> ## Documentation Index
> Fetch the complete documentation index at: https://doc.blueapi.ir/llms.txt
> Use this file to discover all available pages before exploring further.

# Dependency Safety and SBOM Management

> Dependency pinning, SBOM generation, CVE monitoring, offline mirror maintenance, and blocked package lists with automated build-time enforcement.

EMEP depends on model frameworks, numerical libraries, and system packages. A compromised dependency can poison merges, leak weights, or break reproducibility. This page defines the controls that keep the dependency graph safe and auditable.

## Dependency Pinning

All runtime and build dependencies use exact versions with cryptographic hashes. The lockfile format stores:

* Package name and exact version
* Hash algorithm (SHA-256) and value
* Source index or mirror URL
* License identifier

No floating versions are permitted in production builds. Development environments may use a relaxed lockfile that is promoted to exact pins before merge to main.

## SBOM

Every build produces a Software Bill of Materials in CycloneDX format with SPDX fallback. The SBOM includes:

* Direct and transitive dependencies
* Hashes and licenses
* Vulnerability identifiers (populated at build time from CVE database)
* Build timestamp and builder identity

The SBOM is attached to the artifact manifest and signed alongside the artifact.

## CVE Monitoring

| Cadence | Action | Owner |
| - | - | - |
| Every build | Scan dependencies against CVE database; block on CRITICAL | CI pipeline |
| Daily | Re-scan production SBOMs for new CVEs | Security automation |
| Weekly | Review HIGH CVEs and schedule patches | Security team |
| Monthly | Audit blocked-package and blocked-license lists | Security team |

## Blocked Lists

The build system maintains two deny lists:

* Blocked packages: known malicious or abandoned packages
* Blocked licenses: licenses incompatible with EMEP distribution goals

A dependency graph containing a blocked package fails the build immediately.

## Build-Time Flow

```mermaid theme={null}
flowchart LR
    START([PR / Build]) --> EXTRACT[Extract Dependencies]
    EXTRACT --> SCAN[Scan CVE Database]
    SCAN --> THRESHOLD{Threshold Check}
    THRESHOLD -->|CRITICAL found| BLOCK[Block Build + Alert]
    THRESHOLD -->|Clean| SBOM[Generate SBOM]
    SBOM --> SIGN[Sign SBOM]
    SIGN --> CONTINUE[Continue Build]
```

## Offline Mirror

Air-gapped deployments maintain an offline mirror of all dependencies. The mirror syncs from the public index on a scheduled interval through a one-way transfer. The mirror contents are hashed and signed. Builds in the air-gapped zone use only the offline mirror.

## Cross-Links

* [Security Requirements](https://doc.blueapi.ir/security/security-requirements.md)
* [Model Supply Chain](https://doc.blueapi.ir/security/model-supply-chain.md)
* [Offline Security](https://doc.blueapi.ir/security/offline-security.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.