stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity

feat: Add VEX compact fixture and implement offline verifier for Findings Ledger exports

Browse Source 
- Introduced a new VEX compact fixture for testing purposes.
- Implemented `verify_export.py` script to validate Findings Ledger exports, ensuring deterministic ordering and applying redaction manifests.
- Added a lightweight stub `HarnessRunner` for unit tests to validate ledger hashing expectations.
- Documented tasks related to the Mirror Creator.
- Created models for entropy signals and implemented the `EntropyPenaltyCalculator` to compute penalties based on scanner outputs.
- Developed unit tests for `EntropyPenaltyCalculator` to ensure correct penalty calculations and handling of edge cases.
- Added tests for symbol ID normalization in the reachability scanner.
- Enhanced console status service with comprehensive unit tests for connection handling and error recovery.
- Included Cosign tool version 2.6.0 with checksums for various platforms.
This commit is contained in:
StellaOps Bot
2025-12-02 21:08:01 +02:00
parent 6d049905c7
commit 47168fec38
146 changed files with 4329 additions and 549 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
docs/modules/zastava/schemas/README.md Normal file
View File

@@ -0,0 +1,19 @@
# Zastava schemas (runtime & admission)
## Canonicalisation & hashing
- JSON is stored with sorted keys and two-space indentation; hashes use **JCS-style** encoding: `json.dumps(payload, separators=(',', ':'), sort_keys=True)`.
- `payload_hash` fields in examples and exports are computed from the canonical payload bytes and formatted as `sha256:<hex>`.
- Schema negotiation stays on the `zastava.*@v1.x` line; breaking changes bump the major version.
## DSSE signing
- Payload types:
- `application/vnd.stellaops.zastava.schema+json;name=observer_event;version=1`
- `application/vnd.stellaops.zastava.schema+json;name=webhook_admission;version=1`
- Ed25519 public key (base64url, no padding): `mpIEbYRL1q5yhN6wBRvkZ_0xXz3QUJPueJJ8sn__GGc`.
- Signatures are emitted as `<file>.dsse` with DSSEv1 pre-auth encoding over the raw file bytes.
- Regenerate signatures with `docs/modules/zastava/kit/verify.sh` prerequisites (Python + cryptography) and the private key held offline.
## Test vectors
- Example payloads: `schemas/examples/*.json`.
- Signed exports: `exports/observer_events.ndjson(.dsse)` and `exports/webhook_admissions.ndjson(.dsse)`.
- Kit verification aggregates all signatures via `kit/verify.sh`.

22
docs/modules/zastava/schemas/examples/observer_event.example.json
View File

@@ -1,19 +1,19 @@
{
"tenant_id": "tenant-a",
"project_id": "proj-123",
"sensor_id": "observer-01",
"event_type": "runtime_fact",
"firmware_version": "1.2.3",
"policy_hash": "sha256:deadbeef",
"graph_revision_id": "graph-r1",
"ledger_id": "ledger-789",
"replay_manifest": "manifest-r1",
"event_type": "runtime_fact",
"observed_at": "2025-12-02T00:00:00Z",
"monotonic_nanos": 123456789,
"observed_at": "2025-12-02T00:00:00Z",
"payload": {
"process": "nginx",
"pid": 4242
"pid": 4242,
"process": "nginx"
},
"payload_hash": "sha256:payloadhash",
"signature": "dsse://observer-event"
"payload_hash": "sha256:7476a5068a3f0780c552f81c90d061d9e39c37f425a243ecff961b08676546fd",
"policy_hash": "sha256:deadbeef",
"project_id": "proj-123",
"replay_manifest": "manifest-r1",
"sensor_id": "observer-01",
"signature": "dsse://observer-events/2025-12-02/observer_events.ndjson.dsse#line1",
"tenant_id": "tenant-a"
}

41
docs/modules/zastava/schemas/examples/webhook_admission.example.json
View File

