Merge branch 'main' of https://git.stella-ops.org/stella-ops.org/git.stella-ops.org
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
This commit is contained in:
Vladimir Moushkov
0
docs/12_PERFORMANCE_WORKBOOK.md
Executable file → Normal file
0
docs/12_PERFORMANCE_WORKBOOK.md
Executable file → Normal file
@@ -1054,8 +1054,7 @@ This file describe implementation of Stella Ops (docs/README.md). Implementation
|
|||||||
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/Attestor/StellaOps.Attestor.Types/TASKS.md | TODO | Attestation Payloads Guild | ATTEST-TYPES-72-001 | Draft schemas for all attestation payload types. |
|
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/Attestor/StellaOps.Attestor.Types/TASKS.md | TODO | Attestation Payloads Guild | ATTEST-TYPES-72-001 | Draft schemas for all attestation payload types. |
|
||||||
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/Attestor/StellaOps.Attestor.Types/TASKS.md | TODO | Attestation Payloads Guild | ATTEST-TYPES-72-002 | Generate models/validators from schemas. |
|
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/Attestor/StellaOps.Attestor.Types/TASKS.md | TODO | Attestation Payloads Guild | ATTEST-TYPES-72-002 | Generate models/validators from schemas. |
|
||||||
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/Attestor/StellaOps.Attestor/TASKS.md | TODO | Attestor Service Guild | ATTESTOR-72-001 | Scaffold attestor service skeleton. |
|
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/Attestor/StellaOps.Attestor/TASKS.md | TODO | Attestor Service Guild | ATTESTOR-72-001 | Scaffold attestor service skeleton. |
|
||||||
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/Attestor/StellaOps.Attestor/TASKS.md | TODO | Attestor Service Guild | ATTESTOR-72-002 | Implement attestation store + storage integration. |
|
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/Attestor/StellaOps.Attestor/TASKS.md | TODO | Attestor Service Guild | ATTESTOR-72-002 | Implement attestation store + storage integration. |
|
||||||
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/__Libraries/StellaOps.Cryptography.Kms/TASKS.md | DONE | KMS Guild | KMS-72-001 | Implement KMS interface + file driver. |
|
|
||||||
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/__Libraries/StellaOps.Cryptography.Kms/TASKS.md | DONE | KMS Guild | KMS-72-001 | Implement KMS interface + file driver. |
|
| Sprint 72 | Attestor Console Phase 1 – Foundations | src/__Libraries/StellaOps.Cryptography.Kms/TASKS.md | DONE | KMS Guild | KMS-72-001 | Implement KMS interface + file driver. |
|
||||||
| Sprint 73 | Attestor CLI Phase 2 – Signing & Policies | src/Cli/StellaOps.Cli/TASKS.md | TODO | CLI Attestor Guild | CLI-ATTEST-73-001 | Implement `stella attest sign` (payload selection, subject digest, key reference, output format) using official SDK transport. |
|
| Sprint 73 | Attestor CLI Phase 2 – Signing & Policies | src/Cli/StellaOps.Cli/TASKS.md | TODO | CLI Attestor Guild | CLI-ATTEST-73-001 | Implement `stella attest sign` (payload selection, subject digest, key reference, output format) using official SDK transport. |
|
||||||
| Sprint 73 | Attestor CLI Phase 2 – Signing & Policies | src/Cli/StellaOps.Cli/TASKS.md | TODO | CLI Attestor Guild | CLI-ATTEST-73-002 | Implement `stella attest verify` with policy selection, explainability output, and JSON/table formatting. |
|
| Sprint 73 | Attestor CLI Phase 2 – Signing & Policies | src/Cli/StellaOps.Cli/TASKS.md | TODO | CLI Attestor Guild | CLI-ATTEST-73-002 | Implement `stella attest verify` with policy selection, explainability output, and JSON/table formatting. |
|
||||||
|
|||||||
@@ -11,7 +11,6 @@
|
|||||||
> 2025-10-28: Documented duplicate audit + migration workflow in `docs/deploy/containers.md`, Offline Kit guide, and `MIGRATIONS.md`; published `ops/devops/scripts/check-advisory-raw-duplicates.js` for staging/offline clusters.
