Supply-Chain Security

PrivateDAO treats supply-chain review as part of protocol review, not as a separate afterthought.

Scope

The repository publishes reviewer-visible evidence for:

• Cargo.lock
• package-lock.json
• yarn.lock
• package.json
• Cargo.toml
• Anchor.toml

These files define the dependency and toolchain surface that shapes builds, tests, scripts, and reviewer artifacts.

Why It Matters

• Lockfiles reduce ambiguity between reviewed code and reproduced code.
• Toolchain manifests make dependency drift easier to detect.
• Cryptographic integrity over dependency artifacts helps reviewers verify that the evidence surface was not silently rewritten after generation.

Current Boundary

• This repository publishes lockfile and manifest integrity evidence.
• It does not claim a complete SBOM for every transitive binary dependency outside these manifests.
• It does not replace external dependency auditing or registry compromise monitoring.

Verification Commands

npm run build:supply-chain-attestation
npm run verify:supply-chain-attestation
npm run build:cryptographic-manifest
npm run verify:cryptographic-manifest
npm run verify:all

Reviewer Artifacts

• docs/supply-chain-attestation.generated.md
• docs/supply-chain-attestation.generated.json
• docs/cryptographic-manifest.generated.json
• docs/verification-gates.md