@@ -1,21 +1,34 @@
{
"tenant_id": "tenant-a",
"project_id": "proj-123",
"request_uid": "abcd-1234",
"resource_kind": "Deployment",
"namespace": "prod",
"workload_name": "api",
"policy_hash": "sha256:deadbeef",
"bypass_waiver_id": null,
"decision": "allow",
"decision_at": "2025-12-02T00:00:00Z",
"decision_reason": "surface cache fresh",
"graph_revision_id": "graph-r1",
"ledger_id": "ledger-789",
"replay_manifest": "manifest-r1",
"manifest_pointer": "surfacefs://cache/sha256:abc",
"decision": "allow",
"decision_reason": "surface cache fresh",
"decision_at": "2025-12-02T00:00:00Z",
"monotonic_nanos": 2233445566,
"namespace": "prod",
"payload": {
"images": [
{
"digest": "sha256:abcd",
"name": "ghcr.io/acme/api:1.2.3",
"sbom_referrer": true,
"signed": true
}
],
"manifest_pointer": "surfacefs://cache/sha256:abc",
"policy_hash": "sha256:deadbeef",
"verdict": "allow"
},
"payload_hash": "sha256:36bfb2bc81b7050bbb508e12cafe7ad5a51336aad397ef3a23b0e258aed73dc6",
"policy_hash": "sha256:deadbeef",
"project_id": "proj-123",
"replay_manifest": "manifest-r1",
"request_uid": "abcd-1234",
"resource_kind": "Deployment",
"side_effect": "none",
"bypass_waiver_id": null,
"payload_hash": "sha256:payloadhash",
"signature": "dsse://webhook-admission"
"signature": "dsse://webhook-admissions/2025-12-02/webhook_admissions.ndjson.dsse#line1",
"tenant_id": "tenant-a",
"workload_name": "api"
}

84
docs/modules/zastava/schemas/observer_event.schema.json
View File

@@ -1,8 +1,67 @@
{
"$id": "https://stella-ops.org/schemas/zastava/observer_event.schema.json",
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "Zastava Observer Event",
"type": "object",
"properties": {
"event_type": {
"enum": [
"runtime_fact",
"drift",
"policy_violation",
"heartbeat"
]
},
"firmware_version": {
"minLength": 1,
"type": "string"
},
"graph_revision_id": {
"minLength": 1,
"type": "string"
},
"ledger_id": {
"type": "string"
},
"monotonic_nanos": {
"type": "integer"
},
"observed_at": {
"format": "date-time",
"type": "string"
},
"payload": {
"description": "Canonical runtime payload (JCS) used for hashing.",
"type": "object"
},
"payload_hash": {
"description": "sha256 over canonical JSON (JCS) of payload",
"pattern": "^sha256:[0-9a-f]{64}$",
"type": "string"
},
"policy_hash": {
"minLength": 1,
"type": "string"
},
"project_id": {
"minLength": 1,
"type": "string"
},
"replay_manifest": {
"type": "string"
},
"sensor_id": {
"minLength": 1,
"type": "string"
},
"signature": {
"description": "DSSE envelope reference",
"pattern": "^dsse://[A-Za-z0-9._:/-]+$",
"type": "string"
},
"tenant_id": {
"minLength": 1,
"type": "string"
}
},
"required": [
"tenant_id",
"project_id",
@@ -12,23 +71,10 @@
"graph_revision_id",
"event_type",
"observed_at",
"payload",
"payload_hash",
"signature"
"signature"
],
"properties": {
"tenant_id": { "type": "string" },
"project_id": { "type": "string" },
"sensor_id": { "type": "string" },
"firmware_version": { "type": "string" },
"policy_hash": { "type": "string" },
"graph_revision_id": { "type": "string" },
"ledger_id": { "type": "string" },
"replay_manifest": { "type": "string" },
"event_type": { "enum": ["runtime_fact", "drift", "policy_violation", "heartbeat"] },
"observed_at": { "type": "string", "format": "date-time" },
"monotonic_nanos": { "type": "integer" },
"payload": { "type": "object" },
"payload_hash": { "type": "string", "description": "sha256 over canonical JSON (JCS) of payload" },
"signature": { "type": "string", "description": "DSSE envelope reference" }
}
"title": "Zastava Observer Event",
"type": "object"
}

10
docs/modules/zastava/schemas/observer_event.schema.json.dsse Normal file
View File

