vetto 0.2.14

Daemon-less sandbox + security layer for AI coding agents (Landlock/Seatbelt, TUI statusline, post-session audit reports)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# Software Bill of Materials (SBOM)

Vetto publishes a machine-readable Software Bill of Materials (SBOM) conforming to the [CycloneDX 1.5](https://cyclonedx.org/) specification for all release artifacts.

## Generating SBOM

To generate an SBOM locally:

```bash
./scripts/gen-sbom.sh [output-path.json]
```

This script will use `cargo-cyclonedx` if installed, or fall back to an integrated parser for `Cargo.lock` that extracts package names, versions, and SHA256 checksums.

## Release Integration

In CI / release trains, SBOM generation can be attached as a release step:

```yaml
- name: Generate CycloneDX SBOM
  run: ./scripts/gen-sbom.sh vetto-sbom.json

- name: Upload SBOM to release
  uses: softprops/action-gh-release@v1
  with:
    files: vetto-sbom.json
```