Fix build and code structure improvements. New but essential UI functionality. CI improvements. Documentation improvements. AI module improvements.
This commit is contained in:
StellaOps Bot
@@ -0,0 +1,548 @@
|
||||
// -----------------------------------------------------------------------------
|
||||
// CrossModuleEvidenceLinkingTests.cs
|
||||
// Sprint: SPRINT_8100_0012_0002 - Unified Evidence Model
|
||||
// Task: EVID-8100-018 - Cross-module evidence linking integration tests
|
||||
// Description: Integration tests verifying evidence linking across modules:
|
||||
// - Same subject can have evidence from multiple modules
|
||||
// - Evidence types from Scanner, Attestor, Policy, Excititor
|
||||
// - Evidence chain/graph queries work correctly
|
||||
// -----------------------------------------------------------------------------
|
||||
|
||||
using System.Text;
|
||||
using System.Text.Json;
|
||||
using FluentAssertions;
|
||||
using StellaOps.Evidence.Core;
|
||||
using StellaOps.Evidence.Persistence.Postgres.Tests.Fixtures;
|
||||
using Xunit;
|
||||
|
||||
using StellaOps.TestKit;
|
||||
namespace StellaOps.Evidence.Persistence.Postgres.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// Integration tests for cross-module evidence linking.
|
||||
/// Verifies that the unified evidence model correctly links evidence
|
||||
/// from different modules (Scanner, Attestor, Policy, Excititor) to the same subject.
|
||||
/// </summary>
|
||||
[Collection(EvidencePostgresTestCollection.Name)]
|
||||
public sealed class CrossModuleEvidenceLinkingTests : IAsyncLifetime
|
||||
{
|
||||
private readonly EvidencePostgresContainerFixture _fixture;
|
||||
private readonly ITestOutputHelper _output;
|
||||
private readonly string _tenantId = Guid.NewGuid().ToString();
|
||||
private PostgresEvidenceStore _store = null!;
|
||||
|
||||
public CrossModuleEvidenceLinkingTests(
|
||||
EvidencePostgresContainerFixture fixture,
|
||||
ITestOutputHelper output)
|
||||
{
|
||||
_fixture = fixture;
|
||||
_output = output;
|
||||
}
|
||||
|
||||
public Task InitializeAsync()
|
||||
{
|
||||
_store = _fixture.CreateStore(_tenantId);
|
||||
return Task.CompletedTask;
|
||||
}
|
||||
|
||||
public async Task DisposeAsync()
|
||||
{
|
||||
await _fixture.TruncateAllTablesAsync();
|
||||
}
|
||||
|
||||
#region Multi-Module Evidence for Same Subject
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task SameSubject_MultipleEvidenceTypes_AllLinked()
|
||||
{
|
||||
// Arrange - A container image subject with evidence from multiple modules
|
||||
var subjectNodeId = $"sha256:{Guid.NewGuid():N}"; // Container image digest
|
||||
|
||||
var scannerEvidence = CreateScannerEvidence(subjectNodeId);
|
||||
var reachabilityEvidence = CreateReachabilityEvidence(subjectNodeId);
|
||||
var policyEvidence = CreatePolicyEvidence(subjectNodeId);
|
||||
var vexEvidence = CreateVexEvidence(subjectNodeId);
|
||||
var provenanceEvidence = CreateProvenanceEvidence(subjectNodeId);
|
||||
|
||||
// Act - Store all evidence
|
||||
await _store.StoreAsync(scannerEvidence);
|
||||
await _store.StoreAsync(reachabilityEvidence);
|
||||
await _store.StoreAsync(policyEvidence);
|
||||
await _store.StoreAsync(vexEvidence);
|
||||
await _store.StoreAsync(provenanceEvidence);
|
||||
|
||||
// Assert - All evidence linked to same subject
|
||||
var allEvidence = await _store.GetBySubjectAsync(subjectNodeId);
