5.3 Capture and Preserve Dependencies [Dido Solutions, Inc Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== 5.3 Capture and Preserve Dependencies ======

[[dido:02-crusible:05-operational-concept:start|Go to 5. Operational Concept]]

[[dido:99_annexes:annex-b-terms-and-definitions:d:dependency_capture|Dependency Capture]] identifies, obtains, records, and preserves the [[dido:99_annexes:annex-b-terms-and-definitions:d:dependency|Dependencies]] required to perform a selected [[dido:99_annexes:annex-b-terms-and-definitions:o:operational_lifecycle|Operational Lifecycle]] activity.

Crucible treats Dependency Capture as a controlled lifecycle activity rather than an informal packaging step. The captured dependency set provides the inputs needed to reproduce a construction, assessment, transfer, deployment, validation, maintenance, or recovery activity without relying on undocumented or unavailable resources.

===== Dependency Identification =====

Crucible identifies the direct and transitive Dependencies required by the selected lifecycle activity.

Dependencies can include:

  * Source files
  * Software packages
  * Package metadata
  * Build tools
  * Compiler and interpreter versions
  * Generated source and generated artifacts
  * Base images
  * Container build inputs
  * [[dido:99_annexes:annex-b-terms-and-definitions:i:image_layer|Image Layers]]
  * [[dido:99_annexes:annex-b-terms-and-definitions:i:infrastructure_baseline|Infrastructure Baselines]]
  * Configuration files
  * Compliance content
  * Provider tools and plugins
  * Scripts
  * Runtime libraries
  * Environment assumptions
  * Other inputs required to reproduce or operate the result

A direct Dependency is explicitly referenced by the selected input or lifecycle activity. A transitive Dependency is required by another Dependency.

Dependency identification must account for both forms when the selected activity cannot complete without them.

===== Dependency Capture =====

Crucible captures an identified Dependency from an authorized source.

The capture activity records information needed to identify and retrieve the Dependency, including:

  * Dependency identifier
  * Dependency type
  * Version or revision
  * Source or origin
  * Retrieval location
  * Capture time
  * Integrity information
  * Applicable license or usage information, when available
  * The lifecycle activity requiring the Dependency
  * The relationship to other Dependencies

Crucible does not treat an unspecified latest version, mutable tag, undocumented workstation file, or unrecorded external service as a reproducible Dependency.

When an external resource cannot be captured directly, the resulting record identifies the unresolved Dependency and the effect on the selected lifecycle activity.

===== Dependency Manifest =====

A [[dido:99_annexes:annex-b-terms-and-definitions:d:dependency_manifest|Dependency Manifest]] identifies the Dependencies associated with a controlled lifecycle activity or resulting artifact.

The Dependency Manifest records:

  * Each identified Dependency
  * The selected version or revision
  * The Dependency source
  * The relationship between direct and transitive Dependencies
  * The expected integrity value
  * The capture status
  * The preservation status
  * Any unresolved or unavailable Dependency
  * The artifact, image, Baseline, deployment, or activity that uses the Dependency

The Dependency Manifest provides a controlled description of the dependency set. The manifest does not replace the preserved Dependency content.

===== Dependency Records =====

A [[dido:99_annexes:annex-b-terms-and-definitions:d:dependency_record|Dependency Record]] preserves information about an individual Dependency and its use.

A Dependency Record can identify:

  * The Dependency identifier
  * The selected revision
  * The origin
  * The integrity value
  * The capture operation
  * The preservation location
  * The consuming artifact or lifecycle activity
  * The applicable Dependency Manifest
  * The verification result
  * The associated [[dido:99_annexes:annex-b-terms-and-definitions:p:provenance|Provenance]]
  * The associated [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]]

Dependency Records allow a reader or automated process to determine which Dependency contributed to a result and where the preserved content resides.

===== Dependency Preservation =====

Crucible preserves captured Dependencies in a [[dido:99_annexes:annex-b-terms-and-definitions:d:dependency_store|Dependency Store]] or another authorized repository.

Preservation protects the Dependency from loss, unrecorded replacement, or reliance on a source that may later become unavailable.

The preservation activity records:

  * The preserved Dependency
  * The preservation location
  * The preserved revision
  * The integrity value
  * The preservation result
  * The applicable retention information
  * The relationship to the Dependency Manifest and Dependency Record

Preserving a Dependency does not authorize its use. Applicable security, licensing, compliance, export, import, and organizational controls continue to govern the Dependency.

===== Dependency Verification =====

Crucible verifies that a preserved Dependency corresponds to the identified Dependency.

Verification can include:

  * Comparison of content digests
  * Verification of a [[dido:99_annexes:annex-b-terms-and-definitions:d:digital_signature|Digital Signature]]
  * Confirmation of the Dependency identifier and revision
  * Confirmation of the source or origin
  * Confirmation that the preserved content remains readable and retrievable
  * Confirmation that the Dependency Manifest and Dependency Record identify the preserved content correctly

A successful integrity check establishes that the evaluated content matches the recorded value. It does not independently establish that the Dependency is secure, compliant, licensed, approved, or suitable for a particular use.

===== Connected and Disconnected Use =====

In a [[dido:99_annexes:annex-b-terms-and-definitions:c:connected_environment|Connected Environment]], Crucible can capture Dependencies from authorized external repositories and services.

Before operating in a [[dido:99_annexes:annex-b-terms-and-definitions:d:disconnected_environment|Disconnected Environment]] or [[dido:99_annexes:annex-b-terms-and-definitions:a:air-gapped_environment|Air-Gapped Environment]], Crucible must identify and preserve the Dependencies required by the selected lifecycle activity.

The preserved dependency set can be:

  * Included in a [[dido:99_annexes:annex-b-terms-and-definitions:t:transfer_bundle|Transfer Bundle]]
  * Transferred through an authorized process
  * Imported into the destination environment
  * Stored in a local Dependency Store
  * Used to populate [[dido:99_annexes:annex-b-terms-and-definitions:o:offline_repository|Offline Repositories]]
  * Verified before disconnected execution

The disconnected lifecycle activity must not depend on an unauthorized or unavailable resource outside the applicable operational boundary.

===== Capture and Preservation Result =====

The capture and preservation result identifies:

  * The selected lifecycle activity
  * The Dependency Manifest
  * The Dependency Records
  * The identified direct and transitive Dependencies
  * The capture status of each Dependency
  * The preservation status of each Dependency
  * The preservation locations
  * The integrity and verification results
  * Any missing, unresolved, or unauthorized Dependency
  * The associated Provenance
  * The associated Traceability
  * The generated [[dido:99_annexes:annex-b-terms-and-definitions:e:evidence|Evidence]]

The preserved dependency set becomes a controlled input to subsequent construction, assessment, transfer, deployment, validation, maintenance, reproduction, or recovery activities.

===== Requirements Addressed =====

^ Requirement ^ Statement ^
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-001]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-001#Statement&noheader&nofooter&noeditbtn}} |
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-002]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-002#Statement&noheader&nofooter&noeditbtn}} |
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-003]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-003#Statement&noheader&nofooter&noeditbtn}} |
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-004]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-004#Statement&noheader&nofooter&noeditbtn}} |
| [[dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-005]] | {{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-10-dependency-capture-and-offline-transfer:fr-depc-005#Statement&noheader&nofooter&noeditbtn}} |

The linked leaf requirement pages remain the canonical sources.
----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>