SVS v0.3.0 — Supply-Chain Assurance

SVS v0.3.0 — Supply-Chain Assurance

Release date: 3 September 2026

SVS v0.3.0 turns the existing OSV scanner into a small, auditable assurance pipeline while preserving its conservative failure model.

Highlights

• Exact-byte SHA-256 receipts bind reports to the SBOM bytes actually parsed; svs verify-receipt verifies them later.
• Strict OpenVEX 0.2.0 inputs match only exact canonical versioned PURLs and exact advisory identities. Conflicts and free-text-only decisions never suppress findings, and chronology rejects timestamps whose -00:00 offset is explicitly unknown.
• Baselines classify occurrences as new, changed, unchanged, or absent from current without claiming that absence proves remediation.
• Strict policy JSON produces ordered violations and deterministic exit codes while still writing audit artifacts on policy failure.
• Report schema 1.1 is a strict producer contract for every emitted metadata, finding, and assurance object while the major-v1 consumer schema remains additive.
• SARIF carries compact assurance receipts and counts instead of duplicating full sidecar evidence. A policy failure remains a successful completed invocation with exit code 1.
• OpenVEX chronology preserves up to 18 fractional-second digits and retains both normalized UTC and original source timestamps.
• Pull-request summaries neutralize Markdown control characters and mentions from report-derived text, bound fields, and cap displayed policy violations.
• Offline negative, mutation, and boundary tests cover untrusted JSON, malformed CycloneDX/SPDX inventory structures, PURL mismatches, chronological VEX resolution, conflicts, baseline scope, policy failures, receipts, schemas, and output safety.
• Expected OSV discovery and enrichment failures exit 2 without reports; exit 1 is reserved for a completed policy failure with audit artifacts.
• Malformed OSV detail fields and OSV detail trees that exceed documented structural budgets also fail closed as operational exit 2, while summary consumers reject truthy-string receipt or policy values before rendering.
• CI validates formatting and deprecations, rejects symlinks and containment escapes before Pages staging, limits deployment credentials to the deploy job, checks representative SARIF against the pinned official OASIS schema, and smoke-tests both built distributions.

Compatibility

Existing svs scan --sbom ... --out ... usage remains valid. Assurance inputs are opt-in. JSON remains schema major 1, and svs summary continues to accept compatible 1.x plus recognizable unversioned legacy reports.

The versioned source tag and attached release artifacts are the maintainer-controlled publication boundary for this release.