@@ -0,0 +1,10 @@
{
"payload": "ewogICIkaWQiOiAiaHR0cHM6Ly9zdGVsbGEtb3BzLm9yZy9zY2hlbWFzL3phc3RhdmEvb2JzZXJ2ZXJfZXZlbnQuc2NoZW1hLmpzb24iLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInByb3BlcnRpZXMiOiB7CiAgICAiZXZlbnRfdHlwZSI6IHsKICAgICAgImVudW0iOiBbCiAgICAgICAgInJ1bnRpbWVfZmFjdCIsCiAgICAgICAgImRyaWZ0IiwKICAgICAgICAicG9saWN5X3Zpb2xhdGlvbiIsCiAgICAgICAgImhlYXJ0YmVhdCIKICAgICAgXQogICAgfSwKICAgICJmaXJtd2FyZV92ZXJzaW9uIjogewogICAgICAibWluTGVuZ3RoIjogMSwKICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgfSwKICAgICJncmFwaF9yZXZpc2lvbl9pZCI6IHsKICAgICAgIm1pbkxlbmd0aCI6IDEsCiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0sCiAgICAibGVkZ2VyX2lkIjogewogICAgICAidHlwZSI6ICJzdHJpbmciCiAgICB9LAogICAgIm1vbm90b25pY19uYW5vcyI6IHsKICAgICAgInR5cGUiOiAiaW50ZWdlciIKICAgIH0sCiAgICAib2JzZXJ2ZWRfYXQiOiB7CiAgICAgICJmb3JtYXQiOiAiZGF0ZS10aW1lIiwKICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgfSwKICAgICJwYXlsb2FkIjogewogICAgICAiZGVzY3JpcHRpb24iOiAiQ2Fub25pY2FsIHJ1bnRpbWUgcGF5bG9hZCAoSkNTKSB1c2VkIGZvciBoYXNoaW5nLiIsCiAgICAgICJ0eXBlIjogIm9iamVjdCIKICAgIH0sCiAgICAicGF5bG9hZF9oYXNoIjogewogICAgICAiZGVzY3JpcHRpb24iOiAic2hhMjU2IG92ZXIgY2Fub25pY2FsIEpTT04gKEpDUykgb2YgcGF5bG9hZCIsCiAgICAgICJwYXR0ZXJuIjogIl5zaGEyNTY6WzAtOWEtZl17NjR9JCIsCiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0sCiAgICAicG9saWN5X2hhc2giOiB7CiAgICAgICJtaW5MZW5ndGgiOiAxLAogICAgICAidHlwZSI6ICJzdHJpbmciCiAgICB9LAogICAgInByb2plY3RfaWQiOiB7CiAgICAgICJtaW5MZW5ndGgiOiAxLAogICAgICAidHlwZSI6ICJzdHJpbmciCiAgICB9LAogICAgInJlcGxheV9tYW5pZmVzdCI6IHsKICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgfSwKICAgICJzZW5zb3JfaWQiOiB7CiAgICAgICJtaW5MZW5ndGgiOiAxLAogICAgICAidHlwZSI6ICJzdHJpbmciCiAgICB9LAogICAgInNpZ25hdHVyZSI6IHsKICAgICAgImRlc2NyaXB0aW9uIjogIkRTU0UgZW52ZWxvcGUgcmVmZXJlbmNlIiwKICAgICAgInBhdHRlcm4iOiAiXmRzc2U6Ly9bQS1aYS16MC05Ll86Ly1dKyQiLAogICAgICAidHlwZSI6ICJzdHJpbmciCiAgICB9LAogICAgInRlbmFudF9pZCI6IHsKICAgICAgIm1pbkxlbmd0aCI6IDEsCiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0KICB9LAogICJyZXF1aXJlZCI6IFsKICAgICJ0ZW5hbnRfaWQiLAogICAgInByb2plY3RfaWQiLAogICAgInNlbnNvcl9pZCIsCiAgICAiZmlybXdhcmVfdmVyc2lvbiIsCiAgICAicG9saWN5X2hhc2giLAogICAgImdyYXBoX3JldmlzaW9uX2lkIiwKICAgICJldmVudF90eXBlIiwKICAgICJvYnNlcnZlZF9hdCIsCiAgICAicGF5bG9hZCIsCiAgICAicGF5bG9hZF9oYXNoIiwKICAgICJzaWduYXR1cmUiCiAgXSwKICAidGl0bGUiOiAiWmFzdGF2YSBPYnNlcnZlciBFdmVudCIsCiAgInR5cGUiOiAib2JqZWN0Igp9Cg",
"payloadType": "application/vnd.stellaops.zastava.schema+json;name=observer_event;version=1",
"signatures": [
{
"keyid": "mpIEbYRL1q5yhN6wBRvkZ_0xXz3QUJPueJJ8sn__GGc",
"sig": "axmdd1ucHyZyJMAyLzWmpuai7VrS20QenSDQyXRKlmtsAF4Zl4Ke_cHy8konBStBCoJgGA3SM2236QgAbkQMBw"
}
]
}

