color-surface-container:#f2f0f7;--md-sys-color-surface-container-high:#eceaf2;--md-sys-color-on-surface:#1b1b1f;--md-sys-color-on-surface-variant:#46464f;--md-sys-color-outline:#777680;--md-sys-color-outline-variant:#c7c5d0;--md-sys-color-error:#ba1a1a;--md-sys-color-error-container:#ffdad6;--md-sys-color-on-error-container:#410002;--md-sys-color-tertiary-container:#ffdea8;--md-sys-color-on-tertiary-container:#291800;--chip-added-bg:#c9f2d0;--chip-added-fg:#0a3d18;--row-copyleft-bg:#ece6f6;--row-copyleft-fg:#1d192b;--badge-copyleft-bg:#d0bcff;--badge-copyleft-fg:#1d192b;--badge-verified-bg:#dafbe1;--badge-verified-fg:#1a7f37;--badge-verified-border:#4ac26b;--badge-verified-partial-bg:#fff2d6;--badge-verified-partial-fg:#9a5b00;--badge-verified-partial-border:#e0a530;--md-ref-typeface-plain:"Roboto Variable", "Roboto", system-ui, sans-serif;--md-ref-typeface-brand:"Roboto Variable", "Roboto", system-ui, sans-serif}@media (prefers-color-scheme:dark){:root{--lightningcss-light: ;--lightningcss-dark:initial;--md-sys-color-primary:#bfc2ff;--md-sys-color-on-primary:#10218a;--md-sys-color-primary-container:#313aa8;--md-sys-color-on-primary-container:#e0e1ff;--md-sys-color-surface:#121316;--md-sys-color-surface-container:#1e1f23;--md-sys-color-surface-container-high:#292a2e;--md-sys-color-on-surface:#e5e1e6;--md-sys-color-on-surface-variant:#c7c5d0;--md-sys-color-outline:#918f9a;--md-sys-color-outline-variant:#46464f;--md-sys-color-error:#ffb4ab;--md-sys-color-error-container:#93000a;--md-sys-color-on-error-container:#ffdad6;--md-sys-color-tertiary-container:#5f4100;--md-sys-color-on-tertiary-container:#ffdea8;--chip-added-bg:#123f1c;--chip-added-fg:#b7f0bf;--row-copyleft-bg:#2b2930;--row-copyleft-fg:#e6e0e9;--badge-copyleft-bg:#4f378b;--badge-copyleft-fg:#eaddff;--badge-verified-bg:#112d18;--badge-verified-fg:#3fb950;--badge-verified-border:#238636;--badge-verified-partial-bg:#3a2a00;--badge-verified-partial-fg:#e3a53c;--badge-verified-partial-border:#9a6a10}}body{max-width:80rem;font-family:var(--md-ref-typeface-plain);background:var(--md-sys-color-surface-container);color:var(--md-sys-color-on-surface);margin:0 auto;padding:1.5rem clamp(1rem,4vw,2.5rem);line-height:1.5}a{color:var(--md-sys-color-primary)}code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace}.app-header,#tabs,#panel{background:var(--md-sys-color-surface);border:1px solid var(--md-sys-color-outline-variant);box-shadow:0 1px 2px #0000000f,0 1px 3px #00000014}.app-header{border-radius:16px;flex-wrap:wrap;align-items:center;gap:1rem 2rem;margin-bottom:1rem;padding:1rem 1.5rem;display:flex}.app-header .brand{margin-right:auto}.app-title{margin:0;line-height:0}.app-title a{border-radius:4px;display:inline-block}.app-title a:focus-visible{outline:2px solid var(--md-sys-color-primary);outline-offset:3px}.app-title img{width:auto;height:2.25rem;display:block}.app-subtitle{color:var(--md-sys-color-on-surface-variant);margin:.35rem 0 0;font-size:.875rem}.project-meta,.component-meta{color:var(--md-sys-color-on-surface-variant);grid-template-columns:auto 1fr;gap:.1rem .75rem;margin:.35rem 0 0;font-size:.875rem;display:grid}.component-meta{margin:0 0 .75rem}.project-meta:empty,.component-meta:empty{display:none}.project-meta .meta-row,.component-meta .meta-row{display:contents}.project-meta dt,.component-meta dt{font-weight:500}.project-meta dd,.component-meta dd{overflow-wrap:anywhere;min-width:0;margin:0}#global-search{flex:22rem;max-width:34rem;margin:0}#search-results{border:1px solid var(--md-sys-color-outline-variant);background:var(--md-sys-color-surface-container-high);border-radius:.5rem;flex-basis:100%;order:3;max-width:40rem;margin:0;padding:.5rem .75rem}#search-results ul{margin:.25rem 0;padding-left:1.1rem}#search-results[hidden]{display:none}#tabs{--md-primary-tab-container-color:transparent;--md-primary-tab-active-indicator-color:var(--md-sys-color-primary);--md-primary-tab-label-text-color:var(--md-sys-color-on-surface-variant);--md-primary-tab-active-label-text-color:var(--md-sys-color-primary);border-bottom:0;border-radius:16px 16px 0 0;padding:0 .75rem}#panel{border-top:0;border-radius:0 0 16px 16px;min-height:40vh;padding:.75rem 1.5rem 1.5rem}#panel:focus-visible{outline:2px solid var(--md-sys-color-primary);outline-offset:2px}.visually-hidden{clip-path:inset(50%);white-space:nowrap;border:0;width:1px;height:1px;margin:-1px;padding:0;position:absolute;overflow:hidden}.muted{color:var(--md-sys-color-on-surface-variant);font-size:.875rem}.meta{flex-wrap:wrap;align-items:center;gap:1rem;margin:1rem 0 .5rem;display:flex}.meta .component-name{font-weight:500}.controls{flex-wrap:wrap;align-items:center;gap:1rem;margin-bottom:.75rem;display:flex}.recent-changes,.snapshot-diff{margin:0 0 .75rem}.recent-changes summary,.snapshot-diff