|
||||
|
||||
allEvidence.Should().HaveCount(5);
|
||||
allEvidence.Select(e => e.EvidenceType).Should().Contain(new[]
|
||||
{
|
||||
EvidenceType.Scan,
|
||||
EvidenceType.Reachability,
|
||||
EvidenceType.Policy,
|
||||
EvidenceType.Vex,
|
||||
EvidenceType.Provenance
|
||||
});
|
||||
|
||||
_output.WriteLine($"Subject {subjectNodeId} has {allEvidence.Count} evidence records from different modules");
|
||||
}
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task SameSubject_FilterByType_ReturnsCorrectEvidence()
|
||||
{
|
||||
// Arrange
|
||||
var subjectNodeId = $"sha256:{Guid.NewGuid():N}";
|
||||
|
||||
await _store.StoreAsync(CreateScannerEvidence(subjectNodeId));
|
||||
await _store.StoreAsync(CreateScannerEvidence(subjectNodeId)); // Another scan finding
|
||||
await _store.StoreAsync(CreateReachabilityEvidence(subjectNodeId));
|
||||
await _store.StoreAsync(CreatePolicyEvidence(subjectNodeId));
|
||||
|
||||
// Act - Filter by Scan type
|
||||
var scanEvidence = await _store.GetBySubjectAsync(subjectNodeId, EvidenceType.Scan);
|
||||
var policyEvidence = await _store.GetBySubjectAsync(subjectNodeId, EvidenceType.Policy);
|
||||
|
||||
// Assert
|
||||
scanEvidence.Should().HaveCount(2);
|
||||
policyEvidence.Should().HaveCount(1);
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Evidence Chain Scenarios
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task EvidenceChain_ScanToVexToPolicy_LinkedCorrectly()
|
||||
{
|
||||
// Scenario: Vulnerability scan → VEX assessment → Policy decision
|
||||
// All evidence points to the same subject (vulnerability finding)
|
||||
|
||||
var vulnerabilitySubject = $"sha256:{Guid.NewGuid():N}";
|
||||
|
||||
// 1. Scanner finds vulnerability
|
||||
var scanEvidence = CreateScannerEvidence(vulnerabilitySubject);
|
||||
await _store.StoreAsync(scanEvidence);
|
||||
|
||||
// 2. VEX assessment received
|
||||
var vexEvidence = CreateVexEvidence(vulnerabilitySubject, referencedEvidenceId: scanEvidence.EvidenceId);
|
||||
await _store.StoreAsync(vexEvidence);
|
||||
|
||||
// 3. Policy engine makes decision
|
||||
var policyEvidence = CreatePolicyEvidence(vulnerabilitySubject, referencedEvidenceId: vexEvidence.EvidenceId);
|
||||
await _store.StoreAsync(policyEvidence);
|
||||
|
||||
// Assert - Chain is queryable
|
||||
var allEvidence = await _store.GetBySubjectAsync(vulnerabilitySubject);
|
||||
allEvidence.Should().HaveCount(3);
|
||||
|
||||
// Verify order by type represents the chain
|
||||
var scan = allEvidence.First(e => e.EvidenceType == EvidenceType.Scan);
|
||||
var vex = allEvidence.First(e => e.EvidenceType == EvidenceType.Vex);
|
||||
var policy = allEvidence.First(e => e.EvidenceType == EvidenceType.Policy);
|
||||
|
||||
scan.Should().NotBeNull();
|
||||
vex.Should().NotBeNull();
|
||||
policy.Should().NotBeNull();
|
||||
|
||||
_output.WriteLine($"Evidence chain: Scan({scan.EvidenceId}) → VEX({vex.EvidenceId}) → Policy({policy.EvidenceId})");
|
||||
}
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task EvidenceChain_ReachabilityToEpssToPolicy_LinkedCorrectly()
|
||||
{
|
||||
// Scenario: Reachability analysis + EPSS score → Policy decision
|
||||
var subjectNodeId = $"sha256:{Guid.NewGuid():N}";
|
||||
|
||||
// 1. Reachability analysis
|
||||
var reachability = CreateReachabilityEvidence(subjectNodeId);
|
||||
await _store.StoreAsync(reachability);
|
||||
|
||||
