Add inline DSSE provenance documentation and Mongo schema

- Introduced a new document outlining the inline DSSE provenance for SBOM, VEX, scan, and derived events. - Defined the Mongo schema for event patches, including key fields for provenance and trust verification. - Documented the write path for ingesting provenance metadata and backfilling historical events. - Created CI/CD snippets for uploading DSSE attestations and generating provenance metadata. - Established Mongo indexes for efficient provenance queries and provided query recipes for various use cases. - Outlined policy gates for managing VEX decisions based on provenance verification. - Included UI nudges for displaying provenance information and implementation tasks for future enhancements. --- Implement reachability lattice and scoring model - Developed a comprehensive document detailing the reachability lattice and scoring model. - Defined core types for reachability states, evidence, and mitigations with corresponding C# models. - Established a scoring policy with base score contributions from various evidence classes. - Mapped reachability states to VEX gates and provided a clear overview of evidence sources. - Documented the event graph schema for persisting reachability data in MongoDB. - Outlined the integration of runtime probes for evidence collection and defined a roadmap for future tasks. --- Introduce uncertainty states and entropy scoring - Created a draft document for tracking uncertainty states and their impact on risk scoring. - Defined core uncertainty states with associated entropy values and evidence requirements. - Established a schema for storing uncertainty states alongside findings. - Documented the risk score calculation incorporating uncertainty and its effect on final risk assessments. - Provided policy guidelines for handling uncertainty in decision-making processes. - Outlined UI guidelines for displaying uncertainty information and suggested remediation actions. --- Add Ruby package inventory management - Implemented Ruby package inventory management with corresponding data models and storage mechanisms. - Created C# records for Ruby package inventory, artifacts, provenance, and runtime details. - Developed a repository for managing Ruby package inventory documents in MongoDB. - Implemented a service for storing and retrieving Ruby package inventories. - Added unit tests for the Ruby package inventory store to ensure functionality and data integrity.
2025-11-13 00:20:33 +02:00
parent 86be324fc0
commit 7040984215
41 changed files with 1955 additions and 76 deletions
--- a/src/Scanner/__Libraries/StellaOps.Scanner.Storage/Services/RubyPackageInventoryStore.cs
+++ b/src/Scanner/__Libraries/StellaOps.Scanner.Storage/Services/RubyPackageInventoryStore.cs
@@ -0,0 +1,92 @@
+using System.Collections.Generic;
+using System.Collections.Immutable;
+using StellaOps.Scanner.Core.Contracts;
+using StellaOps.Scanner.Storage.Catalog;
+using StellaOps.Scanner.Storage.Repositories;
+
+namespace StellaOps.Scanner.Storage.Services;
+
+public sealed class RubyPackageInventoryStore : IRubyPackageInventoryStore
+{
+    private readonly RubyPackageInventoryRepository _repository;
+
+    public RubyPackageInventoryStore(RubyPackageInventoryRepository repository)
+    {
+        _repository = repository ?? throw new ArgumentNullException(nameof(repository));
+    }
+
+    public async Task StoreAsync(RubyPackageInventory inventory, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(inventory);
+
+        var document = new RubyPackageInventoryDocument
+        {
+            ScanId = inventory.ScanId,
+            ImageDigest = inventory.ImageDigest,
+            GeneratedAtUtc = inventory.GeneratedAtUtc.UtcDateTime,
+            Packages = inventory.Packages.Select(ToDocument).ToList()
+        };
+
+        await _repository.UpsertAsync(document, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async Task<RubyPackageInventory?> GetAsync(string scanId, CancellationToken cancellationToken)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(scanId);
+
+        var document = await _repository.GetAsync(scanId, cancellationToken).ConfigureAwait(false);
+        if (document is null)
+        {
+            return null;
+        }
+
+        var generatedAt = DateTime.SpecifyKind(document.GeneratedAtUtc, DateTimeKind.Utc);
+        var packages = document.Packages?.Select(FromDocument).ToImmutableArray()
+            ?? ImmutableArray<RubyPackageArtifact>.Empty;
+
+        return new RubyPackageInventory(
+            document.ScanId,
+            document.ImageDigest ?? string.Empty,
+            new DateTimeOffset(generatedAt),
+            packages);
+    }
+
+    private static RubyPackageDocument ToDocument(RubyPackageArtifact artifact)
+    {
+        var doc = new RubyPackageDocument
+        {
+            Id = artifact.Id,
+            Name = artifact.Name,
+            Version = artifact.Version,
+            Source = artifact.Source,
+            Platform = artifact.Platform,
+            Groups = artifact.Groups?.ToList(),
+            DeclaredOnly = artifact.DeclaredOnly,
+            RuntimeUsed = artifact.RuntimeUsed,
+            Provenance = artifact.Provenance,
+            Runtime = artifact.Runtime,
+            Metadata = artifact.Metadata is null ? null : new Dictionary<string, string?>(artifact.Metadata, StringComparer.OrdinalIgnoreCase)
+        };
+
+        return doc;
+    }
+
+    private static RubyPackageArtifact FromDocument(RubyPackageDocument document)
+    {
+        IReadOnlyList<string>? groups = document.Groups;
+        IReadOnlyDictionary<string, string?>? metadata = document.Metadata;
+
+        return new RubyPackageArtifact(
+            document.Id,
+            document.Name,
+            document.Version,
+            document.Source,
+            document.Platform,
+            groups,
+            document.DeclaredOnly,
+            document.RuntimeUsed,
+            document.Provenance,
+            document.Runtime,
+            metadata);
+    }
+}