jobtrackingapp/docs/verification/jt-017-dotnet-provenance.md

JT-017 supply-chain provenance verification

Implemented

• global.json requests .NET SDK 9.0.317 with patch-only roll-forward.
• CI validates and installs that exact SDK instead of accepting any .NET 9 feature band.
• API and test projects opt into NuGet lock files.
• Both direct and transitive package versions carry NuGet content hashes in committed packages.lock.json files.
• CI restores both projects with --locked-mode, so unreviewed graph drift fails before build or test.
• A standard-library tracked-file scanner blocks high-confidence credential patterns without printing values.
• A deterministic CycloneDX 1.5 generator combines the npm, NuGet and hash-locked Python dependency graphs.
• CI tests both controls, scans the tracked tree and generates a 964-component SBOM under ignored build artifacts.
• The review/exception/credential-response rules are documented in docs/security/supply-chain-policy.md.

Proof

• Clean forced lock generation completed from the declared projects.
• A subsequent locked restore passed.
• Full backend suite: 719/719 passed.
• dotnet list JobTrackerApi/JobTrackerApi.csproj package --vulnerable --include-transitive reports no known vulnerable packages from the current NuGet source.
• Supply-chain unit tests: 3/3 passed, including seven synthetic credential canaries and deterministic npm/NuGet/PyPI coverage.
• The current tracked tree has no high-confidence credential-pattern findings.
• Repeated SBOM generation is byte-stable for unchanged lock inputs and includes React, Entity Framework Core and FastAPI representatives.

Remaining JT-017 scope

• Pin third-party CI actions and Docker images by reviewed immutable SHA/digest.
• Hash or replace the downloaded dotnet-install.sh bootstrap path.
• Retain the SBOM as a CI artifact once an immutable artifact action or approved runner store is available.
• Add a policy-owned container CVE/licence scan with a tested canary once the Docker daemon/scanner is available.
• Resolve or formally isolate the remaining Torch/Transformers advisories under the model-loading threat path.

Those items require approved registry/action metadata, network-backed upstream verification or a separately reviewed scanner/update process; this increment does not invent immutable identifiers without verifying them.