Open integration software supply-chain assurance
This page covers the public synapse-cdm package and its release process. It does not describe or make assurance claims about the proprietary SynapseCommand decision runtime.
The controls expose risk and make release evidence inspectable. They do not make software secure by definition and do not constitute certification or third-party audit.
From commit to verifiable artefact
Each stage contributes evidence about a defined part of the release. No single stage guarantees all stages before it.
- 1. Source commitThe reviewed source and workflow definitions at a named revision.
- 2. Tests and conformanceThe package suite, adapter conformance sweep and evidence generation must pass.
- 3. Static and dependency checksCodeQL, dependency auditing and secret-history checks expose defined classes of risk.
- 4. Package buildThe wheel and source distribution are built once from the gated tree.
- 5. SBOMsSPDX and CycloneDX documents describe the clean installation and its runtime closure.
- 6. Hashes and attestationsSHA-256 digests and build provenance bind named artefacts to the release workflow.
- 7. Trusted publicationA short-lived OIDC identity publishes the package without a stored package-registry token.
- 8. Independent verificationRelease assets let an evaluator check digests, attestations, conformance and evidence.
What each control checks, and what it does not prove
- CodeQL security-extended
- Checks: Python and JavaScript or TypeScript source with the security-extended query suite. Findings rated high or critical block the gate.
- Does not prove: Static analysis does not inspect dependency advisories and does not prove the absence of defects.
- GitHub dependency review
- Checks: New dependencies introduced through a pull request, with high-severity findings configured to fail.
- Does not prove: It applies to pull requests. The separate strict package audit covers the dependency set on pushes and releases.
- pip-audit --strict
- Checks: The development environment and the built wheel's frozen third-party closure in a clean environment.
- Does not prove: It reports known published advisories. It is not a source-code audit of those dependencies.
- Gitleaks full-history scan
- Checks: The full Git history reachable from the run, using a versioned Gitleaks binary whose download is hash-checked.
- Does not prove: A clean scan means no configured pattern matched. It cannot establish that no secret exists under every possible encoding or pattern.
- Dependabot
- Checks: Python package, workflow-action and documentation dependencies on a weekly update cadence.
- Does not prove: Update automation identifies available changes. Review, tests and release gates still decide what is accepted.
Release 3.3.0, 8 October 2026
Package 3.3.0, CDM schema 3.0.0, Adapter API 3.1.0, manifest schema 2.1.0 and evidence schema 2.0.0. The digests below are the values the GitHub release reports for each asset. This site has not recomputed them, verified a signature or rerun the release.
| Asset | Size | SHA-256, release-reported | What it is |
|---|---|---|---|
| synapse_cdm-3.3.0-py3-none-any.whl | 8280 KiB | 3201f2ac892b99cb0f72e07fea62924ed2b2e3dc45c1da94a59dce9f7179441f | Built wheel. PyPI reports the same digest. |
| synapse_cdm-3.3.0.tar.gz | 5894 KiB | 5d678dbe911eeb3cbeadb476746fd91f14ab704bb5bbac456b99b4dfc9d1e351 | Source distribution. PyPI reports the same digest. |
| synapse_cdm.spdx.json | 108 KiB | 7ca88ade561b57b4b42b27bd365a74c7c13e8a983fd2cbe068f31a8b758b3d94 | SPDX bill of materials. |
| synapse_cdm.cdx.json | 68 KiB | e9dd569c75b244d1b3831e69f2502e3cca27e37e4eba5b9e72ea6f8ac264a26f | CycloneDX bill of materials. |
| conformance-3.3.0.json | 485 KiB | e21c7e2b1bb030cc7a9404de7b70fbbc42bd23bfad325765cdb3151a43d0690b | Publisher's machine-readable conformance report. Not aggregated by this site. |
| evidence-3.3.0.tar.gz | 251 KiB | ceee6598936369a227d7785b29fdc22e8a189de169c61944430cfd0568a7f697 | Per-adapter evidence records. |
| witness-3.3.0.json | 2 KiB | 55c8c01ac0b1601b8cbb58e8f234cb09f2578d4b471d7f2653cf9ce68736303b | Publisher's witness record for this release. |
| SHA256SUMS | 1 KiB | 5a713b84cee7715568d71cf3f6405d0ca9f41f577b8e8802b43606dae3007d35 | Publisher-published digest list. |
| release-notes-3.3.0.md | 82 KiB | d452e739d2d72be031df0dbefb7edd357f4392ff14f573de14ef2085d1d03b37 | Release notes, the source of the fixture and clean-wheel totals shown here. |
- Fixture verdicts
- 596, 0 failed, across 21 adapters.
