Add scripts for resolving and verifying Chromium binary paths

- Implemented `chrome-path.js` to define functions for locating Chromium binaries across different platforms and nested directories. - Added `verify-chromium.js` to check for the presence of the Chromium binary and log the results, including candidate paths checked. - The scripts support Linux, Windows, and macOS environments, enhancing the flexibility of Chromium binary detection.
2025-10-22 09:14:36 +03:00
parent 104d5813c2
commit c377229931
131 changed files with 23191 additions and 3461 deletions
--- a/src/StellaOps.Scanner.Analyzers.Lang/Plugin/ILanguageAnalyzerPlugin.cs
+++ b/src/StellaOps.Scanner.Analyzers.Lang/Plugin/ILanguageAnalyzerPlugin.cs
@@ -0,0 +1,15 @@
+using System;
+using StellaOps.Plugin;
+
+namespace StellaOps.Scanner.Analyzers.Lang.Plugin;
+
+/// <summary>
+/// Represents a restart-time plug-in that exposes a language analyzer.
+/// </summary>
+public interface ILanguageAnalyzerPlugin : IAvailabilityPlugin
+{
+    /// <summary>
+    /// Creates the analyzer instance bound to the service provider.
+    /// </summary>
+    ILanguageAnalyzer CreateAnalyzer(IServiceProvider services);
+}
--- a/src/StellaOps.Scanner.Analyzers.Lang/Plugin/LanguageAnalyzerPluginCatalog.cs
+++ b/src/StellaOps.Scanner.Analyzers.Lang/Plugin/LanguageAnalyzerPluginCatalog.cs
@@ -0,0 +1,147 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Linq;
+using System.Reflection;
+using Microsoft.Extensions.Logging;
+using StellaOps.Plugin;
+using StellaOps.Plugin.Hosting;
+using StellaOps.Scanner.Core.Security;
+
+namespace StellaOps.Scanner.Analyzers.Lang.Plugin;
+
+public interface ILanguageAnalyzerPluginCatalog
+{
+    IReadOnlyCollection<ILanguageAnalyzerPlugin> Plugins { get; }
+
+    void LoadFromDirectory(string directory, bool seal = true);
+
+    IReadOnlyList<ILanguageAnalyzer> CreateAnalyzers(IServiceProvider services);
+}
+
+public sealed class LanguageAnalyzerPluginCatalog : ILanguageAnalyzerPluginCatalog
+{
+    private readonly ILogger<LanguageAnalyzerPluginCatalog> _logger;
+    private readonly IPluginCatalogGuard _guard;
+    private readonly ConcurrentDictionary<string, Assembly> _assemblies = new(StringComparer.OrdinalIgnoreCase);
+    private IReadOnlyList<ILanguageAnalyzerPlugin> _plugins = Array.Empty<ILanguageAnalyzerPlugin>();
+
+    public LanguageAnalyzerPluginCatalog(IPluginCatalogGuard guard, ILogger<LanguageAnalyzerPluginCatalog> logger)
+    {
+        _guard = guard ?? throw new ArgumentNullException(nameof(guard));
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    }
+
+    public IReadOnlyCollection<ILanguageAnalyzerPlugin> Plugins => _plugins;
+
+    public void LoadFromDirectory(string directory, bool seal = true)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(directory);
+        var fullDirectory = Path.GetFullPath(directory);
+
+        var options = new PluginHostOptions
+        {
+            PluginsDirectory = fullDirectory,
+            EnsureDirectoryExists = false,
+            RecursiveSearch = false,
+        };
+        options.SearchPatterns.Add("StellaOps.Scanner.Analyzers.*.dll");
+
+        var result = PluginHost.LoadPlugins(options, _logger);
+        if (result.Plugins.Count == 0)
+        {
+            _logger.LogWarning("No language analyzer plug-ins discovered under '{Directory}'.", fullDirectory);
+        }
+
+        foreach (var descriptor in result.Plugins)
+        {
+            try
+            {
+                _guard.EnsureRegistrationAllowed(descriptor.AssemblyPath);