// 2. EPSS score
|
||||
var epss = CreateEpssEvidence(subjectNodeId);
|
||||
await _store.StoreAsync(epss);
|
||||
|
||||
// 3. Policy decision based on both
|
||||
var policy = CreatePolicyEvidence(subjectNodeId, referencedEvidenceIds: new[]
|
||||
{
|
||||
reachability.EvidenceId,
|
||||
epss.EvidenceId
|
||||
});
|
||||
await _store.StoreAsync(policy);
|
||||
|
||||
// Assert
|
||||
var allEvidence = await _store.GetBySubjectAsync(subjectNodeId);
|
||||
allEvidence.Should().HaveCount(3);
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Multi-Tenant Evidence Isolation
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task MultiTenant_SameSubject_IsolatedByTenant()
|
||||
{
|
||||
// Arrange - Two tenants with evidence for the same subject
|
||||
var subjectNodeId = $"sha256:{Guid.NewGuid():N}";
|
||||
var tenantA = Guid.NewGuid().ToString();
|
||||
var tenantB = Guid.NewGuid().ToString();
|
||||
|
||||
var storeA = _fixture.CreateStore(tenantA);
|
||||
var storeB = _fixture.CreateStore(tenantB);
|
||||
|
||||
var evidenceA = CreateScannerEvidence(subjectNodeId);
|
||||
var evidenceB = CreateScannerEvidence(subjectNodeId);
|
||||
|
||||
// Act - Store in different tenant stores
|
||||
await storeA.StoreAsync(evidenceA);
|
||||
await storeB.StoreAsync(evidenceB);
|
||||
|
||||
// Assert - Each tenant only sees their own evidence
|
||||
var retrievedA = await storeA.GetBySubjectAsync(subjectNodeId);
|
||||
var retrievedB = await storeB.GetBySubjectAsync(subjectNodeId);
|
||||
|
||||
retrievedA.Should().HaveCount(1);
|
||||
retrievedA[0].EvidenceId.Should().Be(evidenceA.EvidenceId);
|
||||
|
||||
retrievedB.Should().HaveCount(1);
|
||||
retrievedB[0].EvidenceId.Should().Be(evidenceB.EvidenceId);
|
||||
|
||||
_output.WriteLine($"Tenant A evidence: {evidenceA.EvidenceId}");
|
||||
_output.WriteLine($"Tenant B evidence: {evidenceB.EvidenceId}");
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Evidence Graph Queries
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task EvidenceGraph_AllTypesForArtifact_ReturnsComplete()
|
||||
{
|
||||
// Arrange - Simulate a complete evidence graph for a container artifact
|
||||
var artifactDigest = $"sha256:{Guid.NewGuid():N}";
|
||||
|
||||
var evidenceRecords = new[]
|
||||
{
|
||||
CreateArtifactEvidence(artifactDigest), // SBOM entry
|
||||
CreateScannerEvidence(artifactDigest), // Vulnerability scan
|
||||
CreateReachabilityEvidence(artifactDigest), // Reachability analysis
|
||||
CreateEpssEvidence(artifactDigest), // EPSS score
|
||||
CreateVexEvidence(artifactDigest), // VEX statement
|
||||
CreatePolicyEvidence(artifactDigest), // Policy decision
|
||||
CreateProvenanceEvidence(artifactDigest), // Build provenance
|
||||
CreateExceptionEvidence(artifactDigest) // Exception applied
|
||||
};
|
||||
|
||||
foreach (var record in evidenceRecords)
|
||||
{
|
||||
await _store.StoreAsync(record);
|
||||
}
|
||||
|
||||
// Act - Query all evidence types
|
||||
var allEvidence = await _store.GetBySubjectAsync(artifactDigest);
|
||||
|
||||
// Assert - Complete evidence graph
|
||||
allEvidence.Should().HaveCount(8);
|
||||
allEvidence.Select(e => e.EvidenceType).Distinct().Should().HaveCount(8);
|
||||
|
||||
// Log evidence graph
|
||||
foreach (var evidence in allEvidence)
|
||||
{
|
||||
_output.WriteLine($" {evidence.EvidenceType}: {evidence.EvidenceId}");
|
||||
}
|
||||
}