- Clean-wheel verdicts
- 1,192 across 2 schema modes, 0 failed.
Both totals are publisher-reported in the 3.3.0 release notes and are separate populations, not one total. Per-check outcomes and semantic conformance totals for 3.3.0 are not reported there and are not aggregated by this site.
What release 2.2.0 published
These are the assets attached to Release v2.2.0 of the synapse-cdm package, with the names the release serves. Each SHA-256 digest below is reported by the release, published by the maintainers in the SHA256SUMS file, and was recomputed from the downloaded bytes when this page was prepared. All three agreed. Recomputing a digest confirms the bytes, not the trustworthiness of what they contain.
| Asset | Size | SHA-256 | What it is |
|---|---|---|---|
| synapse_cdm-2.2.0-py3-none-any.whl | 7052 KiB | e0e87ff1bb5646e8d7503ce26d7bd55973d5f872a99f6b8f3f8b1ce25b42de23 | Built wheel. The same digest is reported by the package index for this release. |
| synapse_cdm-2.2.0.tar.gz | 5055 KiB | 4a2c79fde212dcc172f73ccea5933e23e3c81ff5a7a5e4d333e786c1870ca82a | Source distribution. The ontology Turtle modules are not inside it; they live in the repository at the release tag. |
| synapse_cdm.spdx.json | 108 KiB | 759d2272e80a85f7e4ba36cc1372534b08665ba645ad887815e673099f53337a | SPDX 2.3 bill of materials over the clean installation, 19 packages described. |
| synapse_cdm.cdx.json | 68 KiB | af4de5f3a5f4ccbb6401aa143130e6a556946b2f357c3af9e2636d6daec557be | CycloneDX 1.7 bill of materials over the same installation, 50 components described. |
| conformance-2.2.0.json | 257 KiB | 01131690c7ac046eaac3ef8c881c22c5eb2c19aaf577ac398495ca1354422480 | Machine-readable adapter conformance report for this release, generated by the publisher's sweep. |
| evidence-2.2.0.tar.gz | 138 KiB | c28bc7cf468b4847fca8dcac82a26f4f16797a7ce9471380da9136c6800afa44 | Per-adapter evidence records, one evidence.json for each of the fourteen adapters at adapter version 1.0.0. |
| SHA256SUMS | 1 KiB | ca7af4c544f47b95058eec748462e308a7f5e46e79cd79d5893cfc2ec2e00148 | Publisher-published digests covering both distributions, both bills of materials, the conformance report and the evidence bundle. |
| release-notes-2.2.0.md | 44 KiB | 1b48d07165db5a10e79759c59a900571bb9096467ca900084b62b5590a4911d3 | Release notes, the publisher-reported source of the fixture and clean-wheel totals shown on this site. |
Six claims that are not the same claim, release 2.2.0
A control defined in a workflow file is not a run, a run is not a published artefact, a published digest is not a verified signature, and none of these is an independent reproduction. Each state below is recorded separately for release 2.2.0.
- 1. Workflow configuration
Established here
A control is defined in a tracked workflow file at the release commit.
The release, CodeQL and dependency-review workflow files are readable at the release tag. Configuration alone does not show that a run happened or that the organisation enforced it.
- 2. Named executed run
Not established here
A specific workflow execution is identified for this release.
