Container Registry and Software Supply Chain Platform  ·  View 12 of 33  ·  3 · Data

Supply Chain Data Flow

Where each kind of data comes from, what it becomes, and how long it is kept.

Editable source SVG draw.io All views
Produce Source Commit GitLab revision Base Image hardened, attested Built Image 900–2,500 / day Land Blob Store write once Manifest and Tag strongly consistent Attest Provenance at build time SBOM ~90 MB / day Scan Result p95 ≤ 10 min Signature before promotion Index Component Rows 1,800 per SBOM Finding Set per digest Verdict Inputs compact per digest Decide Evidence Feed ordered per subject Edge Cache ≤ 30 min stale Admission Decision computed, not stored Retain Audit Records 7 years Finding History 3 years, never deleted Lifecycle Expiry dev untagged 30 d on push and on advisory every decision Supply Chain Data Flow and Cadence External / third party Application we own Data store Security / platform Queue / topic event / async Findings are recomputed when advisories move, not only when an image is pushed. v 1.0 · owner Data Architecture · date 2026-09

Volumes

  • 900 builds/day steady, 2,500 on release days; median SBOM 1,800 components
  • ~90 MB/day of new SBOM and attestation data — small enough that evidence replicates everywhere, blobs do not
  • 14 TB of blob storage against roughly 240 GB/year of evidence: the asymmetry is what makes the topology in view 14 affordable

Retention

  • Attestations, signatures, inclusion proofs and audit records: 7 years
  • Finding history: 3 years, never deleted — a finding that leaves a feed is marked withdrawn
  • Production artifacts 2 years after last deployment; development artifacts 30 days untagged

Assumptions

  • 7-year retention is audit-driven, not engineering-driven, and should be confirmed with legal before build
  • Retention drives the cost model more than storage volume does
◀  Evidence Data Model All views Component Index  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises12-supply-chain-data-flow