Supply-Chain Capture

Go up to Terms and Definitions

Supply-Chain Capture is the controlled process of identifying, collecting, recording, and preserving the inputs, dependencies, artefacts, relationships, and evidence associated with the production and delivery of a system or software artefact.

The process may capture source revisions, installation media, packages, libraries, machine images, container images, infrastructure providers, build tools, compliance content, manifests, integrity values, licenses, and Provenance.

Supply-Chain Capture extends beyond Dependency Capture when it records the broader relationships among suppliers, sources, transformations, tools, processes, artefacts, and delivery mechanisms.

Within Crucible, Supply-Chain Capture supports reproducible builds, disconnected operations, transfer-bundle creation, verification, Auditability, and Supply-Chain Integrity.

controlled process of identifying, collecting, recording, and preserving the inputs, dependencies, artefacts, relationships, and evidence associated with the production and delivery of a system or software artefact

Generalized from software supply-chain management, dependency management, provenance, configuration management, and reproducible-build practice and specialized for the Crucible architecture and operational model.

Supply-Chain Capture does not require every external service or organizational relationship to be copied into a local store. The capture may preserve a controlled record or evidence reference when the original entity cannot be transferred.

The defined capture scope should identify which lifecycle stages, dependency classes, artefacts, and relationships the process covers.

Crucible captures the source revisions, Red Hat Enterprise Linux (RHEL) 9 installation media, downloaded packages, Ansible collections, Packer plugins, compliance content, scan results, image digests, and provider registration information associated with a Hardened Image.