sprints and audit work
This commit is contained in:
StellaOps Bot
857
src/Cli/StellaOps.Cli/Commands/EvidenceCommandGroup.cs
Normal file
857
src/Cli/StellaOps.Cli/Commands/EvidenceCommandGroup.cs
Normal file
@@ -0,0 +1,857 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// EvidenceCommandGroup.cs
|
||||
// Sprint: SPRINT_20260106_003_003_EVIDENCE_export_bundle
|
||||
// Task: T025, T026, T027 - Evidence bundle export and verify CLI commands
|
||||
// Description: CLI commands for exporting and verifying evidence bundles.
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System.CommandLine;
|
||||
using System.Formats.Tar;
|
||||
using System.IO.Compression;
|
||||
using System.Net.Http.Headers;
|
||||
using System.Net.Http.Json;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using System.Text.Json;
|
||||
using System.Text.Json.Serialization;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using StellaOps.Cli.Configuration;
|
||||
using Spectre.Console;
|
||||
|
||||
namespace StellaOps.Cli.Commands;
|
||||
|
||||
/// <summary>
|
||||
/// Command group for evidence bundle operations.
|
||||
/// Implements `stella evidence export` and `stella evidence verify`.
|
||||
/// </summary>
|
||||
public static class EvidenceCommandGroup
|
||||
{
|
||||
private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web)
|
||||
{
|
||||
WriteIndented = true,
|
||||
DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
|
||||
PropertyNamingPolicy = JsonNamingPolicy.CamelCase
|
||||
};
|
||||
|
||||
/// <summary>
|
||||
/// Build the evidence command group.
|
||||
/// </summary>
|
||||
public static Command BuildEvidenceCommand(
|
||||
IServiceProvider services,
|
||||
StellaOpsCliOptions options,
|
||||
Option<bool> verboseOption,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var evidence = new Command("evidence", "Evidence bundle operations for audits and offline verification")
|
||||
{
|
||||
BuildExportCommand(services, options, verboseOption, cancellationToken),
|
||||
BuildVerifyCommand(services, options, verboseOption, cancellationToken),
|
||||
BuildStatusCommand(services, options, verboseOption, cancellationToken)
|
||||
};
|
||||
|
||||
return evidence;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Build the export command.
|
||||
/// T025: stella evidence export --bundle <id> --output <path>
|
||||
/// T027: Progress indicator for large exports
|
||||
/// </summary>
|
||||
public static Command BuildExportCommand(
|
||||
IServiceProvider services,
|
||||
StellaOpsCliOptions options,
|
||||
Option<bool> verboseOption,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var bundleIdArg = new Argument<string>("bundle-id")
|
||||
{
|
||||
Description = "Bundle ID to export (e.g., eb-2026-01-06-abc123)"
|
||||
};
|
||||
|
||||
var outputOption = new Option<string>("--output", new[] { "-o" })
|
||||
{
|
||||
Description = "Output file path (defaults to evidence-bundle-<id>.tar.gz)",
|
||||
Required = false
|
||||
};
|
||||
|
||||
var includeLayersOption = new Option<bool>("--include-layers")
|
||||
{
|
||||
Description = "Include per-layer SBOMs in the export"
|
||||
};
|
||||
|
||||
var includeRekorOption = new Option<bool>("--include-rekor-proofs")
|
||||
{
|
||||
Description = "Include Rekor transparency log proofs"
|
||||
};
|
||||
|
||||
var formatOption = new Option<string>("--format", new[] { "-f" })
|
||||
{
|
||||
Description = "Export format: tar.gz (default), zip"
|
||||
};
|
||||
|
||||
var compressionOption = new Option<int>("--compression", new[] { "-c" })
|
||||
{
|
||||
Description = "Compression level (1-9, default: 6)"
|
||||
};
|
||||
|
||||
var export = new Command("export", "Export evidence bundle for offline audits")
|
||||
{
|
||||
bundleIdArg,
|
||||
outputOption,
|
||||
includeLayersOption,
|
||||
includeRekorOption,
|
||||
formatOption,
|
||||
compressionOption,
|
||||
verboseOption
|
||||
};
|
||||
|
||||
export.SetAction(async (parseResult, _) =>
|
||||
{
|
||||
var bundleId = parseResult.GetValue(bundleIdArg) ?? string.Empty;
|
||||
var output = parseResult.GetValue(outputOption);
|
||||
var includeLayers = parseResult.GetValue(includeLayersOption);
|
||||
var includeRekor = parseResult.GetValue(includeRekorOption);
|
||||
var format = parseResult.GetValue(formatOption) ?? "tar.gz";
|
||||
var compression = parseResult.GetValue(compressionOption);
|
||||
var verbose = parseResult.GetValue(verboseOption);
|
||||
|
||||
return await HandleExportAsync(
|
||||
services, options, bundleId, output, includeLayers, includeRekor, format,
|
||||
compression > 0 ? compression : 6, verbose, cancellationToken);
|
||||
});
|
||||
|
||||
return export;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Build the verify command.
