Dependency Record

Go up to Terms and Definitions

A Dependency Record is a controlled information record that identifies and describes a Dependency and its relevant technical, legal, provenance, integrity, lifecycle, and usage characteristics.

The record may identify the Dependency name, type, version, source, supplier, license, integrity value, storage location, capture time, applicable platform, consuming process, associated artifact, and Provenance.

A Dependency Record allows a build, deployment, transfer, verification, or governance process to reason about a Dependency without inspecting the complete dependency content.

One or more Dependency Records may form a Dependency Manifest.

controlled information record that identifies and describes a dependency and its relevant technical, legal, provenance, integrity, lifecycle, and usage characteristics

Generalized from dependency management, configuration-item records, package metadata, software supply-chain records, and artifact inventories and specialized for the Crucible architecture and operational model.

A Dependency Record is not the Dependency itself. The record provides information required to identify, locate, verify, assess, transfer, or govern the Dependency.

A single Dependency may have several Dependency Records when different versions, sources, platforms, or lifecycle contexts apply.

A Dependency Record identifies a specific operating-system package by name, version, source repository, cryptographic digest, license, capture time, and the Image Build that consumed it.