+                _assemblies[descriptor.AssemblyPath] = descriptor.Assembly;
+                _logger.LogInformation(
+                    "Registered language analyzer plug-in assembly '{Assembly}' from '{Path}'.",
+                    descriptor.Assembly.FullName,
+                    descriptor.AssemblyPath);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Failed to register language analyzer plug-in '{Path}'.", descriptor.AssemblyPath);
+            }
+        }
+
+        RefreshPluginList();
+
+        if (seal)
+        {
+            _guard.Seal();
+        }
+    }
+
+    public IReadOnlyList<ILanguageAnalyzer> CreateAnalyzers(IServiceProvider services)
+    {
+        ArgumentNullException.ThrowIfNull(services);
+
+        if (_plugins.Count == 0)
+        {
+            _logger.LogWarning("No language analyzer plug-ins available; skipping language analysis.");
+            return Array.Empty<ILanguageAnalyzer>();
+        }
+
+        var analyzers = new List<ILanguageAnalyzer>(_plugins.Count);
+
+        foreach (var plugin in _plugins)
+        {
+            if (!IsPluginAvailable(plugin, services))
+            {
+                continue;
+            }
+
+            try
+            {
+                var analyzer = plugin.CreateAnalyzer(services);
+                if (analyzer is null)
+                {
+                    continue;
+                }
+
+                analyzers.Add(analyzer);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Language analyzer plug-in '{Plugin}' failed to create analyzer instance.", plugin.Name);
+            }
+        }
+
+        if (analyzers.Count == 0)
+        {
+            _logger.LogWarning("All language analyzer plug-ins were unavailable.");
+            return Array.Empty<ILanguageAnalyzer>();
+        }
+
+        analyzers.Sort(static (a, b) => string.CompareOrdinal(a.Id, b.Id));
+        return new ReadOnlyCollection<ILanguageAnalyzer>(analyzers);
+    }
+
+    private void RefreshPluginList()
+    {
+        var assemblies = _assemblies.Values.ToArray();
+        var plugins = PluginLoader.LoadPlugins<ILanguageAnalyzerPlugin>(assemblies);
+        _plugins = plugins is IReadOnlyList<ILanguageAnalyzerPlugin> list
+            ? list
+            : new ReadOnlyCollection<ILanguageAnalyzerPlugin>(plugins.ToArray());
+    }
+
+    private static bool IsPluginAvailable(ILanguageAnalyzerPlugin plugin, IServiceProvider services)
+    {
+        try
+        {
+            return plugin.IsAvailable(services);
+        }
+        catch
+        {
+            return false;
+        }
+    }
+}
--- a/src/StellaOps.Scanner.Analyzers.Lang/SPRINTS_LANG_IMPLEMENTATION_PLAN.md
+++ b/src/StellaOps.Scanner.Analyzers.Lang/SPRINTS_LANG_IMPLEMENTATION_PLAN.md
@@ -20,7 +20,7 @@ All sprints below assume prerequisites from SP10-G2 (core scaffolding + Java ana
  - `Fixtures/lang/node/**` golden outputs.
  - Analyzer benchmark CSV + flamegraph (commit under `bench/Scanner.Analyzers`).
  - Worker integration sample enabling Node analyzer via manifest.
- **Progress (2025-10-19):** Module walker with package-lock/yarn/pnpm resolution, workspace attribution, integrity metadata, and deterministic fixture harness committed; Node tasks 10-302A/B marked DONE. Shared component mapper + canonical result harness landed, closing tasks 10-307/308. Script metadata & telemetry (10-302C) emit policy hints, hashed evidence, and feed `scanner_analyzer_node_scripts_total` into Worker OpenTelemetry pipeline.