|
||||
/// T026: stella evidence verify <path>
|
||||
/// </summary>
|
||||
public static Command BuildVerifyCommand(
|
||||
IServiceProvider services,
|
||||
StellaOpsCliOptions options,
|
||||
Option<bool> verboseOption,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var pathArg = new Argument<string>("path")
|
||||
{
|
||||
Description = "Path to evidence bundle archive (.tar.gz)"
|
||||
};
|
||||
|
||||
var offlineOption = new Option<bool>("--offline")
|
||||
{
|
||||
Description = "Skip Rekor transparency log verification (for air-gapped environments)"
|
||||
};
|
||||
|
||||
var skipSignaturesOption = new Option<bool>("--skip-signatures")
|
||||
{
|
||||
Description = "Skip DSSE signature verification (checksums only)"
|
||||
};
|
||||
|
||||
var outputOption = new Option<string>("--output", new[] { "-o" })
|
||||
{
|
||||
Description = "Output format: table (default), json"
|
||||
};
|
||||
|
||||
var verify = new Command("verify", "Verify an exported evidence bundle")
|
||||
{
|
||||
pathArg,
|
||||
offlineOption,
|
||||
skipSignaturesOption,
|
||||
outputOption,
|
||||
verboseOption
|
||||
};
|
||||
|
||||
verify.SetAction(async (parseResult, _) =>
|
||||
{
|
||||
var path = parseResult.GetValue(pathArg) ?? string.Empty;
|
||||
var offline = parseResult.GetValue(offlineOption);
|
||||
var skipSignatures = parseResult.GetValue(skipSignaturesOption);
|
||||
var output = parseResult.GetValue(outputOption) ?? "table";
|
||||
var verbose = parseResult.GetValue(verboseOption);
|
||||
|
||||
return await HandleVerifyAsync(services, options, path, offline, skipSignatures, output, verbose, cancellationToken);
|
||||
});
|
||||
|
||||
return verify;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Build the status command for checking async export progress.
|
||||
/// </summary>
|
||||
public static Command BuildStatusCommand(
|
||||
IServiceProvider services,
|
||||
StellaOpsCliOptions options,
|
||||
Option<bool> verboseOption,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var exportIdArg = new Argument<string>("export-id")
|
||||
{
|
||||
Description = "Export job ID to check status for"
|
||||
};
|
||||
|
||||
var bundleIdOption = new Option<string>("--bundle", new[] { "-b" })
|
||||
{
|
||||
Description = "Bundle ID (optional, for disambiguation)"
|
||||
};
|
||||
|
||||
var status = new Command("status", "Check status of an async export job")
|
||||
{
|
||||
exportIdArg,
|
||||
bundleIdOption,
|
||||
verboseOption
|
||||
};
|
||||
|
||||
status.SetAction(async (parseResult, _) =>
|
||||
{
|
||||
var exportId = parseResult.GetValue(exportIdArg) ?? string.Empty;
|
||||
var bundleId = parseResult.GetValue(bundleIdOption);
|
||||
var verbose = parseResult.GetValue(verboseOption);
|
||||
|
||||
return await HandleStatusAsync(services, options, exportId, bundleId, verbose, cancellationToken);
|
||||
});
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
private static async Task<int> HandleExportAsync(
|
||||
IServiceProvider services,
|
||||
StellaOpsCliOptions options,
|
||||
string bundleId,
|
||||
string? outputPath,
|
||||
bool includeLayers,
|
||||
bool includeRekor,
|
||||
string format,
|
||||
int compression,
|
||||
bool verbose,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
if (string.IsNullOrEmpty(bundleId))
|
||||
{
|
||||
AnsiConsole.MarkupLine("[red]Error:[/] Bundle ID is required");
|
||||
return 1;
|
||||
}
|
||||
|
||||
