Sharang ParnerkarandClaude Opus 4.8
3cedb488ac
CI / Check (pull_request) Successful in 6m49s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy Docs (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
Upgrade the firmware SBOM from analysis-only to a full reproducible build: run tramiton's NixBackend (`seal_and_build`) over the ingested source to produce a sealed lock whose libraries are pinned and whose firmware artifact carries a content hash, then render the SBOM from the lock plus deep binary SCA of any pre-compiled inputs — the complete bill of materials (toolchain + every fetched library + the firmware image), mapped into `SbomEntry` rows. Graceful by design: when no nix backend is available (or the build fails / times out at 15m), it falls back to the analysis-only components (toolchain + resolvable libraries), so a nix that can't run in the deployment never breaks a scan. Infra: the agent image now installs `nix-portable` (rootless, single binary; best-effort — a failed download just leaves the analysis-only path). The nix store lives under `NP_LOCATION=/data/compliance-scanner` — mount a PERSISTENT volume there in the deployment, otherwise every firmware scan re-fetches nixpkgs + cross toolchains. Adds the `tramiton-sbom` dependency. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>