====== 5.3 Capture and Preserve Dependencies ====== [[dido:02-crusible:05-operational-concept:start|Go to 5. Operational Concept]] [[dido:99_annexes:annex-b-terms-and-definitions:d:dependency_capture|Dependency Capture]] identifies, obtains, records, and preserves the [[dido:99_annexes:annex-b-terms-and-definitions:d:dependency|Dependencies]] required to perform a selected [[dido:99_annexes:annex-b-terms-and-definitions:o:operational_lifecycle|Operational Lifecycle]] activity. Crucible treats Dependency Capture as a controlled lifecycle activity rather than an informal packaging step. The captured dependency set provides the inputs needed to reproduce a construction, assessment, transfer, deployment, validation, maintenance, or recovery activity without relying on undocumented or unavailable resources. ===== Dependency Identification ===== Crucible identifies the direct and transitive Dependencies required by the selected lifecycle activity. Dependencies can include: * Source files * Software packages * Package metadata * Build tools * Compiler and interpreter versions * Generated source and generated artifacts * Base images * Container build inputs * [[dido:99_annexes:annex-b-terms-and-definitions:i:image_layer|Image Layers]] * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_baseline|Infrastructure Baselines]] * Configuration files * Compliance content * Provider tools and plugins * Scripts * Runtime libraries * Environment assumptions * Other inputs required to reproduce or operate the result A direct Dependency is explicitly referenced by the selected input or lifecycle activity. A transitive Dependency is required by another Dependency. Dependency identification must account for both forms when the selected activity cannot complete without them. ===== Dependency Capture ===== Crucible captures an identified Dependency from an authorized source. The capture activity records information needed to identify and retrieve the Dependency, including: * Dependency identifier * Dependency type * Version or revision * Source or origin * Retrieval location * Capture time * Integrity information * Applicable license or usage information, when available * The lifecycle activity requiring the Dependency * The relationship to other Dependencies Crucible does not treat an unspecified latest version, mutable tag, undocumented workstation file, or unrecorded external service as a reproducible Dependency. When an external resource cannot be captured directly, the resulting record identifies the unresolved Dependency and the effect on the selected lifecycle activity. ===== Dependency Manifest ===== A [[dido:99_annexes:annex-b-terms-and-definitions:d:dependency_manifest|Dependency Manifest]] identifies the Dependencies associated with a controlled lifecycle activity or resulting artifact. The Dependency Manifest records: * Each identified Dependency * The selected version or revision * The Dependency source * The relationship between direct and transitive Dependencies * The expected integrity value * The capture status * The preservation status * Any unresolved or unavailable Dependency * The artifact, image, Baseline, deployment, or activity that uses the Dependency The Dependency Manifest provides a controlled description of the dependency set. The manifest does not replace the preserved Dependency content. ===== Dependency Records ===== A [[dido:99_annexes:annex-b-terms-and-definitions:d:dependency_record|Dependency Record]] preserves information about an individual Dependency and its use. A Dependency Record can identify: * The Dependency identifier * The selected revision * The origin * The integrity value * The capture operation * The preservation location * The consuming artifact or lifecycle activity * The applicable Dependency Manifest * The verification result * The associated [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]] * The associated [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]] Dependency Records allow a reader or automated process to determine which Dependency contributed to a result and where the preserved content resides. ===== Dependency Preservation ===== Crucible preserves captured Dependencies in a [[dido:99_annexes:annex-b-terms-and-definitions:d:dependency_store|Dependency Store]] or another authorized repository. Preservation protects the Dependency from loss, unrecorded replacement, or reliance on a source that may later become unavailable. The preservation activity records: * The preserved Dependency * The preservation location * The preserved revision * The integrity value * The preservation result * The applicable retention information * The relationship to the Dependency Manifest and Dependency Record Preserving a Dependency does not authorize its use. Applicable security, licensing, compliance, export, import, and organizational controls continue to govern the Dependency. ===== Dependency Verification ===== Crucible verifies that a preserved Dependency corresponds to the identified Dependency. Verification can include: * Comparison of content digests * Verification of a [[dido:99_annexes:annex-b-terms-and-definitions:d:digital_signature|Digital Signature]] * Confirmation of the Dependency identifier and revision * Confirmation of the source or origin * Confirmation that the preserved content remains readable and retrievable * Confirmation that the Dependency Manifest and Dependency Record identify the preserved content correctly A successful integrity check establishes that the evaluated content matches the recorded value. It does not independently establish that the Dependency is secure, compliant, licensed, approved, or suitable for a particular use. ===== Connected and Disconnected Use ===== In a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]], Crucible can capture Dependencies from authorized external repositories and services. Before operating in a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] or [[dido:99_annexes:annex-b-terms-and-definitions:a:air-gapped_environment|Air-Gapped Environment]], Crucible must identify and preserve the Dependencies required by the selected lifecycle activity. The preserved dependency set can be: * Included in a [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]] * Transferred through an authorized process * Imported into the destination environment * Stored in a local Dependency Store * Used to populate [[dido:99_annexes:annex-b-terms-and-definitions:o:offline_repository|Offline Repositories]] * Verified before disconnected execution The disconnected lifecycle activity must not depend on an unauthorized or unavailable resource outside the applicable operational boundary. ===== Capture and Preservation Result ===== The capture and preservation result identifies: * The selected lifecycle activity * The Dependency Manifest * The Dependency Records * The identified direct and transitive Dependencies * The capture status of each Dependency * The preservation status of each Dependency * The preservation locations * The integrity and verification results * Any missing, unresolved, or unauthorized Dependency * The associated Provenance * The associated Traceability * The generated [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]] The preserved dependency set becomes a controlled input to subsequent construction, assessment, transfer, deployment, validation, maintenance, reproduction, or recovery activities. ===== Requirements Addressed ===== ^ Requirement ^ Statement ^ | [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-001]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-001#Statement&noheader&nofooter&noeditbtn}} | | [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-002]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-002#Statement&noheader&nofooter&noeditbtn}} | | [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-003]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-003#Statement&noheader&nofooter&noeditbtn}} | | [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-004]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-004#Statement&noheader&nofooter&noeditbtn}} | | [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-005]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-005#Statement&noheader&nofooter&noeditbtn}} | The linked leaf requirement pages remain the canonical sources. ---- © 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.