var loggerFactory = services.GetService<ILoggerFactory>();
|
||||
var logger = loggerFactory?.CreateLogger(typeof(EvidenceCommandGroup));
|
||||
var httpClientFactory = services.GetRequiredService<IHttpClientFactory>();
|
||||
var client = httpClientFactory.CreateClient("EvidenceLocker");
|
||||
|
||||
// Get backend URL
|
||||
var backendUrl = options.BackendUrl
|
||||
?? Environment.GetEnvironmentVariable("STELLAOPS_EVIDENCE_URL")
|
||||
?? Environment.GetEnvironmentVariable("STELLAOPS_BACKEND_URL")
|
||||
?? "http://localhost:5000";
|
||||
|
||||
if (verbose)
|
||||
{
|
||||
AnsiConsole.MarkupLine($"[dim]Backend URL: {backendUrl}[/]");
|
||||
}
|
||||
|
||||
outputPath ??= $"evidence-bundle-{bundleId}.tar.gz";
|
||||
|
||||
// Start export with progress
|
||||
await AnsiConsole.Progress()
|
||||
.AutoClear(false)
|
||||
.HideCompleted(false)
|
||||
.Columns(
|
||||
new TaskDescriptionColumn(),
|
||||
new ProgressBarColumn(),
|
||||
new PercentageColumn(),
|
||||
new RemainingTimeColumn(),
|
||||
new SpinnerColumn())
|
||||
.StartAsync(async ctx =>
|
||||
{
|
||||
var exportTask = ctx.AddTask("[yellow]Exporting evidence bundle[/]");
|
||||
exportTask.MaxValue = 100;
|
||||
|
||||
try
|
||||
{
|
||||
// Request export
|
||||
var exportRequest = new
|
||||
{
|
||||
format,
|
||||
compressionLevel = compression,
|
||||
includeLayerSboms = includeLayers,
|
||||
includeRekorProofs = includeRekor
|
||||
};
|
||||
|
||||
var requestUrl = $"{backendUrl}/api/v1/bundles/{bundleId}/export";
|
||||
var response = await client.PostAsJsonAsync(requestUrl, exportRequest, cancellationToken);
|
||||
|
||||
if (!response.IsSuccessStatusCode)
|
||||
{
|
||||
var error = await response.Content.ReadAsStringAsync(cancellationToken);
|
||||
AnsiConsole.MarkupLine($"[red]Export failed:[/] {response.StatusCode} - {error}");
|
||||
return;
|
||||
}
|
||||
|
||||
var exportResponse = await response.Content.ReadFromJsonAsync<ExportResponseDto>(cancellationToken);
|
||||
if (exportResponse is null)
|
||||
{
|
||||
AnsiConsole.MarkupLine("[red]Invalid response from server[/]");
|
||||
return;
|
||||
}
|
||||
|
||||
exportTask.Description = $"[yellow]Exporting {bundleId}[/]";
|
||||
|
||||
// Poll for completion
|
||||
var statusUrl = $"{backendUrl}/api/v1/bundles/{bundleId}/export/{exportResponse.ExportId}";
|
||||
while (!cancellationToken.IsCancellationRequested)
|
||||
{
|
||||
var statusResponse = await client.GetAsync(statusUrl, cancellationToken);
|
||||
|
||||
if (statusResponse.StatusCode == System.Net.HttpStatusCode.OK)
|
||||
{
|
||||
// Export ready - download
|
||||
exportTask.Value = 90;
|
||||
exportTask.Description = "[green]Downloading bundle[/]";
|
||||
|
||||
await using var fileStream = new FileStream(outputPath, FileMode.Create, FileAccess.Write);
|
||||
await using var downloadStream = await statusResponse.Content.ReadAsStreamAsync(cancellationToken);
|
||||
|
||||
var buffer = new byte[81920];
|
||||
long totalBytesRead = 0;
|
||||
var contentLength = statusResponse.Content.Headers.ContentLength ?? 0;
|
||||
|
||||
int bytesRead;
|
||||
while ((bytesRead = await downloadStream.ReadAsync(buffer, cancellationToken)) > 0)
|
||||
{
|
||||
await fileStream.WriteAsync(buffer.AsMemory(0, bytesRead), cancellationToken);
|
||||
totalBytesRead += bytesRead;
|
||||
|
||||
if (contentLength > 0)
|
||||
{
|
||||
exportTask.Value = 90 + (10.0 * totalBytesRead / contentLength);
|
||||