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task EvidenceGraph_ExistsCheck_ForAllTypes()
|
||||
{
|
||||
// Arrange
|
||||
var subjectNodeId = $"sha256:{Guid.NewGuid():N}";
|
||||
|
||||
await _store.StoreAsync(CreateScannerEvidence(subjectNodeId));
|
||||
await _store.StoreAsync(CreateReachabilityEvidence(subjectNodeId));
|
||||
// Note: No Policy evidence
|
||||
|
||||
// Act & Assert
|
||||
(await _store.ExistsAsync(subjectNodeId, EvidenceType.Scan)).Should().BeTrue();
|
||||
(await _store.ExistsAsync(subjectNodeId, EvidenceType.Reachability)).Should().BeTrue();
|
||||
(await _store.ExistsAsync(subjectNodeId, EvidenceType.Policy)).Should().BeFalse();
|
||||
(await _store.ExistsAsync(subjectNodeId, EvidenceType.Vex)).Should().BeFalse();
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Cross-Module Evidence Correlation
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task Correlation_SameCorrelationId_FindsRelatedEvidence()
|
||||
{
|
||||
// Arrange - Evidence from different modules with same correlation ID
|
||||
var subjectNodeId = $"sha256:{Guid.NewGuid():N}";
|
||||
var correlationId = Guid.NewGuid().ToString();
|
||||
|
||||
var scanEvidence = CreateScannerEvidence(subjectNodeId, correlationId: correlationId);
|
||||
var reachEvidence = CreateReachabilityEvidence(subjectNodeId, correlationId: correlationId);
|
||||
var policyEvidence = CreatePolicyEvidence(subjectNodeId, correlationId: correlationId);
|
||||
|
||||
await _store.StoreAsync(scanEvidence);
|
||||
await _store.StoreAsync(reachEvidence);
|
||||
await _store.StoreAsync(policyEvidence);
|
||||
|
||||
// Act - Get all evidence for subject
|
||||
var allEvidence = await _store.GetBySubjectAsync(subjectNodeId);
|
||||
|
||||
// Assert - All have same correlation ID
|
||||
allEvidence.Should().HaveCount(3);
|
||||
allEvidence.Should().OnlyContain(e => e.Provenance.CorrelationId == correlationId);
|
||||
}
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task Generators_MultiplePerSubject_AllPreserved()
|
||||
{
|
||||
// Arrange - Evidence from different generators
|
||||
var subjectNodeId = $"sha256:{Guid.NewGuid():N}";
|
||||
|
||||
var trivyEvidence = CreateScannerEvidence(subjectNodeId, generator: "stellaops/scanner/trivy");
|
||||
var grypeEvidence = CreateScannerEvidence(subjectNodeId, generator: "stellaops/scanner/grype");
|
||||
var snykEvidence = CreateScannerEvidence(subjectNodeId, generator: "vendor/snyk");
|
||||
|
||||
await _store.StoreAsync(trivyEvidence);
|
||||
await _store.StoreAsync(grypeEvidence);
|
||||
await _store.StoreAsync(snykEvidence);
|
||||
|
||||
// Act
|
||||
var scanEvidence = await _store.GetBySubjectAsync(subjectNodeId, EvidenceType.Scan);
|
||||
|
||||
// Assert
|
||||
scanEvidence.Should().HaveCount(3);
|
||||
scanEvidence.Select(e => e.Provenance.GeneratorId).Should()
|
||||
.Contain(new[] { "stellaops/scanner/trivy", "stellaops/scanner/grype", "vendor/snyk" });
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Evidence Count and Statistics
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task CountBySubject_AfterMultiModuleInserts_ReturnsCorrectCount()
|
||||
{
|
||||
// Arrange
|
||||
var subjectNodeId = $"sha256:{Guid.NewGuid():N}";
|
||||
|
||||
await _store.StoreAsync(CreateScannerEvidence(subjectNodeId));
|
||||
await _store.StoreAsync(CreateReachabilityEvidence(subjectNodeId));
|
||||
await _store.StoreAsync(CreatePolicyEvidence(subjectNodeId));