+- **Progress (2025-10-21):** Module walker with package-lock/yarn/pnpm resolution, workspace attribution, integrity metadata, and deterministic fixture harness committed; Node tasks 10-302A/B remain green. Shared component mapper + canonical result harness landed, closing tasks 10-307/308. Script metadata & telemetry (10-302C) emit policy hints, hashed evidence, and feed `scanner_analyzer_node_scripts_total` into Worker OpenTelemetry pipeline. Restart-time packaging closed (10-309): manifest added, Worker language catalog loads the Node analyzer, integration tests cover dispatch + layer fragments, and Offline Kit docs call out bundled language plug-ins.

 ## Sprint LA2 — Python Analyzer & Entry Point Attribution (Tasks 10-303, 10-307, 10-308, 10-309 subset)
 - **Scope:** Parse `*.dist-info`, `RECORD` hashes, entry points, and pip-installed editable packages; integrate usage hints from EntryTrace.
@@ -32,24 +32,26 @@ All sprints below assume prerequisites from SP10-G2 (core scaffolding + Java ana
  - Hash verification throughput ≥75 MB/s sustained with streaming reader.
  - False-positive rate for editable installs <1 % on curated fixtures.
  - Determinism check across CPython 3.8–3.12 generated metadata.
- **Gate Artifacts:**
-  - Golden fixtures for `site-packages`, virtualenv, and layered pip caches.
-  - Usage hint propagation tests (EntryTrace → analyzer → SBOM).
-  - Metrics counters (`scanner_analyzer_python_components_total`) documented.
+- **Gate Artifacts:**
+  - Golden fixtures for `site-packages`, virtualenv, and layered pip caches.
+  - Usage hint propagation tests (EntryTrace → analyzer → SBOM).
+  - Metrics counters (`scanner_analyzer_python_components_total`) documented.
+- **Progress (2025-10-21):** Python analyzer landed; Tasks 10-303A/B/C are DONE with dist-info parsing, RECORD verification, editable install detection, and deterministic `simple-venv` fixture + benchmark hooks recorded.

-## Sprint LA3 — Go Analyzer & Build Info Synthesis (Tasks 10-304, 10-307, 10-308, 10-309 subset)
- **Scope:** Extract Go build metadata from `.note.go.buildid`, embedded module info, and fallback to `bin:{sha256}`; surface VCS provenance.
- **Deliverables:**
-  - `StellaOps.Scanner.Analyzers.Lang.Go` plug-in.
-  - DWARF-lite parser to enrich component origin (commit hash + dirty flag) when available.
-  - Shared hash cache to dedupe repeated binaries across layers.
- **Acceptance Metrics:**
-  - Analyzer latency ≤400 µs per binary (hot cache) / ≤2 ms (cold).
-  - Provenance coverage ≥95 % on representative Go fixture suite.
-  - Zero allocations in happy path beyond pooled buffers (validated via BenchmarkDotNet).
- **Gate Artifacts:**
-  - Benchmarks vs competitor open-source tool (Trivy or Syft) demonstrating faster metadata extraction.
-  - Documentation snippet explaining VCS metadata fields for Policy team.
+## Sprint LA3 — Go Analyzer & Build Info Synthesis (Tasks 10-304, 10-307, 10-308, 10-309 subset)
+- **Scope:** Extract Go build metadata from `.note.go.buildid`, embedded module info, and fallback to `bin:{sha256}`; surface VCS provenance.
+- **Deliverables:**
+  - `StellaOps.Scanner.Analyzers.Lang.Go` plug-in.
+  - DWARF-lite parser to enrich component origin (commit hash + dirty flag) when available.
+  - Shared hash cache to dedupe repeated binaries across layers.
+- **Acceptance Metrics:**
+  - Analyzer latency ≤400 µs per binary (hot cache) / ≤2 ms (cold).
+  - Provenance coverage ≥95 % on representative Go fixture suite.
+  - Zero allocations in happy path beyond pooled buffers (validated via BenchmarkDotNet).
