fix(release): retain reproducible SBOM identities

[kazazes]

Summary

• promote the merged private SBOM attestation repair without transformation
• derive deterministic RFC 4122 UUIDv5 serial numbers from sanitized CycloneDX content
• retain byte-reproducible release reports while satisfying GitHub SBOM attestation parsing

Promotion record

• authoritative private merge: 36d4ba57b8b87735cdcc3a659859626a6369e2a6
• private candidate: 3dfa8ac1ccffda9071945f13cb693a0b8bca2a2c
• exported files: 514
• withheld internal files: 26
• export tree SHA-256: 1023f000f54d1a6c42d4878726ff17ccbf9356c8d7a560b6ea3c2a72ed8abeea

Verification

• public checkout re-verified byte-for-byte against the authoritative export record after committing
• private source tests: 248 passed
• private local exact installed-artifact verifier: passed
• private hosted Exact release artifact: passed for 3dfa8ac1ccffda9071945f13cb693a0b8bca2a2c
• CodeRabbit and Codex settled on the private candidate; CodeRabbit withdrew its sole comment after contract verification

Publication remains gated until this exact export passes public required checks and review.

Summary by CodeRabbit

• Bug Fixes

  • SBOM sanitization now assigns a consistent serial number based on the sanitized content.
  • Serial numbers no longer vary due to the original serial number or timestamp.
  • SBOMs with different component inventories receive distinct serial numbers.

• Tests

  • Added coverage validating consistent identity generation across equivalent SBOMs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 62390ae7-c7e9-4c5d-87f0-8bf18d5c37ed

📥 Commits

Reviewing files that changed from the base of the PR and between 4d46474 and 2e82b03.

📒 Files selected for processing (2)

• scripts/verify_release.py
• tests/release/test_release_checks.py

---

📝 Walkthrough

Walkthrough

SBOM sanitization now derives a UUIDv5 serialNumber from canonical sanitized content. Tests verify stability across input serial numbers and timestamps, and verify changes when component inventories differ.

Changes

SBOM identity generation

Layer / File(s)	Summary
Sanitize and validate deterministic serial numbers scripts/verify_release.py, tests/release/test_release_checks.py	_sanitize_sbom assigns a urn:uuid: serial number derived from sanitized SBOM JSON. Tests cover stable identities and inventory-dependent identities.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: audeberc

Poem

A rabbit checks the bill of parts,
And stamps each list with matching hearts.
New contents change the UUID trail,
While timestamps and old stamps fail.
“Hop!” says the hare, “the identity’s clear.”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preserving reproducible SBOM identities.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/fde-714-sbom-attestation

---

_{Comment @coderabbitai help to get the list of available commands.}