|
||||
|
||||
// Act
|
||||
var count = await _store.CountBySubjectAsync(subjectNodeId);
|
||||
|
||||
// Assert
|
||||
count.Should().Be(3);
|
||||
}
|
||||
|
||||
[Trait("Category", TestCategories.Unit)]
|
||||
[Fact]
|
||||
public async Task GetByType_AcrossSubjects_ReturnsAll()
|
||||
{
|
||||
// Arrange - Multiple subjects with same evidence type
|
||||
var subject1 = $"sha256:{Guid.NewGuid():N}";
|
||||
var subject2 = $"sha256:{Guid.NewGuid():N}";
|
||||
var subject3 = $"sha256:{Guid.NewGuid():N}";
|
||||
|
||||
await _store.StoreAsync(CreateScannerEvidence(subject1));
|
||||
await _store.StoreAsync(CreateScannerEvidence(subject2));
|
||||
await _store.StoreAsync(CreateScannerEvidence(subject3));
|
||||
await _store.StoreAsync(CreateReachabilityEvidence(subject1)); // Different type
|
||||
|
||||
// Act
|
||||
var scanEvidence = await _store.GetByTypeAsync(EvidenceType.Scan);
|
||||
|
||||
// Assert
|
||||
scanEvidence.Should().HaveCount(3);
|
||||
scanEvidence.Select(e => e.SubjectNodeId).Should()
|
||||
.Contain(new[] { subject1, subject2, subject3 });
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Helpers
|
||||
|
||||
private static EvidenceRecord CreateScannerEvidence(
|
||||
string subjectNodeId,
|
||||
string? correlationId = null,
|
||||
string generator = "stellaops/scanner/trivy")
|
||||
{
|
||||
var payload = JsonSerializer.SerializeToUtf8Bytes(new
|
||||
{
|
||||
cve = $"CVE-2024-{Random.Shared.Next(1000, 9999)}",
|
||||
severity = "HIGH",
|
||||
affectedPackage = "example-lib@1.0.0"
|
||||
});
|
||||
|
||||
var provenance = new EvidenceProvenance
|
||||
{
|
||||
GeneratorId = generator,
|
||||
GeneratorVersion = "1.0.0",
|
||||
GeneratedAt = DateTimeOffset.UtcNow,
|
||||
CorrelationId = correlationId ?? Guid.NewGuid().ToString()
|
||||
};
|
||||
|
||||
return EvidenceRecord.Create(subjectNodeId, EvidenceType.Scan, payload, provenance, "1.0.0");
|
||||
}
|
||||
|
||||
private static EvidenceRecord CreateReachabilityEvidence(
|
||||
string subjectNodeId,
|
||||
string? correlationId = null)
|
||||
{
|
||||
var payload = JsonSerializer.SerializeToUtf8Bytes(new
|
||||
{
|
||||
reachable = true,
|
||||
confidence = 0.95,
|
||||
paths = new[] { "main.go:42", "handler.go:128" }
|
||||
});
|
||||
|
||||
var provenance = new EvidenceProvenance
|
||||
{
|
||||
GeneratorId = "stellaops/scanner/reachability",
|
||||
GeneratorVersion = "1.0.0",
|
||||
GeneratedAt = DateTimeOffset.UtcNow,
|
||||
CorrelationId = correlationId ?? Guid.NewGuid().ToString()
|
||||
};
|
||||
|
||||
return EvidenceRecord.Create(subjectNodeId, EvidenceType.Reachability, payload, provenance, "1.0.0");
|
||||
}
|
||||
|
||||
private static EvidenceRecord CreatePolicyEvidence(
|
||||
string subjectNodeId,
|
||||
string? referencedEvidenceId = null,
|
||||
string[]? referencedEvidenceIds = null,
|
||||
string? correlationId = null)
|
||||
{
|
||||
var refs = referencedEvidenceIds ?? (referencedEvidenceId is not null ? new[] { referencedEvidenceId } : null);
|
||||
|
||||
var payload = JsonSerializer.SerializeToUtf8Bytes(new
|
||||
{
|
||||
ruleId = "vuln-severity-block",
|
||||
verdict = "BLOCK",
|
||||
referencedEvidence = refs
|
||||
});
|
||||
|
||||
var provenance = new EvidenceProvenance
|
||||
{
|
||||
GeneratorId = "stellaops/policy/opa",
|
||||
GeneratorVersion = "1.0.0",
|
||||
GeneratedAt = DateTimeOffset.UtcNow,
|
||||
CorrelationId = correlationId ?? Guid.NewGuid().ToString()