summary{cursor:pointer;color:var(--md-sys-color-on-surface-variant)}.snapshot-diff .controls{margin:.5rem 0}ul.snapshot-diff-list{margin:.5rem 0;padding-left:0;list-style:none}ul.snapshot-diff-list li{margin-bottom:.3rem}ul.recent,ul.drifts{margin:.5rem 0;padding-left:1.2rem}ul.recent li,ul.drifts>li{margin-bottom:.3rem}.timeline-date{color:var(--md-sys-color-on-surface-variant);font-size:.8rem}ol.timeline{margin:0;padding-left:1.2rem}ol.timeline li{margin-bottom:.3rem}.controls .count{color:var(--md-sys-color-on-surface-variant);font-size:.875rem}.controls .export-csv{margin-left:auto}.table-scroll{overflow-x:auto}table.inventory{border-collapse:collapse;width:100%;font-size:.9rem}table.inventory th,table.inventory td{text-align:left;border-bottom:1px solid var(--md-sys-color-outline-variant);padding:.5rem .75rem}table.inventory th{color:var(--md-sys-color-on-surface-variant);font-weight:500}button.th-sort{font:inherit;color:inherit;cursor:pointer;background:0 0;border:0;align-items:baseline;gap:.25rem;padding:0;font-weight:500;display:inline-flex}button.th-sort:hover{color:var(--md-sys-color-on-surface)}button.th-sort:focus-visible{outline:2px solid var(--md-sys-color-primary);outline-offset:2px}.sort-caret{color:var(--md-sys-color-primary);min-width:.7rem;font-size:.7rem}table.inventory tr.strong-copyleft td{background:var(--row-copyleft-bg);color:var(--row-copyleft-fg)}button.pkg-name{font:inherit;color:var(--md-sys-color-primary);cursor:pointer;background:0 0;border:0;padding:0;text-decoration:underline}.badge,.chip{white-space:nowrap;border-radius:.4rem;align-items:center;gap:.15rem;padding:0 .4rem;font-size:.75rem;display:inline-flex}.badge md-icon,.chip md-icon{font-size:1rem}.tab-label{white-space:nowrap;align-items:center;gap:.25rem;display:inline-flex}.tab-icon{color:var(--md-sys-color-error);font-size:1rem}.tab-icon.tab-icon-verified{color:var(--badge-verified-fg)}.tab-icon.tab-icon-verified-partial{color:var(--badge-verified-partial-fg)}.badge-popover-anchor{display:inline-flex;position:relative}.badge-verified{background:var(--badge-verified-bg);color:var(--badge-verified-fg);border:1px solid var(--badge-verified-border);cursor:pointer;border-radius:999px;gap:.35rem;padding:.15rem .55rem;font-family:inherit;font-weight:500;line-height:1.4;transition:filter .15s}.badge-verified:hover{filter:brightness(.95)}.badge-verified-partial{background:var(--badge-verified-partial-bg);color:var(--badge-verified-partial-fg);border-color:var(--badge-verified-partial-border)}.verified-popover{z-index:100;background:var(--md-sys-color-surface-container-high);min-width:280px;max-width:360px;color:var(--md-sys-color-on-surface);border:1px solid var(--md-sys-color-outline-variant);text-align:left;border-radius:8px;padding:.85rem 1rem;font-size:.8125rem;line-height:1.5;display:none;position:absolute;top:calc(100% + 6px);left:0;box-shadow:0 8px 24px #00000026}.verified-popover.open{display:block}.verified-popover-header{color:var(--badge-verified-fg);align-items:center;gap:.4rem;margin-bottom:.4rem;font-size:.875rem;font-weight:600;display:flex}.verified-popover.partial .verified-popover-header{color:var(--badge-verified-partial-fg)}.verified-popover-header md-icon{font-size:1.15rem}.verified-popover-desc{color:var(--md-sys-color-on-surface-variant);margin:0 0 .6rem;font-size:.775rem}.verified-popover-details{border-top:1px solid var(--md-sys-color-outline-variant);grid-template-columns:auto 1fr;gap:.25rem .6rem;margin:0;padding-top:.5rem;font-size:.75rem;display:grid}.verified-popover-details dt{color:var(--md-sys-color-on-surface-variant);font-weight:500}.verified-popover-details dd{overflow-wrap:anywhere;margin:0}.verified-popover-details code{background:var(--md-sys-color-surface-container);border-radius:4px;padding:.1rem .3rem;font-family:monospace}.badge-copyleft{background:var(--badge-copyleft-bg);color:var(--badge-copyleft-fg)}.badge-stale,.badge-attestation{background:var(--md-sys-color-error-container);color:var(--md-sys-color-on-error-container)}.badge-drift{background:var(--md-sys-color-tertiary-container);color:var(--md-sys-color-on-tertiary-container)}.chip-added{background:var(--chip-added-bg);color:var(--chip-added-fg)}.chip-removed{background:var(--md-sys-color-error-container);color:var(--md-sys-color-on-error-container)}.chip-changed{background:var(--md-sys-color-primary-container);color:var(--md-sys-color-on-primary-container)}.license-cell{align-items:center;gap:.35rem;display:inline-flex}#error{background:var(--md-sys-color-error);color:var(--md-sys-color-on-primary);border-radius:.5rem;margin-top:1rem;padding:.75rem 1rem}#error[hidden]{display:none}#site-footer{text-align:center;color:var(--md-sys-color-on-surface-variant);margin:1.5rem 0 .5rem;font-size:.8125rem}