605841e443
docs: v1.0.0 Beta Release - Pen Testing & Bug Bounty Ready
...
- BETA-RELEASE.md: Complete security testing guide
- Attack surface overview (HAProxy, WAF, LXC, P2P)
- High-value targets and secrets locations
- Known weak points (intentional disclosure)
- Bug bounty scope and reporting guidelines
- Test environment setup (VirtualBox, Docker)
- SECURITY.md: Updated with Hall of Fame and beta info
- README.md: Version bump to 1.0.0-beta
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-03-15 18:45:29 +01:00
8769a60275
feat(sbom): Add CRA Annex I compliant SBOM pipeline
...
Implements comprehensive Software Bill of Materials generation for
EU Cyber Resilience Act compliance with ANSSI CSPN certification path.
SBOM Pipeline:
- scripts/check-sbom-prereqs.sh: Prerequisites validation (OpenWrt, tools, Kconfig)
- scripts/sbom-generate.sh: Multi-source SBOM generation (native, feed, rootfs, firmware)
- scripts/sbom-audit-feed.sh: PKG_HASH/PKG_LICENSE feed audit with MANIFEST.md
- Makefile: SBOM targets (sbom, sbom-quick, sbom-validate, sbom-scan, sbom-audit)
- .github/workflows/sbom-release.yml: CI with CVE gating and auto-security issues
Documentation:
- SECURITY.md: CRA Art. 13 §6 compliant vulnerability disclosure policy
- docs/sbom-pipeline.md: Architecture, CRA mapping, ANSSI CSPN guidance
AI Gateway (bonus feed):
- secubox-ai-gateway: 3-tier data classification (LOCAL_ONLY/SANITIZED/CLOUD_DIRECT)
- luci-app-ai-gateway: LuCI dashboard with provider management and audit logging
Output formats: CycloneDX 1.6 (primary) + SPDX 2.3 (secondary)
Tools: syft, grype, cyclonedx-cli (auto-installed if missing)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-03-04 08:01:00 +01:00