|
> 2025-10-28: Documented duplicate audit + migration workflow in `docs/deploy/containers.md`, Offline Kit guide, and `MIGRATIONS.md`; published `ops/devops/scripts/check-advisory-raw-duplicates.js` for staging/offline clusters.
|
||||||
> Docs alignment (2025-10-26): Offline kit requirements documented in `docs/deploy/containers.md` §5.
|
> Docs alignment (2025-10-26): Offline kit requirements documented in `docs/deploy/containers.md` §5.
|
||||||
| CONCELIER-STORE-AOC-19-005 `Raw linkset backfill` | TODO (2025-11-04) | Concelier Storage Guild, DevOps Guild | CONCELIER-CORE-AOC-19-004 | Plan and execute advisory_observations `rawLinkset` backfill (online + Offline Kit bundles), supply migration scripts + rehearse rollback. Follow the coordination plan in `docs/dev/raw-linkset-backfill-plan.md`. |
|
| CONCELIER-STORE-AOC-19-005 `Raw linkset backfill` | TODO (2025-11-04) | Concelier Storage Guild, DevOps Guild | CONCELIER-CORE-AOC-19-004 | Plan and execute advisory_observations `rawLinkset` backfill (online + Offline Kit bundles), supply migration scripts + rehearse rollback. Follow the coordination plan in `docs/dev/raw-linkset-backfill-plan.md`. |
|
||||||
|
|
||||||
|
|
||||||
## Policy Engine v2
|
## Policy Engine v2
|
||||||
|
|
||||||
|
|||||||
@@ -3,5 +3,4 @@ If you are working on this file you need to read docs/modules/excititor/ARCHITEC
|
|||||||
| Task | Owner(s) | Depends on | Notes |
|
| Task | Owner(s) | Depends on | Notes |
|
||||||
|---|---|---|---|
|
|---|---|---|---|
|
||||||
|EXCITITOR-ATTEST-01-003 – Verification suite & observability|Team Excititor Attestation|EXCITITOR-ATTEST-01-002|DOING (2025-10-22) – Continuing implementation: build `IVexAttestationVerifier`, wire metrics/logging, and add regression tests. Draft plan in `EXCITITOR-ATTEST-01-003-plan.md` (2025-10-19) guides scope; updating with worknotes as progress lands.<br>2025-10-31: Verifier now tolerates duplicate source providers from AOC raw projections, downgrades offline Rekor verification to a degraded result, and enforces trusted signer registry checks with detailed diagnostics/tests.|
|
|EXCITITOR-ATTEST-01-003 – Verification suite & observability|Team Excititor Attestation|EXCITITOR-ATTEST-01-002|DOING (2025-10-22) – Continuing implementation: build `IVexAttestationVerifier`, wire metrics/logging, and add regression tests. Draft plan in `EXCITITOR-ATTEST-01-003-plan.md` (2025-10-19) guides scope; updating with worknotes as progress lands.<br>2025-10-31: Verifier now tolerates duplicate source providers from AOC raw projections, downgrades offline Rekor verification to a degraded result, and enforces trusted signer registry checks with detailed diagnostics/tests.|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@@ -183,8 +183,7 @@ internal sealed class VexAttestationVerifier : IVexAttestationVerifier
|
|||||||
catch (Exception ex)
|
catch (Exception ex)
|
||||||
{
|
{
|
||||||
diagnostics["error"] = ex.GetType().Name;
|
diagnostics["error"] = ex.GetType().Name;
|
||||||
diagnostics["error.message"] = ex.Message;
|
diagnostics["error.message"] = ex.Message; resultLabel = "error";
|
||||||
resultLabel = "error";
|
|
||||||
_logger.LogError(ex, "Unexpected exception verifying attestation for export {ExportId}", request.Attestation.ExportId);
|
_logger.LogError(ex, "Unexpected exception verifying attestation for export {ExportId}", request.Attestation.ExportId);