}
|
||||
}
|
||||
|
||||
exportTask.Value = 100;
|
||||
exportTask.Description = "[green]Export complete[/]";
|
||||
break;
|
||||
}
|
||||
|
||||
if (statusResponse.StatusCode == System.Net.HttpStatusCode.Accepted)
|
||||
{
|
||||
var statusDto = await statusResponse.Content.ReadFromJsonAsync<ExportStatusDto>(cancellationToken);
|
||||
if (statusDto is not null)
|
||||
{
|
||||
exportTask.Value = statusDto.Progress;
|
||||
exportTask.Description = $"[yellow]{statusDto.Status}: {statusDto.Progress}%[/]";
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
var error = await statusResponse.Content.ReadAsStringAsync(cancellationToken);
|
||||
AnsiConsole.MarkupLine($"[red]Export failed:[/] {statusResponse.StatusCode} - {error}");
|
||||
return;
|
||||
}
|
||||
|
||||
await Task.Delay(1000, cancellationToken);
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
AnsiConsole.MarkupLine($"[red]Error:[/] {ex.Message}");
|
||||
if (verbose)
|
||||
{
|
||||
logger?.LogError(ex, "Export failed");
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
if (File.Exists(outputPath))
|
||||
{
|
||||
var fileInfo = new FileInfo(outputPath);
|
||||
AnsiConsole.WriteLine();
|
||||
AnsiConsole.MarkupLine($"[green]Exported to:[/] {outputPath}");
|
||||
AnsiConsole.MarkupLine($"[dim]Size: {FormatSize(fileInfo.Length)}[/]");
|
||||
return 0;
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
private static async Task<int> HandleVerifyAsync(
|
||||
IServiceProvider services,
|
||||
StellaOpsCliOptions options,
|
||||
string path,
|
||||
bool offline,
|
||||
bool skipSignatures,
|
||||
string outputFormat,
|
||||
bool verbose,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
if (!File.Exists(path))
|
||||
{
|
||||
AnsiConsole.MarkupLine($"[red]Error:[/] File not found: {path}");
|
||||
return 1;
|
||||
}
|
||||
|
||||
var results = new List<VerificationResult>();
|
||||
|
||||
await AnsiConsole.Status()
|
||||
.AutoRefresh(true)
|
||||
.Spinner(Spinner.Known.Dots)
|
||||
.StartAsync("Verifying evidence bundle...", async ctx =>
|
||||
{
|
||||
try
|
||||
{
|
||||
// Extract to temp directory
|
||||
var extractDir = Path.Combine(Path.GetTempPath(), $"evidence-verify-{Guid.NewGuid():N}");
|
||||
Directory.CreateDirectory(extractDir);
|
||||
|
||||
ctx.Status("Extracting bundle...");
|
||||
await ExtractTarGzAsync(path, extractDir, cancellationToken);
|
||||
|
||||
// Check 1: Verify checksums file exists
|
||||
var checksumsPath = Path.Combine(extractDir, "checksums.sha256");
|
||||
if (!File.Exists(checksumsPath))
|
||||
{
|
||||
results.Add(new VerificationResult("Checksums file", false, "checksums.sha256 not found"));
|
||||
}
|
||||
else
|
||||
{
|
||||
// Check 2: Verify all checksums
|
||||
ctx.Status("Verifying checksums...");
|
||||
var checksumResult = await VerifyChecksumsAsync(extractDir, checksumsPath, cancellationToken);
|
||||
results.Add(checksumResult);
|
||||
}
|
||||
|
||||
// Check 3: Verify manifest
|
||||
var manifestPath = Path.Combine(extractDir, "manifest.json");
|
||||
if (!File.Exists(manifestPath))
|
||||
{
|
||||
results.Add(new VerificationResult("Manifest", false, "manifest.json not found"));
|
||||
}
|
||||
else
|
||||
{
|
||||
ctx.Status("Verifying manifest...");
|
||||
var manifestResult = await VerifyManifestAsync(manifestPath, extractDir, cancellationToken);
|
||||
results.Add(manifestResult);
|
||||
}
|
||||
|
||||
// Check 4: Verify DSSE signatures (unless skipped)
