feat: Implement distro-native version comparison for RPM, Debian, and Alpine packages
- Add RpmVersionComparer for RPM version comparison with epoch, version, and release handling. - Introduce DebianVersion for parsing Debian EVR (Epoch:Version-Release) strings. - Create ApkVersion for parsing Alpine APK version strings with suffix support. - Define IVersionComparator interface for version comparison with proof-line generation. - Implement VersionComparisonResult struct to encapsulate comparison results and proof lines. - Add tests for Debian and RPM version comparers to ensure correct functionality and edge case handling. - Create project files for the version comparison library and its tests.
This commit is contained in:
50
docs/implplan/SPRINT_4400_SUMMARY.md
Normal file
50
docs/implplan/SPRINT_4400_SUMMARY.md
Normal file
@@ -0,0 +1,50 @@
|
||||
# SPRINT_4400 SUMMARY: Delta Verdicts & Reachability Attestations
|
||||
|
||||
## Program Overview
|
||||
|
||||
| Field | Value |
|
||||
|-------|-------|
|
||||
| **Program ID** | 4400 |
|
||||
| **Theme** | Attestable Change Control: Delta Verdicts & Reachability Proofs |
|
||||
| **Priority** | P2 (Medium) |
|
||||
| **Total Effort** | ~4 weeks |
|
||||
| **Advisory Source** | 19-Dec-2025 - Stella Ops candidate features mapped to moat strength |
|
||||
|
||||
---
|
||||
|
||||
## Strategic Context
|
||||
|
||||
This program extends the attestation infrastructure to cover:
|
||||
1. **Smart-Diff semantic delta** — Changes in exploitable surface as signed artifacts
|
||||
2. **Reachability proofs** — Call-path subgraphs as portable evidence
|
||||
|
||||
---
|
||||
|
||||
## Sprint Breakdown
|
||||
|
||||
| Sprint ID | Title | Effort | Moat |
|
||||
|-----------|-------|--------|------|
|
||||
| 4400_0001_0001 | Signed Delta Verdict Attestation | 2 weeks | 4 |
|
||||
| 4400_0001_0002 | Reachability Subgraph Attestation | 2 weeks | 4 |
|
||||
|
||||
---
|
||||
|
||||
## Dependencies
|
||||
|
||||
- **Requires**: SPRINT_4300_0001_0001 (OCI Verdict Push)
|
||||
- **Requires**: MaterialRiskChangeDetector (exists)
|
||||
- **Requires**: PathWitnessBuilder (exists)
|
||||
|
||||
---
|
||||
|
||||
## Outcomes
|
||||
|
||||
1. Delta verdicts become attestable change-control artifacts
|
||||
2. Reachability analysis produces portable proof subgraphs
|
||||
3. Both can be pushed to OCI registries as referrers
|
||||
|
||||
---
|
||||
|
||||
**Sprint Series Status:** TODO
|
||||
|
||||
**Created:** 2025-12-22
|
||||
Reference in New Issue
Block a user