[cpp-RCP-11] tara.json cites mitigations and dependencies that do not exist in this repository #79

Location: tara.json, and cmake/FetchDeps.cmake for comparison.

Finding: The generated tara.json cites mitigations and dependencies that don't actually exist in this repository — for example, sign/slsa tooling commands, a .fusa-dispositions.json file, and a claim that "FetchContent: CLI11, nlohmann/json, Catch2" are pinned in cmake/FetchDeps.cmake. The actual cmake/FetchDeps.cmake in this tree only declares one FetchContent dependency (Catch2, pinned to v3.6.0) — there's no CLI11 or nlohmann/json entry there at all. This looks like a template document describing the cpp-FuSa tool's own typical dependency set, mechanically committed against this project without being adapted to what's actually here.

Recommendation: Either regenerate tara.json from this project's real asset/dependency graph so its claims match the actual cmake/FetchDeps.cmake and toolchain, or remove it as safety/security evidence for this repo (see the related finding about tara.json/tara.md targeting the wrong subject entirely).

Verification: Independently re-read tara.json and cmake/FetchDeps.cmake against current HEAD (commit 4b9449a, 2026-07-29). Confirmed cmake/FetchDeps.cmake declares only Catch2 via FetchContent, with no CLI11 or nlohmann/json entries, contradicting tara.json's TARA-004 mitigation text.

Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.