|
||||
if (!skipSignatures)
|
||||
{
|
||||
ctx.Status("Verifying signatures...");
|
||||
var attestDir = Path.Combine(extractDir, "attestations");
|
||||
var keysDir = Path.Combine(extractDir, "keys");
|
||||
|
||||
if (Directory.Exists(attestDir))
|
||||
{
|
||||
var sigResult = await VerifySignaturesAsync(attestDir, keysDir, verbose, cancellationToken);
|
||||
results.Add(sigResult);
|
||||
}
|
||||
else
|
||||
{
|
||||
results.Add(new VerificationResult("Signatures", true, "No attestations to verify"));
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
results.Add(new VerificationResult("Signatures", true, "Skipped (--skip-signatures)"));
|
||||
}
|
||||
|
||||
// Check 5: Verify Rekor proofs (unless offline)
|
||||
if (!offline)
|
||||
{
|
||||
ctx.Status("Verifying Rekor proofs...");
|
||||
var rekorDir = Path.Combine(extractDir, "attestations", "rekor-proofs");
|
||||
if (Directory.Exists(rekorDir) && Directory.GetFiles(rekorDir).Length > 0)
|
||||
{
|
||||
var rekorResult = await VerifyRekorProofsAsync(rekorDir, verbose, cancellationToken);
|
||||
results.Add(rekorResult);
|
||||
}
|
||||
else
|
||||
{
|
||||
results.Add(new VerificationResult("Rekor proofs", true, "No proofs to verify"));
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
results.Add(new VerificationResult("Rekor proofs", true, "Skipped (offline mode)"));
|
||||
}
|
||||
|
||||
// Cleanup
|
||||
try
|
||||
{
|
||||
Directory.Delete(extractDir, recursive: true);
|
||||
}
|
||||
catch
|
||||
{
|
||||
// Ignore cleanup errors
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
results.Add(new VerificationResult("Extraction", false, $"Failed: {ex.Message}"));
|
||||
}
|
||||
});
|
||||
|
||||
// Output results
|
||||
if (outputFormat == "json")
|
||||
{
|
||||
var jsonResults = JsonSerializer.Serialize(new
|
||||
{
|
||||
path,
|
||||
verified = results.All(r => r.Passed),
|
||||
results = results.Select(r => new { check = r.Check, passed = r.Passed, message = r.Message })
|
||||
}, JsonOptions);
|
||||
Console.WriteLine(jsonResults);
|
||||
}
|
||||
else
|
||||
{
|
||||
var table = new Table()
|
||||
.Border(TableBorder.Rounded)
|
||||
.AddColumn("Check")
|
||||
.AddColumn("Status")
|
||||
.AddColumn("Details");
|
||||
|
||||
foreach (var result in results)
|
||||
{
|
||||
var status = result.Passed ? "[green]PASS[/]" : "[red]FAIL[/]";
|
||||
table.AddRow(result.Check, status, result.Message);
|
||||
}
|
||||
|
||||
AnsiConsole.WriteLine();
|
||||
AnsiConsole.Write(table);
|
||||
AnsiConsole.WriteLine();
|
||||
|
||||
var allPassed = results.All(r => r.Passed);
|
||||
if (allPassed)
|
||||
{
|
||||
AnsiConsole.MarkupLine("[green]Verification PASSED[/]");
|
||||
}
|
||||
else
|
||||
{
|
||||
AnsiConsole.MarkupLine("[red]Verification FAILED[/]");
|
||||
}
|
||||
}
|
||||
|
||||
return results.All(r => r.Passed) ? 0 : 1;
|
||||
}
|
||||
|
||||
private static async Task<int> HandleStatusAsync(
|
||||
IServiceProvider services,
|
||||
StellaOpsCliOptions options,
|
||||
string exportId,
|
||||
string? bundleId,
|
||||
bool verbose,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var httpClientFactory = services.GetRequiredService<IHttpClientFactory>();
|
||||
var client = httpClientFactory.CreateClient("EvidenceLocker");
|
||||
|
||||
var backendUrl = options.BackendUrl
|
||||
?? Environment.GetEnvironmentVariable("STELLAOPS_EVIDENCE_URL")
|
||||
