EPPA SBOM, SOUP and Vulnerability Policy

EPPA generates dependency artifacts from reproducible dependency inputs:

• Node dependencies: fronts/eppa/package-lock.json
• Python dependencies: fronts/eppa/python/requirements.txt

Generate artifacts locally:

cd fronts/eppa
python3 scripts/supply_chain.py generate --artifact-dir .supply-chain-artifacts

The command writes:

• .supply-chain-artifacts/eppa-sbom.cyclonedx.json
• .supply-chain-artifacts/eppa-soup-register.json

These generated files are CI/release artifacts and are not committed by default.

Vulnerability Gate

CI enforces a high severity threshold. Any non-allowlisted dependency finding with severity high or critical fails the build.

The gate accepts JSON reports from npm audit --json, pip-audit -f json, or a generic fixture/report format:

For npm reports, the normalizer evaluates concrete advisory objects at their own severity. Dependency-path nodes are not duplicated as separate vulnerabilities.

{
  "findings": [
    {
      "ecosystem": "python",
      "package": "example",
      "id": "CVE-2099-0001",
      "severity": "high",
      "title": "example finding"
    }
  ]
}

Allowlist entries live in fronts/eppa/docs/security/dependency-vulnerability-allowlist.json. Every entry must include an ecosystem, package, vulnerability id, reason, owner, and expiry date. Expired entries must be removed or re-reviewed before release.

python3 scripts/supply_chain.py vulnerability-check \
  --severity-threshold high \
  --allowlist docs/security/dependency-vulnerability-allowlist.json \
  --reports .supply-chain-artifacts/npm-audit.json .supply-chain-artifacts/pip-audit.json