|
||||
};
|
||||
|
||||
return EvidenceRecord.Create(subjectNodeId, EvidenceType.Policy, payload, provenance, "1.0.0");
|
||||
}
|
||||
|
||||
private static EvidenceRecord CreateVexEvidence(
|
||||
string subjectNodeId,
|
||||
string? referencedEvidenceId = null)
|
||||
{
|
||||
var payload = JsonSerializer.SerializeToUtf8Bytes(new
|
||||
{
|
||||
status = "not_affected",
|
||||
justification = "vulnerable_code_not_in_execute_path",
|
||||
referencedEvidence = referencedEvidenceId
|
||||
});
|
||||
|
||||
var provenance = new EvidenceProvenance
|
||||
{
|
||||
GeneratorId = "stellaops/excititor/vex",
|
||||
GeneratorVersion = "1.0.0",
|
||||
GeneratedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
return EvidenceRecord.Create(subjectNodeId, EvidenceType.Vex, payload, provenance, "1.0.0");
|
||||
}
|
||||
|
||||
private static EvidenceRecord CreateEpssEvidence(string subjectNodeId)
|
||||
{
|
||||
var payload = JsonSerializer.SerializeToUtf8Bytes(new
|
||||
{
|
||||
score = 0.0342,
|
||||
percentile = 0.89,
|
||||
modelDate = "2024-12-25"
|
||||
});
|
||||
|
||||
var provenance = new EvidenceProvenance
|
||||
{
|
||||
GeneratorId = "stellaops/scanner/epss",
|
||||
GeneratorVersion = "1.0.0",
|
||||
GeneratedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
return EvidenceRecord.Create(subjectNodeId, EvidenceType.Epss, payload, provenance, "1.0.0");
|
||||
}
|
||||
|
||||
private static EvidenceRecord CreateProvenanceEvidence(string subjectNodeId)
|
||||
{
|
||||
var payload = JsonSerializer.SerializeToUtf8Bytes(new
|
||||
{
|
||||
buildId = Guid.NewGuid().ToString(),
|
||||
builder = "github-actions",
|
||||
inputs = new[] { "go.mod", "main.go" }
|
||||
});
|
||||
|
||||
var provenance = new EvidenceProvenance
|
||||
{
|
||||
GeneratorId = "stellaops/attestor/provenance",
|
||||
GeneratorVersion = "1.0.0",
|
||||
GeneratedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
return EvidenceRecord.Create(subjectNodeId, EvidenceType.Provenance, payload, provenance, "1.0.0");
|
||||
}
|
||||
|
||||
private static EvidenceRecord CreateArtifactEvidence(string subjectNodeId)
|
||||
{
|
||||
var payload = JsonSerializer.SerializeToUtf8Bytes(new
|
||||
{
|
||||
purl = "pkg:golang/example.com/mylib@1.0.0",
|
||||
digest = subjectNodeId,
|
||||
sbomFormat = "SPDX-3.0.1"
|
||||
});
|
||||
|
||||
var provenance = new EvidenceProvenance
|
||||
{
|
||||
GeneratorId = "stellaops/scanner/sbom",
|
||||
GeneratorVersion = "1.0.0",
|
||||
GeneratedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
return EvidenceRecord.Create(subjectNodeId, EvidenceType.Artifact, payload, provenance, "1.0.0");
|
||||
}
|
||||
|
||||
private static EvidenceRecord CreateExceptionEvidence(string subjectNodeId)
|
||||
{
|
||||
var payload = JsonSerializer.SerializeToUtf8Bytes(new
|
||||
{
|
||||
exceptionId = Guid.NewGuid().ToString(),
|
||||
reason = "Risk accepted per security review",
|
||||
expiry = DateTimeOffset.UtcNow.AddDays(90)
|
||||
});
|
||||
|
||||
var provenance = new EvidenceProvenance
|
||||
{
|
||||
GeneratorId = "stellaops/policy/exceptions",
|
||||
GeneratorVersion = "1.0.0",
|
||||
GeneratedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
|
||||
return EvidenceRecord.Create(subjectNodeId, EvidenceType.Exception, payload, provenance, "1.0.0");
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
Reference in New Issue
Block a user