?? Environment.GetEnvironmentVariable("STELLAOPS_BACKEND_URL")
|
||||
?? "http://localhost:5000";
|
||||
|
||||
// If bundle ID is provided, use specific endpoint
|
||||
var statusUrl = !string.IsNullOrEmpty(bundleId)
|
||||
? $"{backendUrl}/api/v1/bundles/{bundleId}/export/{exportId}"
|
||||
: $"{backendUrl}/api/v1/exports/{exportId}";
|
||||
|
||||
try
|
||||
{
|
||||
var response = await client.GetAsync(statusUrl, cancellationToken);
|
||||
|
||||
if (response.StatusCode == System.Net.HttpStatusCode.OK)
|
||||
{
|
||||
AnsiConsole.MarkupLine($"[green]Export complete[/]: Ready for download");
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (response.StatusCode == System.Net.HttpStatusCode.Accepted)
|
||||
{
|
||||
var status = await response.Content.ReadFromJsonAsync<ExportStatusDto>(cancellationToken);
|
||||
if (status is not null)
|
||||
{
|
||||
AnsiConsole.MarkupLine($"[yellow]Status:[/] {status.Status}");
|
||||
AnsiConsole.MarkupLine($"[dim]Progress: {status.Progress}%[/]");
|
||||
if (!string.IsNullOrEmpty(status.EstimatedTimeRemaining))
|
||||
{
|
||||
AnsiConsole.MarkupLine($"[dim]ETA: {status.EstimatedTimeRemaining}[/]");
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
|
||||
{
|
||||
AnsiConsole.MarkupLine($"[red]Export not found:[/] {exportId}");
|
||||
return 1;
|
||||
}
|
||||
|
||||
var error = await response.Content.ReadAsStringAsync(cancellationToken);
|
||||
AnsiConsole.MarkupLine($"[red]Error:[/] {response.StatusCode} - {error}");
|
||||
return 1;
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
AnsiConsole.MarkupLine($"[red]Error:[/] {ex.Message}");
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
private static async Task ExtractTarGzAsync(string archivePath, string extractDir, CancellationToken cancellationToken)
|
||||
{
|
||||
await using var fileStream = File.OpenRead(archivePath);
|
||||
await using var gzipStream = new GZipStream(fileStream, CompressionMode.Decompress);
|
||||
await TarFile.ExtractToDirectoryAsync(gzipStream, extractDir, overwriteFiles: true, cancellationToken);
|
||||
}
|
||||
|
||||
private static async Task<VerificationResult> VerifyChecksumsAsync(
|
||||
string extractDir,
|
||||
string checksumsPath,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var lines = await File.ReadAllLinesAsync(checksumsPath, cancellationToken);
|
||||
var failedFiles = new List<string>();
|
||||
var verifiedCount = 0;
|
||||
|
||||
foreach (var line in lines)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(line) || line.StartsWith('#'))
|
||||
continue;
|
||||
|
||||
// Parse BSD format: SHA256 (filename) = digest
|
||||
var match = System.Text.RegularExpressions.Regex.Match(line, @"^SHA256 \(([^)]+)\) = ([a-f0-9]+)$");
|
||||
if (!match.Success)
|
||||
continue;
|
||||
|
||||
var fileName = match.Groups[1].Value;
|
||||
var expectedDigest = match.Groups[2].Value;
|
||||
var filePath = Path.Combine(extractDir, fileName);
|
||||
|
||||
if (!File.Exists(filePath))
|
||||
{
|
||||
failedFiles.Add($"{fileName} (missing)");
|
||||
continue;
|
||||
}
|
||||
|
||||
var actualDigest = await ComputeSha256Async(filePath, cancellationToken);
|
||||
if (!string.Equals(actualDigest, expectedDigest, StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
failedFiles.Add($"{fileName} (mismatch)");
|
||||
}
|
||||
else
|
||||
{
|
||||
verifiedCount++;
|
||||
}
|
||||
}
|
||||
|
||||
if (failedFiles.Count > 0)
|
||||
{
|
||||