+- **Gate Artifacts:**
+  - Benchmarks vs competitor open-source tool (Trivy or Syft) demonstrating faster metadata extraction.
+  - Documentation snippet explaining VCS metadata fields for Policy team.
+- **Progress (2025-10-22):** Build-info decoder shipped with DWARF-string fallback for `vcs.*` markers, plus cached metadata keyed by binary length/timestamp. Added Go test fixtures covering build-info and DWARF-only binaries with deterministic goldens; analyzer now emits `go.dwarf` evidence alongside `go.buildinfo` metadata to feed downstream provenance rules.

 ## Sprint LA4 — .NET Analyzer & RID Variants (Tasks 10-305, 10-307, 10-308, 10-309 subset)
 - **Scope:** Parse `*.deps.json`, `runtimeconfig.json`, assembly metadata, and RID-specific assets; correlate with native dependencies.
@@ -61,10 +63,11 @@ All sprints below assume prerequisites from SP10-G2 (core scaffolding + Java ana
  - Multi-target app fixture processed <1.2 s; memory <250 MB.
  - RID variant collapse reduces component explosion by ≥40 % vs naive listing.
  - All security metadata (signing Publisher, timestamp) surfaced deterministically.
- **Gate Artifacts:**
-  - Signed .NET sample apps (framework-dependent & self-contained) under `samples/scanner/lang/dotnet/`.
-  - Tests verifying dual runtimeconfig merge logic.
-  - Guidance for Policy on license propagation from NuGet metadata.
+- **Gate Artifacts:**
+  - Signed .NET sample apps (framework-dependent & self-contained) under `samples/scanner/lang/dotnet/`.
+  - Tests verifying dual runtimeconfig merge logic.
+  - Guidance for Policy on license propagation from NuGet metadata.
+- **Progress (2025-10-22):** Completed task 10-305A with a deterministic deps/runtimeconfig ingest pipeline producing `pkg:nuget` components across RID targets. Added dotnet fixture + golden output to the shared harness, wired analyzer plugin availability, and surfaced RID metadata in component records for downstream emit/diff work.

 ## Sprint LA5 — Rust Analyzer & Binary Fingerprinting (Tasks 10-306, 10-307, 10-308, 10-309 subset)
 - **Scope:** Detect crates via metadata in `.fingerprint`, Cargo.lock fragments, or embedded `rustc` markers; robust fallback to binary hash classification.
--- a/src/StellaOps.Scanner.Analyzers.Lang/StellaOps.Scanner.Analyzers.Lang.csproj
+++ b/src/StellaOps.Scanner.Analyzers.Lang/StellaOps.Scanner.Analyzers.Lang.csproj
@@ -12,10 +12,11 @@
    <Compile Include="**\\*.cs" Exclude="obj\\**;bin\\**" />
    <EmbeddedResource Include="**\\*.json" Exclude="obj\\**;bin\\**" />
    <None Include="**\\*" Exclude="**\\*.cs;**\\*.json;bin\\**;obj\\**" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\\StellaOps.Scanner.Core\\StellaOps.Scanner.Core.csproj" />
-  </ItemGroup>
-
-</Project>
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\\StellaOps.Scanner.Core\\StellaOps.Scanner.Core.csproj" />
+    <ProjectReference Include="..\\StellaOps.Plugin\\StellaOps.Plugin.csproj" />
+  </ItemGroup>
+
+</Project>
--- a/src/StellaOps.Scanner.Analyzers.Lang/TASKS.md
+++ b/src/StellaOps.Scanner.Analyzers.Lang/TASKS.md
@@ -3,11 +3,11 @@
 | ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
 |----|--------|----------|------------|-------------|---------------|
 | SCANNER-ANALYZERS-LANG-10-301 | DONE (2025-10-19) | Language Analyzer Guild | SCANNER-CORE-09-501, SCANNER-WORKER-09-203 | Java analyzer emitting deterministic `pkg:maven` components using pom.properties / MANIFEST evidence. | Java analyzer extracts coordinates+version+licenses with provenance; golden fixtures deterministic; microbenchmark meets target. |
