compliance-bundler

End-to-end compliance bundle agent — CycloneDX SBOM + SPDX licenses + SARIF findings + OpenVEX/CycloneDX VEX, optional cosign signing, optional Vulnetix upload, manifest.json with SHA-256 sums, Markdown index.

Compliance Bundler Agent

Use when

  • Assembling an audit deliverable (SOC 2, ISO 27001, FedRAMP).
  • Building a customer-facing security disclosure.
  • Producing the quarterly compliance archive.
  • Pre-release: the bundle ships with the release.
  • Replacing manual SBOM + VEX + SARIF generation with one orchestrated run.

Stage 1: Capabilities

Read .vulnetix/capabilities.yaml. Note binaries.cosign, binaries.syft.

Stage 2: Generate artifacts in parallel

OUT=".vulnetix/compliance/$(date -u +%Y%m%dT%H%M%SZ)"
mkdir -p "$OUT"

vulnetix scan -o json-cyclonedx > "$OUT/sbom.cdx.json" &
vulnetix license -o json-spdx > "$OUT/licenses.spdx.json" &
vulnetix scan --evaluate-sast --evaluate-secrets --evaluate-sca -o json-sarif > "$OUT/findings.sarif" &
vulnetix triage --provider vulnetix --vex-format cyclonedx -o json > "$OUT/vex.cdx.json" &
[[ "$has_syft" == "true" ]] && syft "$(pwd)" -o cyclonedx-json > "$OUT/sbom.syft.cdx.json" &
wait

Stage 3: Sign (conditional)

If binaries.cosign: true AND user passed --sign:

cosign sign-blob --yes "$OUT/sbom.cdx.json" --bundle "$OUT/sbom.cdx.json.sig.bundle"
cosign sign-blob --yes "$OUT/findings.sarif" --bundle "$OUT/findings.sarif.sig.bundle"
cosign sign-blob --yes "$OUT/vex.cdx.json" --bundle "$OUT/vex.cdx.json.sig.bundle"

Stage 4: Manifest + index

Compute sha256 sums for every artifact. Write $OUT/manifest.json and a Markdown $OUT/README.md index.

Stage 5: Optional upload

If user passes --upload:

vulnetix upload --file "$OUT/sbom.cdx.json"
vulnetix upload --file "$OUT/vex.cdx.json"

Stage 6: Report

Compliance bundle: $OUT
- SBOM: <count> components, <count> deps
- Licenses: <count>, conflicts: <n>
- Findings: <crit/high/med/low>
- VEX: <statements>
- Signed: <yes|no>
- Uploaded: <yes|no>

Edge cases & gotchas

  • Four parallel CLI calls + optional syft cross-validation — pace by 1s on rate limits.
  • Cosign signing prefers keyless OIDC (Fulcio); local devs without OIDC must use --key file:cosign.key.
  • Manifest.json SHA-256 sums computed AFTER signing — re-verify with sha256sum -c manifest.json before archive.
  • Optional --upload sends VEX only; SBOM/SARIF/SPDX stay local unless --upload-all.
  • Output dir is .vulnetix/compliance/<ISO8601>/; multiple runs create siblings, never overwrite.
  • Empty repo (no manifests) produces a near-empty SBOM; verify components.length > 0 before publishing.