return new VerificationResult("Checksums", false, $"Failed: {string.Join(", ", failedFiles.Take(3))}");
|
||||
}
|
||||
|
||||
return new VerificationResult("Checksums", true, $"Verified {verifiedCount} files");
|
||||
}
|
||||
|
||||
private static async Task<VerificationResult> VerifyManifestAsync(
|
||||
string manifestPath,
|
||||
string extractDir,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
try
|
||||
{
|
||||
var manifestJson = await File.ReadAllTextAsync(manifestPath, cancellationToken);
|
||||
var manifest = JsonSerializer.Deserialize<ManifestDto>(manifestJson);
|
||||
|
||||
if (manifest is null)
|
||||
{
|
||||
return new VerificationResult("Manifest", false, "Invalid manifest JSON");
|
||||
}
|
||||
|
||||
// Verify all referenced artifacts exist
|
||||
var missingArtifacts = new List<string>();
|
||||
var allArtifacts = (manifest.Sboms ?? [])
|
||||
.Concat(manifest.VexStatements ?? [])
|
||||
.Concat(manifest.Attestations ?? [])
|
||||
.Concat(manifest.PolicyVerdicts ?? [])
|
||||
.Concat(manifest.ScanResults ?? []);
|
||||
|
||||
foreach (var artifact in allArtifacts)
|
||||
{
|
||||
var artifactPath = Path.Combine(extractDir, artifact.Path);
|
||||
if (!File.Exists(artifactPath))
|
||||
{
|
||||
missingArtifacts.Add(artifact.Path);
|
||||
}
|
||||
}
|
||||
|
||||
if (missingArtifacts.Count > 0)
|
||||
{
|
||||
return new VerificationResult("Manifest", false, $"Missing artifacts: {string.Join(", ", missingArtifacts.Take(3))}");
|
||||
}
|
||||
|
||||
return new VerificationResult("Manifest", true, $"Bundle {manifest.BundleId}, {manifest.TotalArtifacts} artifacts");
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
return new VerificationResult("Manifest", false, $"Parse error: {ex.Message}");
|
||||
}
|
||||
}
|
||||
|
||||
private static Task<VerificationResult> VerifySignaturesAsync(
|
||||
string attestDir,
|
||||
string keysDir,
|
||||
bool verbose,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
// For now, just verify DSSE envelope structure exists
|
||||
// Full cryptographic verification would require loading keys and verifying signatures
|
||||
var dsseFiles = Directory.GetFiles(attestDir, "*.dsse.json");
|
||||
|
||||
if (dsseFiles.Length == 0)
|
||||
{
|
||||
return Task.FromResult(new VerificationResult("Signatures", true, "No DSSE envelopes found"));
|
||||
}
|
||||
|
||||
// Basic structure validation - check files are valid JSON with expected structure
|
||||
var validCount = 0;
|
||||
foreach (var file in dsseFiles)
|
||||
{
|
||||
try
|
||||
{
|
||||
var content = File.ReadAllText(file);
|
||||
var doc = JsonDocument.Parse(content);
|
||||
if (doc.RootElement.TryGetProperty("payloadType", out _) &&
|
||||
doc.RootElement.TryGetProperty("payload", out _))
|
||||
{
|
||||
validCount++;
|
||||
}
|
||||
}
|
||||
catch
|
||||
{
|
||||
// Invalid DSSE envelope
|
||||
}
|
||||
}
|
||||
|
||||
return Task.FromResult(new VerificationResult(
|
||||
"Signatures",
|
||||
validCount == dsseFiles.Length,
|
||||
$"Validated {validCount}/{dsseFiles.Length} DSSE envelopes"));
|
||||
}
|
||||
|
||||
private static Task<VerificationResult> VerifyRekorProofsAsync(
|
||||
string rekorDir,
|
||||
bool verbose,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
// Rekor verification requires network access and is complex
|
||||
// For now, verify proof files are valid JSON
|
||||
var proofFiles = Directory.GetFiles(rekorDir, "*.proof.json");