112
docs/modules/zastava/schemas/webhook_admission.schema.json
View File

@@ -1,8 +1,91 @@
{
"$id": "https://stella-ops.org/schemas/zastava/webhook_admission.schema.json",
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "Zastava Webhook Admission",
"type": "object",
"properties": {
"bypass_waiver_id": {
"type": "string"
},
"decision": {
"enum": [
"allow",
"deny",
"dry-run"
]
},
"decision_at": {
"format": "date-time",
"type": "string"
},
"decision_reason": {
"minLength": 1,
"type": "string"
},
"graph_revision_id": {
"minLength": 1,
"type": "string"
},
"ledger_id": {
"type": "string"
},
"manifest_pointer": {
"description": "Surface.FS manifest pointer",
"type": "string"
},
"monotonic_nanos": {
"type": "integer"
},
"namespace": {
"minLength": 1,
"type": "string"
},
"payload": {
"description": "AdmissionReview payload (canonical JSON) hashed via payload_hash",
"type": "object"
},
"payload_hash": {
"pattern": "^sha256:[0-9a-f]{64}$",
"type": "string"
},
"policy_hash": {
"minLength": 1,
"type": "string"
},
"project_id": {
"minLength": 1,
"type": "string"
},
"replay_manifest": {
"type": "string"
},
"request_uid": {
"minLength": 1,
"type": "string"
},
"resource_kind": {
"minLength": 1,
"type": "string"
},
"side_effect": {
"enum": [
"none",
"mutating",
"bypass"
]
},
"signature": {
"description": "DSSE envelope reference",
"pattern": "^dsse://[A-Za-z0-9._:/-]+$",
"type": "string"
},
"tenant_id": {
"minLength": 1,
"type": "string"
},
"workload_name": {
"minLength": 1,
"type": "string"
}
},
"required": [
"tenant_id",
"project_id",
@@ -16,27 +99,10 @@
"decision_reason",
"decision_at",
"manifest_pointer",
"payload",
"payload_hash",
"signature"
],
"properties": {
"tenant_id": { "type": "string" },
"project_id": { "type": "string" },
"request_uid": { "type": "string" },
"resource_kind": { "type": "string" },
"namespace": { "type": "string" },
"workload_name": { "type": "string" },
"policy_hash": { "type": "string" },
"graph_revision_id": { "type": "string" },
"ledger_id": { "type": "string" },
"replay_manifest": { "type": "string" },
"manifest_pointer": { "type": "string", "description": "Surface.FS manifest pointer" },
"decision": { "enum": ["allow", "deny", "dry-run"] },
"decision_reason": { "type": "string" },
"decision_at": { "type": "string", "format": "date-time" },
"monotonic_nanos": { "type": "integer" },
"side_effect": { "enum": ["none", "mutating", "bypass"] },
"bypass_waiver_id": { "type": "string" },
"payload_hash": { "type": "string" },
"signature": { "type": "string", "description": "DSSE envelope reference" }
}
"title": "Zastava Webhook Admission",
"type": "object"
}

10
docs/modules/zastava/schemas/webhook_admission.schema.json.dsse Normal file
View File

