doctor enhancements, setup, enhancements, ui functionality and design consolidation and , test projects fixes , product advisory attestation/rekor and delta verfications enhancements
This commit is contained in:
master
240
examples/policies/opa/input-schema.json
Normal file
240
examples/policies/opa/input-schema.json
Normal file
@@ -0,0 +1,240 @@
|
||||
{
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"$id": "https://stellaops.io/schemas/opa/policy-input.json",
|
||||
"title": "Stella OPA Policy Input Schema",
|
||||
"description": "Input schema for OPA/Rego CVE gating policies",
|
||||
"type": "object",
|
||||
"required": ["attestation", "cve_findings", "environment"],
|
||||
"properties": {
|
||||
"attestation": {
|
||||
"type": "object",
|
||||
"description": "Attestation data including DSSE envelope and Rekor entry",
|
||||
"required": ["dsse_envelope"],
|
||||
"properties": {
|
||||
"dsse_envelope": {
|
||||
"type": "object",
|
||||
"description": "DSSE envelope containing signed statement",
|
||||
"required": ["payloadType", "payload", "signatures"],
|
||||
"properties": {
|
||||
"payloadType": {
|
||||
"type": "string",
|
||||
"description": "DSSE payload type URI",
|
||||
"examples": ["application/vnd.in-toto+json"]
|
||||
},
|
||||
"payload": {
|
||||
"type": "string",
|
||||
"description": "Base64-encoded payload (in-toto statement)"
|
||||
},
|
||||
"signatures": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"required": ["keyid", "sig"],
|
||||
"properties": {
|
||||
"keyid": {
|
||||
"type": "string",
|
||||
"description": "Key identifier"
|
||||
},
|
||||
"sig": {
|
||||
"type": "string",
|
||||
"description": "Base64-encoded signature"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"rekor_entry": {
|
||||
"type": "object",
|
||||
"description": "Rekor transparency log entry (optional)",
|
||||
"properties": {
|
||||
"log_index": {
|
||||
"type": "integer",
|
||||
"description": "Rekor log index"
|
||||
},
|
||||
"log_id": {
|
||||
"type": "string",
|
||||
"description": "Rekor log ID (base64 SHA256)"
|
||||
},
|
||||
"integrated_time": {
|
||||
"type": "integer",
|
||||
"description": "Unix timestamp of log inclusion"
|
||||
},
|
||||
"inclusion_proof": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"root_hash": { "type": "string" },
|
||||
"tree_size": { "type": "integer" },
|
||||
"hashes": {
|
||||
"type": "array",
|
||||
"items": { "type": "string" }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"trusted_keys": {
|
||||
"type": "array",
|
||||
"description": "List of trusted signing key IDs",
|
||||
"items": { "type": "string" }
|
||||
}
|
||||
}
|
||||
},
|
||||
"cve_findings": {
|
||||
"type": "array",
|
||||
"description": "CVE findings from scan results",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"required": ["cve_id"],
|
||||
"properties": {
|
||||
"cve_id": {
|
||||
"type": "string",
|
||||
"pattern": "^CVE-\\d{4}-\\d{4,}$",
|
||||
"description": "CVE identifier"
|
||||
},
|
||||
"cvss_score": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 10,
|
||||
"description": "CVSS v3 base score"
|
||||
},
|
||||
"severity": {
|
||||
"type": "string",
|
||||
"enum": ["critical", "high", "medium", "low", "unknown"],
|
||||
"description": "Severity classification"
|
||||
},
|
||||
"epss_score": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 1,
|
||||
"description": "EPSS exploitation probability (0-1)"
|
||||
},
|
||||
"epss_percentile": {
|
||||
"type": "number",
|
||||
"minimum": 0,
|
||||
"maximum": 100,
|
||||
"description": "EPSS percentile (0-100)"
|
||||
},
|
||||
"is_kev": {
|
||||
"type": "boolean",
