v1.1 Planning

The following features are under consideration for v1.1. The v1.1 theme is software supply chain security — a natural extension of the air-gap deployment workflow. When deploying software to air-gapped environments, verifying the integrity and provenance of every component is critical. SBOM generation, cryptographic bill-of-materials tracking, and offline vulnerability scanning address this need directly.

AirGap Deploy v1.1

• SBOM generation: Generate CycloneDX SBOM during prep phase from Cargo.lock dependency graph, component metadata, and license information

• CBOM generation: Scan dependencies for known cryptographic crates and document crypto usage as CycloneDX CBOM entries

• Vulnerability scanning: airgap-deploy scan subcommand that checks SBOMs against an offline vulnerability database (Grype or Trivy)

AirGap Transfer v1.1

• SBOM-aware manifests: Reference CycloneDX SBOM files in transfer manifests for chain-of-custody documentation

Cleanroom Whisper v1.1

No v1.1 features are currently planned for Cleanroom Whisper. Whisper’s v1.0.0 scope is self-contained, and post-v1.0.0 priorities will depend on user feedback and adoption patterns. Possible future directions include additional output format support and export options, but no commitments are made at this stage.

Timeline

The v1.1 scope will be finalized after v1.0.0 release and initial user feedback. No target date has been set. Per the release philosophy, AirGap Deploy and Transfer minor releases are coordinated while Cleanroom Whisper releases independently.

See individual project SRS documents for detailed requirements (tagged v1.1).

Proposed Artifacts

The following tables list all proposed sphinx-needs artifacts for v1.1. These items are not yet approved and may change based on v1.0.0 feedback.

AirGap Deploy

ID	Title	Type	Priority	Status
FR-DEPLOY-073	Generate CycloneDX SBOM	req	should	proposed
FR-DEPLOY-074	Parse Cargo.lock for Dependency Graph	req	should	proposed
FR-DEPLOY-075	Extract License Information	req	should	proposed
FR-DEPLOY-076	Include Component Metadata in SBOM	req	should	proposed
FR-DEPLOY-077	Include SBOM in Deployment Archive	req	should	proposed
FR-DEPLOY-078	Detect Cryptographic Dependencies	req	should	proposed
FR-DEPLOY-079	Document Internal Cryptographic Usage	req	should	proposed
FR-DEPLOY-080	Unified SBOM/CBOM Document	req	should	proposed
FR-DEPLOY-081	Scan Subcommand	req	could	proposed
FR-DEPLOY-082	Offline Vulnerability Database	req	could	proposed
FR-DEPLOY-083	Vulnerability Report Output	req	could	proposed
FR-DEPLOY-084	Severity Threshold Exit Code	req	could	proposed
UC-DEPLOY-003	SBOM/CBOM Generation During Deployment Packaging	usecase	should	proposed
UC-DEPLOY-004	Offline Vulnerability Scanning with SBOM	usecase	could	proposed

AirGap Transfer

ID	Title	Type	Priority	Status
FR-TRANSFER-048	Reference SBOM in Transfer Manifest	req	could	proposed
FR-TRANSFER-049	Log SBOM in Transfer Audit Trail	req	could	proposed
UC-TRANSFER-004	Transfer Deployment Package with SBOM Metadata	usecase	could	proposed