@@ -0,0 +1,10 @@
{
"payload": "ewogICIkaWQiOiAiaHR0cHM6Ly9zdGVsbGEtb3BzLm9yZy9zY2hlbWFzL3phc3RhdmEvd2ViaG9va19hZG1pc3Npb24uc2NoZW1hLmpzb24iLAogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInByb3BlcnRpZXMiOiB7CiAgICAiYnlwYXNzX3dhaXZlcl9pZCI6IHsKICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgfSwKICAgICJkZWNpc2lvbiI6IHsKICAgICAgImVudW0iOiBbCiAgICAgICAgImFsbG93IiwKICAgICAgICAiZGVueSIsCiAgICAgICAgImRyeS1ydW4iCiAgICAgIF0KICAgIH0sCiAgICAiZGVjaXNpb25fYXQiOiB7CiAgICAgICJmb3JtYXQiOiAiZGF0ZS10aW1lIiwKICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgfSwKICAgICJkZWNpc2lvbl9yZWFzb24iOiB7CiAgICAgICJtaW5MZW5ndGgiOiAxLAogICAgICAidHlwZSI6ICJzdHJpbmciCiAgICB9LAogICAgImdyYXBoX3JldmlzaW9uX2lkIjogewogICAgICAibWluTGVuZ3RoIjogMSwKICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgfSwKICAgICJsZWRnZXJfaWQiOiB7CiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0sCiAgICAibWFuaWZlc3RfcG9pbnRlciI6IHsKICAgICAgImRlc2NyaXB0aW9uIjogIlN1cmZhY2UuRlMgbWFuaWZlc3QgcG9pbnRlciIsCiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0sCiAgICAibW9ub3RvbmljX25hbm9zIjogewogICAgICAidHlwZSI6ICJpbnRlZ2VyIgogICAgfSwKICAgICJuYW1lc3BhY2UiOiB7CiAgICAgICJtaW5MZW5ndGgiOiAxLAogICAgICAidHlwZSI6ICJzdHJpbmciCiAgICB9LAogICAgInBheWxvYWQiOiB7CiAgICAgICJkZXNjcmlwdGlvbiI6ICJBZG1pc3Npb25SZXZpZXcgcGF5bG9hZCAoY2Fub25pY2FsIEpTT04pIGhhc2hlZCB2aWEgcGF5bG9hZF9oYXNoIiwKICAgICAgInR5cGUiOiAib2JqZWN0IgogICAgfSwKICAgICJwYXlsb2FkX2hhc2giOiB7CiAgICAgICJwYXR0ZXJuIjogIl5zaGEyNTY6WzAtOWEtZl17NjR9JCIsCiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0sCiAgICAicG9saWN5X2hhc2giOiB7CiAgICAgICJtaW5MZW5ndGgiOiAxLAogICAgICAidHlwZSI6ICJzdHJpbmciCiAgICB9LAogICAgInByb2plY3RfaWQiOiB7CiAgICAgICJtaW5MZW5ndGgiOiAxLAogICAgICAidHlwZSI6ICJzdHJpbmciCiAgICB9LAogICAgInJlcGxheV9tYW5pZmVzdCI6IHsKICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgfSwKICAgICJyZXF1ZXN0X3VpZCI6IHsKICAgICAgIm1pbkxlbmd0aCI6IDEsCiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0sCiAgICAicmVzb3VyY2Vfa2luZCI6IHsKICAgICAgIm1pbkxlbmd0aCI6IDEsCiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0sCiAgICAic2lkZV9lZmZlY3QiOiB7CiAgICAgICJlbnVtIjogWwogICAgICAgICJub25lIiwKICAgICAgICAibXV0YXRpbmciLAogICAgICAgICJieXBhc3MiCiAgICAgIF0KICAgIH0sCiAgICAic2lnbmF0dXJlIjogewogICAgICAiZGVzY3JpcHRpb24iOiAiRFNTRSBlbnZlbG9wZSByZWZlcmVuY2UiLAogICAgICAicGF0dGVybiI6ICJeZHNzZTovL1tBLVphLXowLTkuXzovLV0rJCIsCiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0sCiAgICAidGVuYW50X2lkIjogewogICAgICAibWluTGVuZ3RoIjogMSwKICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgfSwKICAgICJ3b3JrbG9hZF9uYW1lIjogewogICAgICAibWluTGVuZ3RoIjogMSwKICAgICAgInR5cGUiOiAic3RyaW5nIgogICAgfQogIH0sCiAgInJlcXVpcmVkIjogWwogICAgInRlbmFudF9pZCIsCiAgICAicHJvamVjdF9pZCIsCiAgICAicmVxdWVzdF91aWQiLAogICAgInJlc291cmNlX2tpbmQiLAogICAgIm5hbWVzcGFjZSIsCiAgICAid29ya2xvYWRfbmFtZSIsCiAgICAicG9saWN5X2hhc2giLAogICAgImdyYXBoX3JldmlzaW9uX2lkIiwKICAgICJkZWNpc2lvbiIsCiAgICAiZGVjaXNpb25fcmVhc29uIiwKICAgICJkZWNpc2lvbl9hdCIsCiAgICAibWFuaWZlc3RfcG9pbnRlciIsCiAgICAicGF5bG9hZCIsCiAgICAicGF5bG9hZF9oYXNoIiwKICAgICJzaWduYXR1cmUiCiAgXSwKICAidGl0bGUiOiAiWmFzdGF2YSBXZWJob29rIEFkbWlzc2lvbiIsCiAgInR5cGUiOiAib2JqZWN0Igp9Cg",
"payloadType": "application/vnd.stellaops.zastava.schema+json;name=webhook_admission;version=1",
"signatures": [
{
"keyid": "mpIEbYRL1q5yhN6wBRvkZ_0xXz3QUJPueJJ8sn__GGc",
"sig": "Vk0mACAjBtUuVn_S2M5HU81zMbH8wDCQYOHVsft7cmxl0JbDrSIA9z3xlTI5JiT7DYOGsDUc96dlC1njldN4Aw"
}
]
}