|
||||
"description": "Whether CVE is in CISA KEV catalog"
|
||||
},
|
||||
"kev_due_date": {
|
||||
"type": "string",
|
||||
"format": "date",
|
||||
"description": "KEV remediation due date (YYYY-MM-DD)"
|
||||
},
|
||||
"is_reachable": {
|
||||
"type": "boolean",
|
||||
"description": "Whether vulnerable code is reachable"
|
||||
},
|
||||
"reachability_state": {
|
||||
"type": "string",
|
||||
"enum": ["confirmed_reachable", "runtime_observed", "statically_reachable", "not_reachable", "unknown"],
|
||||
"description": "Detailed reachability state"
|
||||
},
|
||||
"is_suppressed": {
|
||||
"type": "boolean",
|
||||
"description": "Whether CVE is suppressed/excepted"
|
||||
},
|
||||
"package_name": {
|
||||
"type": "string",
|
||||
"description": "Affected package name"
|
||||
},
|
||||
"package_version": {
|
||||
"type": "string",
|
||||
"description": "Affected package version"
|
||||
},
|
||||
"fix_available": {
|
||||
"type": "boolean",
|
||||
"description": "Whether a fix is available"
|
||||
},
|
||||
"fixed_version": {
|
||||
"type": "string",
|
||||
"description": "Version containing the fix"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"baseline_cve_findings": {
|
||||
"type": "array",
|
||||
"description": "CVE findings from baseline release (for delta comparison)",
|
||||
"items": { "$ref": "#/properties/cve_findings/items" }
|
||||
},
|
||||
"environment": {
|
||||
"type": "string",
|
||||
"description": "Target deployment environment",
|
||||
"examples": ["development", "staging", "production"]
|
||||
},
|
||||
"release": {
|
||||
"type": "object",
|
||||
"description": "Release metadata",
|
||||
"properties": {
|
||||
"id": { "type": "string" },
|
||||
"version": { "type": "string" },
|
||||
"image_digest": { "type": "string" },
|
||||
"baseline_digest": { "type": "string" }
|
||||
}
|
||||
},
|
||||
"config": {
|
||||
"type": "object",
|
||||
"description": "Policy configuration",
|
||||
"properties": {
|
||||
"epss_threshold": {
|
||||
"type": "number",
|
||||
"description": "EPSS score threshold (0-1)"
|
||||
},
|
||||
"epss_percentile_threshold": {
|
||||
"type": "number",
|
||||
"description": "EPSS percentile threshold (0-100)"
|
||||
},
|
||||
"severity_threshold": {
|
||||
"type": "number",
|
||||
"description": "CVSS severity threshold"
|
||||
},
|
||||
"max_critical": {
|
||||
"type": "integer",
|
||||
"description": "Maximum allowed critical CVEs"
|
||||
},
|
||||
"max_high": {
|
||||
"type": "integer",
|
||||
"description": "Maximum allowed high CVEs"
|
||||
},
|
||||
"max_medium": {
|
||||
"type": "integer",
|
||||
"description": "Maximum allowed medium CVEs"
|
||||
},
|
||||
"max_low": {
|
||||
"type": "integer",
|
||||
"description": "Maximum allowed low CVEs"
|
||||
},
|
||||
"max_total": {
|
||||
"type": "integer",
|
||||
"description": "Maximum total CVEs"
|
||||
},
|
||||
"require_rekor": {
|
||||
"type": "boolean",
|
||||
"description": "Require Rekor anchor for attestations"
|
||||
},
|
||||
"count_suppressed": {
|
||||
"type": "boolean",
|
||||
"description": "Include suppressed CVEs in counts"
|
||||
},
|
||||
"only_reachable": {
|
||||
"type": "boolean",
|
||||
"description": "Only evaluate reachable CVEs"
|
||||
},
|
||||
"environments": {
|
||||
"type": "object",
|
||||
"description": "Per-environment configuration overrides",
|
||||
"additionalProperties": { "$ref": "#/properties/config" }
|
||||
}
|
||||
}
|
||||
},
|
||||
"current_time": {
|
||||
"type": "string",
|
||||
"format": "date-time",
|
||||
"description": "Current evaluation timestamp (ISO 8601)"
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user