Add tests and implement StubBearer authentication for Signer endpoints

- Created SignerEndpointsTests to validate the SignDsse and VerifyReferrers endpoints.
- Implemented StubBearerAuthenticationDefaults and StubBearerAuthenticationHandler for token-based authentication.
- Developed ConcelierExporterClient for managing Trivy DB settings and export operations.
- Added TrivyDbSettingsPageComponent for UI interactions with Trivy DB settings, including form handling and export triggering.
- Implemented styles and HTML structure for Trivy DB settings page.
- Created NotifySmokeCheck tool for validating Redis event streams and Notify deliveries.

deploy/compose/README.md

@@ -20,12 +20,25 @@ docker compose --env-file dev.env -f docker-compose.dev.yaml config
 docker compose --env-file dev.env -f docker-compose.dev.yaml up -d
 ```
 
-The stage and airgap variants behave the same way—swap the file names accordingly. All profiles expose 443/8443 for the UI and REST APIs, and they share a `stellaops` Docker network scoped to the compose project.
-
-### Updating to a new release
-
-1. Import the new manifest into `deploy/releases/` (see `deploy/README.md`).
-2. Update image digests in the relevant Compose file(s).
-3. Re-run `docker compose config` to confirm the bundle is deterministic.
+The stage and airgap variants behave the same way—swap the file names accordingly. All profiles expose 443/8443 for the UI and REST APIs, and they share a `stellaops` Docker network scoped to the compose project.
+
+### Scanner event stream settings
+
+Scanner WebService can emit signed `scanner.report.*` events to Redis Streams when `SCANNER__EVENTS__ENABLED=true`. Each profile ships environment placeholders you can override in the `.env` file:
+
+- `SCANNER_EVENTS_ENABLED` – toggle emission on/off (defaults to `false`).
+- `SCANNER_EVENTS_DRIVER` – currently only `redis` is supported.
+- `SCANNER_EVENTS_DSN` – Redis endpoint; leave blank to reuse the queue DSN when it uses `redis://`.
+- `SCANNER_EVENTS_STREAM` – stream name (`stella.events` by default).
+- `SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS` – per-publish timeout window (defaults to `5`).
+- `SCANNER_EVENTS_MAX_STREAM_LENGTH` – max stream length before Redis trims entries (defaults to `10000`).
+
+Helm values mirror the same knobs under each service’s `env` map (see `deploy/helm/stellaops/values-*.yaml`).
+
+### Updating to a new release
+
+1. Import the new manifest into `deploy/releases/` (see `deploy/README.md`).
+2. Update image digests in the relevant Compose file(s).
+3. Re-run `docker compose config` to confirm the bundle is deterministic.
 
 Keep digests synchronized between Compose, Helm, and the release manifest to preserve reproducibility guarantees. `deploy/tools/validate-profiles.sh` performs a quick audit.

deploy/compose/docker-compose.airgap.yaml

@@ -136,10 +136,16 @@ services:
       - nats
     environment:
       SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      SCANNER__STORAGE__S3__ENDPOINT: "http://minio:9000"
-      SCANNER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER}"
-      SCANNER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD}"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
+      SCANNER__STORAGE__S3__ENDPOINT: "http://minio:9000"
+      SCANNER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER}"
+      SCANNER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD}"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
+      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-redis}"
+      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
+      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
+      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
+      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
     ports:
       - "${SCANNER_WEB_PORT:-8444}:8444"
     networks:

deploy/compose/docker-compose.dev.yaml

@@ -134,10 +134,16 @@ services:
       - nats
     environment:
       SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      SCANNER__STORAGE__S3__ENDPOINT: "http://minio:9000"
-      SCANNER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER}"
