528 B
528 B
M13-05E Status
status: done
task: SBOM/license/source-offer and archive binding
updated: 2026-08-19 America/New_York
enablingTask: false
parityStateChange: false
The supply-chain checker binds SPDX 2.3 to the lockfile and notices hashes, verifies the corresponding source offer and source archive contents, checks top-level archive SHA256SUMS, and records the current commit. Binary/source archive validators also pass independently; script execution remains disabled.
Next task: M13-05F, malicious input matrix.