Inventory local runtime artifacts in SBOM

2026-10-07 17:57:25 +03:00
parent a09e763ada
commit 20c90dbf29
6 changed files with 393 additions and 14 deletions
@@ -1,17 +1,19 @@
 # Preliminary component inventory

-`component-inventory.json` is a point-in-time CycloneDX 1.5 inventory assembled from the active Python virtual environment, `flutter_app/pubspec.lock`, and (when supplied) the bundled Flutter `NOTICES.Z` file. It is an engineering aid, not a complete or legally approved commercial SBOM.
+`component-inventory.json` is a point-in-time CycloneDX 1.5 inventory assembled from the active Python virtual environment, `flutter_app/pubspec.lock`, the installed PDFium native binary and its wheel-bundled build notices, observed local EasyOCR model weights, and (when supplied) the bundled Flutter `NOTICES.Z` file. Host-local runtime files are observations for the current machine, not a release artifact manifest. This is an engineering aid, not a complete or legally approved commercial SBOM.

 The generator performs local JSON and uniqueness checks; this snapshot has not yet been validated against the official [CycloneDX 1.5 JSON schema](https://github.com/CycloneDX/specification/blob/master/schema/bom-1.5.schema.json). The `pub` PURL type is listed by the [Package-URL type registry](https://github.com/package-url/purl-spec/blob/main/purl-types-index.json).

-## Snapshot captured on 2026-10-04
+## Snapshot captured on 2026-10-07

 - 50 Python distributions from `.venv`: 8 direct runtime requirements, 1 optional OCR requirement, and 41 installed transitive/development packages. Python versions are the versions installed in this local environment; `requirements.txt` still uses ranges and is not a fully pinned production lock.
 - 104 Flutter pub packages from the resolved lock: 15 direct main, 3 direct development, and 86 transitive/SDK packages.
 - 104 package license files have SHA-256 evidence. For 101 components the inventory can find a license file but deliberately does not classify its legal terms automatically. The remaining declarations come from distribution/package metadata or the Flutter SDK license notice.
 - The Windows Debug artifact bundled `NOTICES.Z` (SHA-256 `eb0096c70ca8a2b23d1a806f1fddb5ce379730712347b267b7c7de4599b8ba70`; 1,836,646 bytes after decompression). The application build already carries this Flutter notice archive.
+- Three host-local runtime artifacts are now hashed as CycloneDX file/model components. `pypdfium2` 5.13.0's `pdfium.dll` is 7,260,672 bytes (SHA-256 `fb898a1f5ace57805834f390407500bdb6ef93eff326a252ad334a8aae809d8e`); the inventory records hashes for 16 Windows x64 `BUILD_LICENSES` files shipped in the wheel.
+- EasyOCR 1.7.2's local `arabic.pth` (215,400,714 bytes; SHA-256 `2a9afd42c374deb98aed0b53c9b77d75e1d00d4e0501f3b0276c54190c89b1a8`) and `craft_mlt_25k.pth` (83,152,330 bytes; SHA-256 `4a5efbfb48b4081100544e75e1e2b57f8de3d84f213004b14b85fd4b3748db17`) match the MD5 identifiers in the pinned EasyOCR model configuration. This confirms artifact identity against that manifest, not redistribution rights; both model components remain marked for human license review. `english_g2.pth`, which the current Arabic/English reader expects, is absent from this host's OCR model directory and is recorded as missing. The OCR code may download it when first initializing because downloads are enabled by default.

-The inventory does not include dependency edges, a release-only Python environment, all native Windows/C++ components, a complete PDFium notice review, OCR model-weight files, or model weights. It does not decide whether any license permits a specific commercial distribution. Continue the manual source, hash, notice, and terms review in `LICENSE_REVIEW_2026-10.md` for the exact release artifacts.
+The inventory does not include dependency edges, a release-only Python environment, all native Windows/C++ components, or completed classification of PDFium/OCR notices. It does not decide whether any license permits a specific commercial distribution. Continue the manual source, hash, notice, and terms review in `LICENSE_REVIEW_2026-10.md` for the exact release artifacts.

