> ## Documentation Index
> Fetch the complete documentation index at: https://doc.blueapi.ir/llms.txt
> Use this file to discover all available pages before exploring further.

# Dependency Safety and SBOM Management

> Dependency pinning, SBOM generation, CVE monitoring, offline mirror maintenance, and blocked package lists with automated build-time enforcement.

EMEP depends on model frameworks, numerical libraries, and system packages. A compromised dependency can poison merges, leak weights, or break reproducibility. This page defines the controls that keep the dependency graph safe and auditable.

## Dependency Pinning

All runtime and build dependencies use exact versions with cryptographic hashes. The lockfile format stores:

* Package name and exact version
* Hash algorithm (SHA-256) and value
* Source index or mirror URL
* License identifier

No floating versions are permitted in production builds. Development environments may use a relaxed lockfile that is promoted to exact pins before merge to main.

## SBOM

Every build produces a Software Bill of Materials in CycloneDX format with SPDX fallback. The SBOM includes:

* Direct and transitive dependencies
* Hashes and licenses
* Vulnerability identifiers (populated at build time from CVE database)
* Build timestamp and builder identity

The SBOM is attached to the artifact manifest and signed alongside the artifact.

## CVE Monitoring

| Cadence     | Action                                                    | Owner               |
| ----------- | --------------------------------------------------------- | ------------------- |
| Every build | Scan dependencies against CVE database; block on CRITICAL | CI pipeline         |
| Daily       | Re-scan production SBOMs for new CVEs                     | Security automation |
| Weekly      | Review HIGH CVEs and schedule patches                     | Security team       |
| Monthly     | Audit blocked-package and blocked-license lists           | Security team       |

## Blocked Lists

The build system maintains two deny lists:

* Blocked packages: known malicious or abandoned packages
* Blocked licenses: licenses incompatible with EMEP distribution goals

A dependency graph containing a blocked package fails the build immediately.

## Build-Time Flow

```mermaid theme={null}
flowchart LR
    START([PR / Build]) --> EXTRACT[Extract Dependencies]
    EXTRACT --> SCAN[Scan CVE Database]
    SCAN --> THRESHOLD{Threshold Check}
    THRESHOLD -->|CRITICAL found| BLOCK[Block Build + Alert]
    THRESHOLD -->|Clean| SBOM[Generate SBOM]
    SBOM --> SIGN[Sign SBOM]
    SIGN --> CONTINUE[Continue Build]
```

## Offline Mirror

Air-gapped deployments maintain an offline mirror of all dependencies. The mirror syncs from the public index on a scheduled interval through a one-way transfer. The mirror contents are hashed and signed. Builds in the air-gapped zone use only the offline mirror.

## Cross-Links

* [Security Requirements](/security/security-requirements)
* [Model Supply Chain](/security/model-supply-chain)
* [Offline Security](/security/offline-security)