|
||||
|
||||
if (proofFiles.Length == 0)
|
||||
{
|
||||
return Task.FromResult(new VerificationResult("Rekor proofs", true, "No proofs to verify"));
|
||||
}
|
||||
|
||||
var validCount = 0;
|
||||
foreach (var file in proofFiles)
|
||||
{
|
||||
try
|
||||
{
|
||||
var content = File.ReadAllText(file);
|
||||
JsonDocument.Parse(content);
|
||||
validCount++;
|
||||
}
|
||||
catch
|
||||
{
|
||||
// Invalid proof
|
||||
}
|
||||
}
|
||||
|
||||
return Task.FromResult(new VerificationResult(
|
||||
"Rekor proofs",
|
||||
validCount == proofFiles.Length,
|
||||
$"Validated {validCount}/{proofFiles.Length} proof files (online verification not implemented)"));
|
||||
}
|
||||
|
||||
private static async Task<string> ComputeSha256Async(string filePath, CancellationToken cancellationToken)
|
||||
{
|
||||
await using var stream = File.OpenRead(filePath);
|
||||
var hash = await SHA256.HashDataAsync(stream, cancellationToken);
|
||||
return Convert.ToHexStringLower(hash);
|
||||
}
|
||||
|
||||
private static string FormatSize(long bytes)
|
||||
{
|
||||
string[] sizes = ["B", "KB", "MB", "GB"];
|
||||
var order = 0;
|
||||
double size = bytes;
|
||||
while (size >= 1024 && order < sizes.Length - 1)
|
||||
{
|
||||
order++;
|
||||
size /= 1024;
|
||||
}
|
||||
return $"{size:0.##} {sizes[order]}";
|
||||
}
|
||||
|
||||
// DTOs for API communication
|
||||
private sealed record ExportResponseDto
|
||||
{
|
||||
[JsonPropertyName("exportId")]
|
||||
public string ExportId { get; init; } = string.Empty;
|
||||
|
||||
[JsonPropertyName("status")]
|
||||
public string Status { get; init; } = string.Empty;
|
||||
|
||||
[JsonPropertyName("estimatedSize")]
|
||||
public long EstimatedSize { get; init; }
|
||||
}
|
||||
|
||||
private sealed record ExportStatusDto
|
||||
{
|
||||
[JsonPropertyName("exportId")]
|
||||
public string ExportId { get; init; } = string.Empty;
|
||||
|
||||
[JsonPropertyName("status")]
|
||||
public string Status { get; init; } = string.Empty;
|
||||
|
||||
[JsonPropertyName("progress")]
|
||||
public int Progress { get; init; }
|
||||
|
||||
[JsonPropertyName("estimatedTimeRemaining")]
|
||||
public string? EstimatedTimeRemaining { get; init; }
|
||||
}
|
||||
|
||||
private sealed record ManifestDto
|
||||
{
|
||||
[JsonPropertyName("bundleId")]
|
||||
public string BundleId { get; init; } = string.Empty;
|
||||
|
||||
[JsonPropertyName("totalArtifacts")]
|
||||
public int TotalArtifacts { get; init; }
|
||||
|
||||
[JsonPropertyName("sboms")]
|
||||
public ArtifactRefDto[]? Sboms { get; init; }
|
||||
|
||||
[JsonPropertyName("vexStatements")]
|
||||
public ArtifactRefDto[]? VexStatements { get; init; }
|
||||
|
||||
[JsonPropertyName("attestations")]
|
||||
public ArtifactRefDto[]? Attestations { get; init; }
|
||||
|
||||
[JsonPropertyName("policyVerdicts")]
|
||||
public ArtifactRefDto[]? PolicyVerdicts { get; init; }
|
||||
|
||||
[JsonPropertyName("scanResults")]
|
||||
public ArtifactRefDto[]? ScanResults { get; init; }
|
||||
}
|
||||
|
||||
private sealed record ArtifactRefDto
|
||||
{
|
||||
[JsonPropertyName("path")]
|
||||
public string Path { get; init; } = string.Empty;
|
||||
|
||||
[JsonPropertyName("digest")]
|
||||
public string Digest { get; init; } = string.Empty;
|
||||
}
|
||||
|
||||
private sealed record VerificationResult(string Check, bool Passed, string Message);
|
||||
}
|
||||
Reference in New Issue
Block a user