Add software compliance standard

Author: Bohkissa

.github/workflows/release.yml

@@ -22,6 +22,9 @@ jobs:
           cache: pip
       - run: python -m pip install -r requirements-build.txt
       - run: python -m unittest discover -s tests -v
+      - name: Audit runtime dependencies
+        shell: pwsh
+        run: python -m pip_audit -r requirements.txt
       - run: python -m PyInstaller --noconfirm --clean BC-ModelVault.spec
       - name: Sign executable when certificate is configured
         if: env.WINDOWS_CERTIFICATE_BASE64 != ''
@@ -35,23 +38,32 @@ jobs:
         run: |
           $hash = (Get-FileHash dist/BC-ModelVault.exe -Algorithm SHA256).Hash.ToLowerInvariant()
           "$hash  BC-ModelVault.exe" | Set-Content dist/SHA256SUMS.txt -Encoding ascii
+      - name: Generate CycloneDX SBOM from resolved runtime dependencies
+        shell: pwsh
+        run: |
+          python -m venv .sbom-env
+          .\.sbom-env\Scripts\python.exe -m pip install --disable-pip-version-check -r requirements.txt
+          .\.sbom-env\Scripts\python.exe -m pip uninstall --yes pip
+          python -m cyclonedx_py environment .\.sbom-env\Scripts\python.exe --pyproject pyproject.toml --spec-version 1.7 --output-format JSON --output-file dist/sbom.cdx.json
       - name: Create user package
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Path package/BC-ModelVault-Windows
-          Copy-Item dist/BC-ModelVault.exe, dist/SHA256SUMS.txt, LICENSE, NOTICE package/BC-ModelVault-Windows/
+          Copy-Item dist/BC-ModelVault.exe, dist/SHA256SUMS.txt, dist/sbom.cdx.json, LICENSE, NOTICE, THIRD_PARTY_NOTICES.md package/BC-ModelVault-Windows/
           Compress-Archive -Path package/BC-ModelVault-Windows/* -DestinationPath package/BC-ModelVault-Windows.zip
       - uses: actions/upload-artifact@v4
         with:
           name: BC-ModelVault-Windows
           path: |
             dist/BC-ModelVault.exe
             dist/SHA256SUMS.txt
+            dist/sbom.cdx.json
             package/BC-ModelVault-Windows.zip
       - uses: softprops/action-gh-release@v2
         if: startsWith(github.ref, 'refs/tags/v')
         with:
           files: |
             dist/BC-ModelVault.exe
             dist/SHA256SUMS.txt
+            dist/sbom.cdx.json
             package/BC-ModelVault-Windows.zip

.github/workflows/security.yml

@@ -0,0 +1,46 @@
+name: Security and compliance
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  python-security:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - run: python -m pip install -r requirements-build.txt
+      - run: python -m unittest discover -s tests -v
+      - name: Audit runtime dependencies
+        shell: pwsh
+        run: python -m pip_audit -r requirements.txt
+      - name: Generate CycloneDX SBOM
+        shell: pwsh
+        run: |
+          python -m venv .sbom-env
+          .\.sbom-env\Scripts\python.exe -m pip install --disable-pip-version-check -r requirements.txt
+          .\.sbom-env\Scripts\python.exe -m pip uninstall --yes pip
+          python -m cyclonedx_py environment .\.sbom-env\Scripts\python.exe --pyproject pyproject.toml --spec-version 1.7 --output-format JSON --output-file sbom.cdx.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: compliance-sbom
+          path: sbom.cdx.json
+
+  dependency-review:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high

.gitignore

@@ -7,6 +7,7 @@ build/
 dist/
 package/
 tmp/
+/docs/compliance/private/
 *.spec.bak
 
 # Artefatti locali: pubblicarli come allegati delle GitHub Releases.

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- Added the BC Software Compliance Standard pilot: public provenance, AI-development, privacy, CRA, threat/risk, support/EOL, known-issue, and release-control records.
+- Added CycloneDX SBOM generation, dependency vulnerability auditing, dependency review, third-party notices, and compliance artifacts to Windows releases.
+- Standardized public copyright, authorship, and product metadata on the Balzano Consulting name.
+
 ## [1.0.1] — 2026-08-07
 
 - Removed the version number from the window title and added version, license, developer, website, and GitHub product links to Settings.
@@ -43,10 +47,10 @@ First stable release of BC ModelVault.
 - Downloads pinned to the verified commit, pause/resume, and final validation.
 - Overall progress, transfer speed, ETA, and notification area integration.
 - Italian and English interfaces with light and dark themes.
-- Portable Windows executable with BC Consulting branding.
+- Portable Windows executable with Balzano Consulting branding.
 
 ### Distribution
 
 - Windows 1.0.0 version metadata.
 - Reproducible PyInstaller build.
-- PolyForm Noncommercial License 1.0.0 with attribution to BC Consulting.
+- PolyForm Noncommercial License 1.0.0 with attribution to Balzano Consulting.