-      SCANNER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD}"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
+      SCANNER__STORAGE__S3__ENDPOINT: "http://minio:9000"
+      SCANNER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER}"
+      SCANNER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD}"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
+      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-redis}"
+      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
+      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
+      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
+      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
     ports:
       - "${SCANNER_WEB_PORT:-8444}:8444"
     networks:

deploy/compose/docker-compose.stage.yaml

@@ -134,10 +134,16 @@ services:
       - nats
     environment:
       SCANNER__STORAGE__MONGO__CONNECTIONSTRING: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongo:27017"
-      SCANNER__STORAGE__S3__ENDPOINT: "http://minio:9000"
-      SCANNER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER}"
-      SCANNER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD}"
-      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
+      SCANNER__STORAGE__S3__ENDPOINT: "http://minio:9000"
+      SCANNER__STORAGE__S3__ACCESSKEYID: "${MINIO_ROOT_USER}"
+      SCANNER__STORAGE__S3__SECRETACCESSKEY: "${MINIO_ROOT_PASSWORD}"
+      SCANNER__QUEUE__BROKER: "${SCANNER_QUEUE_BROKER}"
+      SCANNER__EVENTS__ENABLED: "${SCANNER_EVENTS_ENABLED:-false}"
+      SCANNER__EVENTS__DRIVER: "${SCANNER_EVENTS_DRIVER:-redis}"
+      SCANNER__EVENTS__DSN: "${SCANNER_EVENTS_DSN:-}"
+      SCANNER__EVENTS__STREAM: "${SCANNER_EVENTS_STREAM:-stella.events}"
+      SCANNER__EVENTS__PUBLISHTIMEOUTSECONDS: "${SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS:-5}"
+      SCANNER__EVENTS__MAXSTREAMLENGTH: "${SCANNER_EVENTS_MAX_STREAM_LENGTH:-10000}"
     ports:
       - "${SCANNER_WEB_PORT:-8444}:8444"
     networks:

deploy/compose/env/airgap.env.example

@@ -10,8 +10,15 @@ SIGNER_POE_INTROSPECT_URL=file:///offline/poe/introspect.json
 SIGNER_PORT=8441
 ATTESTOR_PORT=8442
 CONCELIER_PORT=8445
-SCANNER_WEB_PORT=8444
-UI_PORT=9443
-NATS_CLIENT_PORT=24222
-SCANNER_QUEUE_BROKER=nats://nats:4222
-AUTHORITY_OFFLINE_CACHE_TOLERANCE=00:45:00
+SCANNER_WEB_PORT=8444
+UI_PORT=9443
+NATS_CLIENT_PORT=24222
+SCANNER_QUEUE_BROKER=nats://nats:4222
+AUTHORITY_OFFLINE_CACHE_TOLERANCE=00:45:00
+SCANNER_EVENTS_ENABLED=false
+SCANNER_EVENTS_DRIVER=redis
+# Leave SCANNER_EVENTS_DSN empty to inherit the Redis queue DSN when SCANNER_QUEUE_BROKER uses redis://.
+SCANNER_EVENTS_DSN=
+SCANNER_EVENTS_STREAM=stella.events
+SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
+SCANNER_EVENTS_MAX_STREAM_LENGTH=10000

deploy/compose/env/dev.env.example

@@ -10,7 +10,14 @@ SIGNER_POE_INTROSPECT_URL=https://licensing.svc.local/introspect
 SIGNER_PORT=8441
 ATTESTOR_PORT=8442
 CONCELIER_PORT=8445
-SCANNER_WEB_PORT=8444
-UI_PORT=8443
-NATS_CLIENT_PORT=4222
-SCANNER_QUEUE_BROKER=nats://nats:4222
+SCANNER_WEB_PORT=8444
+UI_PORT=8443
+NATS_CLIENT_PORT=4222
+SCANNER_QUEUE_BROKER=nats://nats:4222
+SCANNER_EVENTS_ENABLED=false
+SCANNER_EVENTS_DRIVER=redis
+# Leave SCANNER_EVENTS_DSN empty to inherit the Redis queue DSN when SCANNER_QUEUE_BROKER uses redis://.
+SCANNER_EVENTS_DSN=
+SCANNER_EVENTS_STREAM=stella.events
+SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
+SCANNER_EVENTS_MAX_STREAM_LENGTH=10000

deploy/compose/env/stage.env.example

@@ -10,7 +10,14 @@ SIGNER_POE_INTROSPECT_URL=https://licensing.stage.stella-ops.internal/introspect
 SIGNER_PORT=8441
 ATTESTOR_PORT=8442
 CONCELIER_PORT=8445
-SCANNER_WEB_PORT=8444
-UI_PORT=8443
-NATS_CLIENT_PORT=4222
-SCANNER_QUEUE_BROKER=nats://nats:4222
+SCANNER_WEB_PORT=8444
+UI_PORT=8443
+NATS_CLIENT_PORT=4222
+SCANNER_QUEUE_BROKER=nats://nats:4222
+SCANNER_EVENTS_ENABLED=false
+SCANNER_EVENTS_DRIVER=redis
+# Leave SCANNER_EVENTS_DSN empty to inherit the Redis queue DSN when SCANNER_QUEUE_BROKER uses redis://.
+SCANNER_EVENTS_DSN=
+SCANNER_EVENTS_STREAM=stella.events
+SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
+SCANNER_EVENTS_MAX_STREAM_LENGTH=10000