-| SCANNER-ANALYZERS-LANG-10-302 | DOING (2025-10-19) | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-307 | Node analyzer resolving workspaces/symlinks into `pkg:npm` identities. | Node analyzer handles symlinks/workspaces; outputs sorted components; determinism harness covers hoisted deps. |
-| SCANNER-ANALYZERS-LANG-10-303 | TODO | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-307 | Python analyzer consuming `*.dist-info` metadata and RECORD hashes. | Analyzer binds METADATA + RECORD evidence, includes entry points, determinism fixtures stable. |
-| SCANNER-ANALYZERS-LANG-10-304 | TODO | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-307 | Go analyzer leveraging buildinfo for `pkg:golang` components. | Buildinfo parser emits module path/version + vcs metadata; binaries without buildinfo downgraded gracefully. |
-| SCANNER-ANALYZERS-LANG-10-305 | TODO | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-307 | .NET analyzer parsing `*.deps.json`, assembly metadata, and RID variants. | Analyzer merges deps.json + assembly info; dedupes per RID; determinism verified. |
+| SCANNER-ANALYZERS-LANG-10-302 | DONE (2025-10-21) | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-307 | Node analyzer resolving workspaces/symlinks into `pkg:npm` identities. | Node analyzer handles symlinks/workspaces; outputs sorted components; determinism harness covers hoisted deps. |
+| SCANNER-ANALYZERS-LANG-10-303 | DONE (2025-10-21) | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-307 | Python analyzer consuming `*.dist-info` metadata and RECORD hashes. | Analyzer binds METADATA + RECORD evidence, includes entry points, determinism fixtures stable. |
+| SCANNER-ANALYZERS-LANG-10-304 | DOING (2025-10-22) | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-307 | Go analyzer leveraging buildinfo for `pkg:golang` components. | Buildinfo parser emits module path/version + vcs metadata; binaries without buildinfo downgraded gracefully. |
+| SCANNER-ANALYZERS-LANG-10-305 | DOING (2025-10-22) | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-307 | .NET analyzer parsing `*.deps.json`, assembly metadata, and RID variants. | Analyzer merges deps.json + assembly info; dedupes per RID; determinism verified. |
 | SCANNER-ANALYZERS-LANG-10-306 | TODO | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-307 | Rust analyzer detecting crate provenance or falling back to `bin:{sha256}`. | Analyzer emits `pkg:cargo` when metadata present; falls back to binary hash; fixtures cover both paths. |
 | SCANNER-ANALYZERS-LANG-10-307 | DONE (2025-10-19) | Language Analyzer Guild | SCANNER-CORE-09-501 | Shared language evidence helpers + usage flag propagation. | Shared abstractions implemented; analyzers reuse helpers; evidence includes usage hints; unit tests cover canonical ordering. |
 | SCANNER-ANALYZERS-LANG-10-308 | DONE (2025-10-19) | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-307 | Determinism + fixture harness for language analyzers. | Harness executes analyzers against fixtures; golden JSON stored; CI helper ensures stable hashes. |
-| SCANNER-ANALYZERS-LANG-10-309 | DOING (2025-10-19) | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-301..308 | Package language analyzers as restart-time plug-ins (manifest + host registration). | Plugin manifests authored under `plugins/scanner/analyzers/lang`; Worker loads via DI; restart required flag enforced; tests confirm manifest integrity. |
+| SCANNER-ANALYZERS-LANG-10-309 | DONE (2025-10-21) | Language Analyzer Guild | SCANNER-ANALYZERS-LANG-10-301..308 | Package language analyzers as restart-time plug-ins (manifest + host registration). | Plugin manifests authored under `plugins/scanner/analyzers/lang`; Worker loads via DI; restart required flag enforced; tests confirm manifest integrity. |