Supply-chain integrity
At a glance
Section titled “At a glance”NextPDF’s supply-chain controls operate at two points: CI gates that run on every dependency-changing pull request and every version tag, and the release workflow, which configures provenance generation, keyless signing, and SBOM emission.
| Control | Type |
|---|---|
CycloneDX 1.7 SBOM of the build | CI gate, hard |
| in-toto statement committing to the build inputs | CI gate, hard |
| SHA-256 dependency-fingerprint diff against a pinned baseline | CI gate, hard |
| OpenVEX consistency check against the dependency advisory policy | CI gate, hard |
| Cross-fixture determinism check | CI check, best-effort |
Pinned slsa-github-generator provenance generation | Workflow configuration — release workflow |
Sigstore cosign keyless signing with Rekor transparency logging | Workflow configuration — release workflow |
CycloneDX 1.7 and SPDX 2.3 SBOM emission | Workflow configuration — release workflow |
Nightly php-fuzzer matrix over the parser and writer paths | Scheduled CI |
CI gates
Section titled “CI gates”Every pull request that touches dependencies, and every version tag, runs:
| Check | What it does | Gate |
|---|---|---|
| Inventory | Emits a CycloneDX 1.7 SBOM of the build | Hard |
| Build-input record | Emits an in-toto statement committing to the build inputs | Hard |
| Dependency integrity | Diffs SHA-256 byte-fingerprints against a pinned baseline | Hard |
| VEX consistency | Requires every entry in the dependency advisory policy to have a matching statement in the repository’s OpenVEX v0.2.0 document | Hard |
| Reproducibility | Runs a determinism check across fixtures | Best-effort |
The dependency-integrity gate diffs SHA-256 byte-fingerprints of the dependency tree against a baseline pinned in the repository, independent of package metadata.
Release workflow configuration
Section titled “Release workflow configuration”Provenance — workflow configuration
Section titled “Provenance — workflow configuration”The release workflow pins the canonical slsa-github-generator reusable workflow,
which is configured to generate in-toto provenance inside an isolated, ephemeral
builder, and configures slsa-verifier to run inline against the generator’s output.
Signing and transparency — workflow configuration
Section titled “Signing and transparency — workflow configuration”The release workflow configures Sigstore cosign keyless signing for the artifact
bundle, with transparency logging to Rekor. Keyless signing derives a short-lived
certificate from the workflow’s GitHub Actions OIDC identity
(https://token.actions.githubusercontent.com) for each run.
SBOM — workflow configuration
Section titled “SBOM — workflow configuration”The release workflow configures dual SBOM emission — a CycloneDX 1.7 document and
an SPDX 2.3 document.
Fuzzing
Section titled “Fuzzing”A nightly php-fuzzer matrix, together with an AST/structure-tree harness, exercises
the parser and writer paths.