 ## Regenerate

@@ -21,4 +23,4 @@ From the repository root, after installing Python requirements in `.venv` and re
 & .\.venv\Scripts\python.exe .\scripts\generate_component_inventory.py
 ```

-To hash the notices archive from a Windows build, add `--flutter-notices <path-to-NOTICES.Z>`. The script reads installed Python distribution metadata, the Flutter lock and package cache, and the passed notice archive; it does not install packages or inspect model weights.
+To hash the notices archive from a Windows build, add `--flutter-notices <path-to-NOTICES.Z>`. The script reads installed Python distribution metadata, the Flutter lock and package cache, the installed `pypdfium2_raw` binary and its license notices, the three EasyOCR model files from `LOCAL_OCR_MODEL_DIR` (or the app's default model directory), and the passed Flutter notice archive. It does not install packages, download models, or infer that a detected file is legally redistributable.
@@ -1,10 +1,10 @@
 {
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4b7c89bc-351c-4aa3-821c-471543ead589",
+  "serialNumber": "urn:uuid:4882e02b-7508-44a4-aff7-8df48bd03f2a",
  "version": 1,
  "metadata": {
-    "timestamp": "2026-10-04T01:47:26.714482+00:00",
+    "timestamp": "2026-10-07T14:56:01.658964+00:00",
    "tools": [
      {
        "name": "generate_component_inventory.py"
@@ -32,6 +32,14 @@
        "name": "inventory.flutter_lock_sha256",
        "value": "e29b3502666c804cf979f6d390e30ec04a668749ad86c13bb089d4b62d93bc8a"
      },
+      {
+        "name": "inventory.runtime_artifact_scope",
+        "value": "Observed files from the current host only; not a release artifact manifest."
+      },
+      {
+        "name": "inventory.missing_ocr_model",
+        "value": "english_g2.pth"
+      },
      {
        "name": "inventory.flutter_notices_sha256",
        "value": "eb0096c70ca8a2b23d1a806f1fddb5ce379730712347b267b7c7de4599b8ba70"
@@ -4570,6 +4578,141 @@
          }
        }
      ]
+    },
+    {
+      "type": "file",
+      "bom-ref": "file:PDFium native binary pdfium.dll:sha256:fb898a1f5ace57805834f390407500bdb6ef93eff326a252ad334a8aae809d8e",
+      "name": "PDFium native binary pdfium.dll",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "fb898a1f5ace57805834f390407500bdb6ef93eff326a252ad334a8aae809d8e"
+        }
+      ],
+      "properties": [
+        {
+          "name": "inventory.scope",
+          "value": "local-runtime-artifact"
+        },
+        {
+          "name": "inventory.observed_filename",
+          "value": "pdfium.dll"
+        },
+        {
+          "name": "inventory.size_bytes",
+          "value": "7260672"
+        },
+        {
+          "name": "inventory.license_status",
+          "value": "upstream and bundled dependency notices recorded; release review required"
+        },
+        {
+          "name": "inventory.evidence.python_distribution",
+          "value": "pypdfium2 5.13.0"
+        },
+        {
+          "name": "inventory.evidence.bundled_build_license_files",
+          "value": "{\"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/abseil.txt\": \"f54fff0b905df5b3464527c652a30e903b172d6dcab4d89b5e6f105d5e4a4603\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/agg23.txt\": \"c110d3ea2ad77467ce0dcff7d3337e6c8be8049a5103f4b9bd5fd911a77972e5\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/fast_float.txt\": \"bf1b57355feca8fce77ee95f48002f8d4789fb71b30ec7599c06cda4901fbb2b\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/freetype.txt\": \"f4b133e25df1f86ad3ffea453aa0e613f0474f34778dbbb3e437e7b2724937d8\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/icu.txt\": \"93679f4389d53b6835d89843f251844fb9bc455b35bab036d3c8e7abe497a47a\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/lcms.txt\": \"7312b68c5b25e9bf2b828706fb4e29588f22705112f411fd42e1f7d84c3d139a\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/libjpeg_turbo.ijg\": \"db16a04128171879c60708d171b88d97345a2dd20f9bfc173680a4497c73f704\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/libjpeg_turbo.md\": \"be2b2b5ab168bce87bc3e31f2a5c5adba4b7f6e9e51d618e958d1d46972ebd95\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/libopenjpeg.txt\": \"c5ab0890a737c2dfa7ba675036554f6d17741d98629b0c2a145354d00617e6b2\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/libpng.txt\": \"452390433ba0f88aa3e2b122c647741b72a0c117cd6ed7a329b49785aecb5511\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/libtiff.txt\": \"92b72ba97e6c2749c2a94bc0ef646b47080217f1e772a482b33cf5a5f98a6506\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/llvm-libc.txt\": \"3b6226c32e168c83b891d8d6f0d3c29c2116dc3ef93dc93c307b54f279ecf383\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/pdfium-binaries.txt\": \"8854f4388f1ca13b3ad9baa42e95f5546b4c0b17109c159256d3eca7be39b09b\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/pdfium.txt\": \"961eacd9633fff6d051db7208b755e9210e30efac7adec3e6a6d52798f0ccf0e\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/simdutf.txt\": \"c172a0ba936ff31230febb5dad869e25cb7c1a07480c7a381be8cf011bb52719\", \"pypdfium2-5.13.0.dist-info/licenses/data/windows_x64/BUILD_LICENSES/zlib.txt\": \"33fd641c9f3b0e0be64bc78fea9e94807674cdd70c48477599226cb8956565fe\"}"
+        }
+      ]
+    },
+    {
+      "type": "machine-learning-model",
+      "bom-ref": "file:EasyOCR model arabic.pth:sha256:2a9afd42c374deb98aed0b53c9b77d75e1d00d4e0501f3b0276c54190c89b1a8",
+      "name": "EasyOCR model arabic.pth",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2a9afd42c374deb98aed0b53c9b77d75e1d00d4e0501f3b0276c54190c89b1a8"
+        }
+      ],
+      "properties": [
+        {
+          "name": "inventory.scope",
+          "value": "local-runtime-artifact"
+        },
+        {
+          "name": "inventory.observed_filename",
+          "value": "arabic.pth"
+        },
+        {
+          "name": "inventory.size_bytes",
+          "value": "215400714"
+        },
+        {
+          "name": "inventory.license_status",
+          "value": "model redistribution terms not established; human review required"
+        },
+        {
+          "name": "inventory.evidence.upstream_manifest",
+          "value": "easyocr==1.7.2 config.py"
+        },
+        {
+          "name": "inventory.evidence.upstream_url",
+          "value": "https://github.com/JaidedAI/EasyOCR/releases/download/pre-v1.1.6/arabic.zip"
+        },
+        {
+          "name": "inventory.evidence.upstream_manifest_md5",
+          "value": "993074555550e4e06a6077d55ff0449a"
+        },
+        {
+          "name": "inventory.evidence.observed_md5",
+          "value": "993074555550e4e06a6077d55ff0449a"
+        },
+        {
+          "name": "inventory.evidence.upstream_md5_match",
+          "value": "true"
+        }
+      ]
+    },
+    {
+      "type": "machine-learning-model",
+      "bom-ref": "file:EasyOCR model craft_mlt_25k.pth:sha256:4a5efbfb48b4081100544e75e1e2b57f8de3d84f213004b14b85fd4b3748db17",
+      "name": "EasyOCR model craft_mlt_25k.pth",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "4a5efbfb48b4081100544e75e1e2b57f8de3d84f213004b14b85fd4b3748db17"
+        }
+      ],
+      "properties": [
+        {
+          "name": "inventory.scope",
+          "value": "local-runtime-artifact"
+        },
+        {
+          "name": "inventory.observed_filename",
+          "value": "craft_mlt_25k.pth"
+        },
+        {
+          "name": "inventory.size_bytes",
+          "value": "83152330"
+        },
+        {
+          "name": "inventory.license_status",
+          "value": "model redistribution terms not established; human review required"
+        },
+        {
+          "name": "inventory.evidence.upstream_manifest",
+          "value": "easyocr==1.7.2 config.py"
+        },
+        {
+          "name": "inventory.evidence.upstream_url",
+          "value": "https://github.com/JaidedAI/EasyOCR/releases/download/pre-v1.1.6/craft_mlt_25k.zip"
+        },
+        {
+          "name": "inventory.evidence.upstream_manifest_md5",
+          "value": "2f8227d2def4037cdb3b34389dcf9ec1"
+        },
+        {
+          "name": "inventory.evidence.observed_md5",
+          "value": "2f8227d2def4037cdb3b34389dcf9ec1"
+        },
+        {
+          "name": "inventory.evidence.upstream_md5_match",
+          "value": "true"
+        }
+      ]
    }
  ]
 }