Notes
Working notes on evidence, verification and the standards ActaSeal is built against. Written when there is something to record, not on a schedule.
-
A CBOM can pass schema validation and still be wrong
A real, anonymized CycloneDX CBOM that validates cleanly against the schema while getting three load-bearing facts wrong. The schema checks shape, not meaning.
-
What a verifier signing its own result proves
An offline checker with no separately trusted identity gains nothing by signing its own verdict. What the emitted result has to preserve instead.
CBOM semantic checker: github.com/actaseal/cbom-check.