No workflow run identifier for the 2.2.0 release has been read from source here, so no executed run is asserted on this page.
- 3. Published artefact
Established here
The release carries the artefact the control is said to produce.
Eight assets are attached to Release v2.2.0, including both bills of materials, the conformance report and the evidence bundle.
- 4. Recomputed byte digest
Established here
The published bytes hash to the published digest.
Every asset above was downloaded once and its SHA-256 digest recomputed. All recomputed digests matched both the release API digest and the publisher's SHA256SUMS file.
- 5. Verified attestation
Publisher-reported
A build-provenance attestation is retrieved and cryptographically verified.
An attestation is present in the platform attestation store for the wheel digest, and the release notes state the workflow verifies it. No signature verification was performed here, so this is reported rather than independently verified.
- 6. Independent reproduction
Not established here
An outside party rebuilds or reruns and obtains the same result.
The conformance and clean-wheel totals shown on this site are the publisher's run. They were not rerun on independent infrastructure.
What the historical 2.2.0 conformance report contains
The report is generated by the maintainers with package 2.2.0, CDM schema 2.1.0 and Adapter API 2.1.0. Reading it gives 210 dimension verdicts, which is 14 adapters against 15 dimensions A to O: 184 PASS, 0 FAIL and 26 SKIP. A SKIP is a check that did not apply or did not run, never a pass.
The six fixture checks A, B, C, D, E, F run over 538 fixtures each and produce 2678 passing, 0 failing and 550 skipped fixture outcomes. Dimension verdicts and fixture outcomes count different things and are not added together or expressed as one score. The release notes report 538 fixture verdicts with 0 failures and 1076 clean-wheel verdicts over two schema modes. Those totals are the maintainers' own run, reported for release 2.2.0 and not carried over from the earlier 2.1.2 record, which the site keeps separately as a historical assertion.
A conformance report describes shipped adapters against packaged fixtures. It is not acceptance of a deployed system, a certification, or evidence about the proprietary SynapseCommand runtime. For the package itself, its versions and how to install it, see the open integration package.
Two machine-readable inventories
Release 3.3.0 includes SPDX and CycloneDX software bills of materials and a publisher-published SHA256SUMS file. Evaluators can download the assets, recalculate each SHA-256 digest and compare it with the release table above. A linked file proves only that it is available.
Short-lived identities, verifiable artefacts
The release workflow uses GitHub build provenance attestation backed by Sigstore and OIDC for the wheel, source distribution, both SBOMs and the evidence bundle, then verifies those attestations in the same run. PyPI Trusted Publishing over OIDC uploads the distribution without a stored registry token. This is build provenance and authenticated publication, not code signing, package certification or an independent security audit. The integrity fields this site displays are digests and declared attestations; the public package is not a cryptographic signing implementation, and none of this evidence transfers to the proprietary runtime.
Minimal runtime dependency surface
The synapse-cdm 3.3.0 package declares 2 runtime dependencies: pydantic and jsonschema. A smaller declared set makes the runtime closure easier to inspect and audit. It does not make the package or its dependencies secure automatically.
Offline by design
The public integration package does not implement its own network client, telemetry, licence check, update ping or remote registry. It can perform translation and conformance work without requiring a service connection. This statement describes the package implementation, not every possible transitive dependency or host environment.
Three separate evidence domains
Public package supply chain
This page owns build controls, SBOMs, digests, attestations, publication and offline implementation scope.
Adapter conformance
Interoperability evidence owns direction, fixtures, loss accounting and conformance for each public adapter.
Private runtime assurance
Decision-quality evidence owns proprietary runtime TEVV, model-bearing runs and decision assurance.
Exceptions and limitations
Documented security exceptions are schema-validated, assigned an owner and expiry, and consumed from one repository directory by the relevant gates. An expired exception fails the suite.
Automated controls reduce, expose and record risk. They do not eliminate vulnerability risk, prove the absence of unknown defects or certify the package.
The release is built once and hashed. The repository does not claim that separate builds are byte-for-byte reproducible.