CONTRIBUTING.md

@@ -17,4 +17,4 @@ Describe the problem, solution, completed checks, and any effect on security, to
 
 ## Rights and licensing
 
-By submitting a contribution, you represent that you have the right to provide it and agree that it may be distributed under the project's license. Contributions must preserve the original attribution. Accepting a contribution does not transfer trademarks or rights to the BC Consulting logo and grants no additional commercial rights.
+By submitting a contribution, you represent that you have the right to provide it, that you have identified derived material, and that the contribution does not knowingly violate third-party rights. You agree that it may be distributed under the project's license. Contributions must preserve the original attribution. Accepting a contribution does not transfer trademarks or rights to the Balzano Consulting logo and grants no additional commercial rights. Balzano Consulting may require a separate contributor IP agreement before accepting material contributions.

EOL_POLICY.md

@@ -0,0 +1,12 @@
+# End-of-life policy
+
+Balzano Consulting supports the latest patch release in a supported minor line. Older patch releases may be superseded immediately when a security or integrity fix is published.
+
+| Release line | Security support through | Status |
+| --- | --- | --- |
+| 1.x | 31 December 2028 | Supported |
+| < 1.0 | Ended | Unsupported |
+
+At least 90 days before planned end of support, the project should announce the date in the README, changelog, and GitHub release notes. Balzano Consulting may extend support or issue an emergency fix after EOL, but this policy does not promise such an extension.
+
+Users of unsupported versions should upgrade before reporting vulnerabilities or requesting compatibility fixes.

KNOWN_ISSUES.md

@@ -0,0 +1,8 @@
+# Known issues
+
+- Windows SmartScreen may warn when an executable is unsigned. Verify `SHA256SUMS.txt` before running it.
+- Symbolic-link installation into ComfyUI can require Windows Developer Mode or elevated privileges; copy fallback remains available.
+- Availability, gating, and rate limits for Hugging Face repositories depend on the upstream service and the user's account permissions.
+- The desktop application targets Windows. Other operating systems are not release-tested.
+
+Security-sensitive issues must be reported through the private process in [SECURITY.md](SECURITY.md), not added here.

LICENSE

@@ -3,11 +3,11 @@ PolyForm Noncommercial License 1.0.0
 The license terms governing this software are available at:
 https://polyformproject.org/licenses/noncommercial/1.0.0
 
-Required Notice: Copyright 2026 BC Consulting. All rights reserved.
+Required Notice: Copyright 2026 Balzano Consulting. All rights reserved.
 
 Use of BC ModelVault is permitted only for purposes allowed by the PolyForm
 Noncommercial License 1.0.0. Commercial use requires a separate written
-license from BC Consulting.
+license from Balzano Consulting.
 
 Every distributed copy, modification, or derivative work must include this
 file, the license URL above, and the Required Notice without alteration.

NOTICE

@@ -1,14 +1,14 @@
 BC ModelVault 1.0.1
 
-Required Notice: Copyright 2026 BC Consulting. All rights reserved.
+Required Notice: Copyright 2026 Balzano Consulting. All rights reserved.
 
 BC ModelVault, its original source code, documentation, visual identity, and
-logo are owned by BC Consulting, except for third-party components identified
+logo are owned by Balzano Consulting, except for third-party components identified
 by their respective notices and licenses.
 
 Derivative works and redistributed copies must clearly attribute BC ModelVault
-and BC Consulting, preserve this notice, and state that changes were made.
-No endorsement by BC Consulting may be implied.
+and Balzano Consulting, preserve this notice, and state that changes were made.
+No endorsement by Balzano Consulting may be implied.
 
 Commercial use is not licensed. Contact the copyright holder to request a
 separate commercial license.

README.md

@@ -105,6 +105,10 @@ written to logs.
 - [Contributing](CONTRIBUTING.md)
 - [Security](SECURITY.md)
 - [Support](SUPPORT.md)
+- [Known issues](KNOWN_ISSUES.md)
+- [End-of-life policy](EOL_POLICY.md)
+- [Compliance and provenance](docs/compliance/README.md)
+- [Third-party notices](THIRD_PARTY_NOTICES.md)
 
 ## Project structure
 
@@ -116,7 +120,7 @@ written to logs.
 - `bc_modelvault/theme.py`: light and dark themes.
 - `bc_modelvault/tray.py`: Windows notification area integration.
 - `languages/`: Italian and English catalogs.
-- `img/logo.png`: transparent BC Consulting logo used by the window, tray, and executable.
+- `img/logo.png`: transparent Balzano Consulting logo used by the window, tray, and executable.
 - `img/icons/`: optional PNG icons for sidebar and actions; missing icons use text fallback.
 
 ### Optional interface icons
@@ -136,4 +140,4 @@ installation with multiple profiles, conflict handling, and optional links.
 
 ## License
 
-Copyright © 2026 BC Consulting. All rights reserved. This project is distributed under the **PolyForm Noncommercial License 1.0.0**. Use, modification, and redistribution are allowed only for noncommercial purposes and require preservation of the license and attribution. Commercial use requires separate permission from the copyright holder. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+Copyright © 2026 Balzano Consulting. All rights reserved. This project is distributed under the **PolyForm Noncommercial License 1.0.0**. Use, modification, and redistribution are allowed only for noncommercial purposes and require preservation of the license and attribution. Commercial use requires separate permission from the copyright holder. See [LICENSE](LICENSE), [NOTICE](NOTICE), and [third-party notices](THIRD_PARTY_NOTICES.md).