|
||||||
return BuildResult(false);
|
return BuildResult(false);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,101 +1,101 @@
|
|||||||
{
|
{
|
||||||
"eventId": "6d2d1b77-f3c3-4f70-8a9d-6f2d0c8801ab",
|
"eventId": "6d2d1b77-f3c3-4f70-8a9d-6f2d0c8801ab",
|
||||||
"kind": "scanner.event.report.ready",
|
"kind": "scanner.event.report.ready",
|
||||||
"version": 1,
|
"version": 1,
|
||||||
"tenant": "tenant-alpha",
|
"tenant": "tenant-alpha",
|
||||||
"occurredAt": "2025-10-19T12:34:56Z",
|
"occurredAt": "2025-10-19T12:34:56Z",
|
||||||
"recordedAt": "2025-10-19T12:34:57Z",
|
"recordedAt": "2025-10-19T12:34:57Z",
|
||||||
"source": "scanner.webservice",
|
"source": "scanner.webservice",
|
||||||
"idempotencyKey": "scanner.event.report.ready:tenant-alpha:report-abc",
|
"idempotencyKey": "scanner.event.report.ready:tenant-alpha:report-abc",
|
||||||
"correlationId": "report-abc",
|
"correlationId": "report-abc",
|
||||||
"traceId": "0af7651916cd43dd8448eb211c80319c",
|
"traceId": "0af7651916cd43dd8448eb211c80319c",
|
||||||
"spanId": "b7ad6b7169203331",
|
"spanId": "b7ad6b7169203331",
|
||||||
"scope": {
|
"scope": {
|
||||||
"namespace": "acme/edge",
|
"namespace": "acme/edge",
|
||||||
"repo": "api",
|
"repo": "api",
|
||||||
"digest": "sha256:feedface"
|
"digest": "sha256:feedface"
|
||||||
},
|
|
||||||
"attributes": {
|
|
||||||
"reportId": "report-abc",
|
|
||||||
"policyRevisionId": "rev-42",
|
|
||||||
"policyDigest": "digest-123",
|
|
||||||
"verdict": "blocked"
|
|
||||||
},
|
|
||||||
"payload": {
|
|
||||||
"reportId": "report-abc",
|
|
||||||
"scanId": "report-abc",
|
|
||||||
"imageDigest": "sha256:feedface",
|
|
||||||
"generatedAt": "2025-10-19T12:34:56Z",
|
|
||||||
"verdict": "fail",
|
|
||||||
"summary": {
|
|
||||||
"total": 1,
|
|
||||||
"blocked": 1,
|
|
||||||
"warned": 0,
|
|
||||||
"ignored": 0,
|
|
||||||
"quieted": 0
|
|
||||||
},
|
},
|
||||||
"delta": {
|
"attributes": {
|
||||||
"newCritical": 1,
|
"reportId": "report-abc",
|
||||||
"kev": [
|
"policyRevisionId": "rev-42",
|
||||||
"CVE-2024-9999"
|
"policyDigest": "digest-123",
|
||||||
]
|
"verdict": "blocked"
|
||||||
},
|
},
|
||||||
"quietedFindingCount": 0,
|
"payload": {
|
||||||
"policy": {
|
"reportId": "report-abc",
|
||||||
"digest": "digest-123",
|
"scanId": "report-abc",
|
||||||
"revisionId": "rev-42"
|
"imageDigest": "sha256:feedface",
|
||||||
},
|
"generatedAt": "2025-10-19T12:34:56Z",
|
||||||
"links": {
|
"verdict": "fail",
|
||||||
"report": {
|
"summary": {
|
||||||
"ui": "https://scanner.example/ui/reports/report-abc",
|
"total": 1,
|
||||||
"api": "https://scanner.example/api/v1/reports/report-abc"
|
"blocked": 1,
|
||||||
},
|
"warned": 0,
|
||||||
"policy": {
|
"ignored": 0,
|
||||||
"ui": "https://scanner.example/ui/policy/revisions/rev-42",
|
"quieted": 0
|
||||||
"api": "https://scanner.example/api/v1/policy/revisions/rev-42"
|
},
|
||||||
},
|
"delta": {
|
||||||
"attestation": {
|
"newCritical": 1,
|
||||||
"ui": "https://scanner.example/ui/attestations/report-abc",
|
"kev": [
|
||||||
"api": "https://scanner.example/api/v1/reports/report-abc/attestation"
|
"CVE-2024-9999"
|
||||||
}
|
]
|
||||||
},
|
},
|
||||||
"dsse": {
|
"quietedFindingCount": 0,
|
||||||
"payloadType": "application/vnd.stellaops.report+json",
|
"policy": {
|
||||||
"payload": "eyJyZXBvcnRJZCI6InJlcG9ydC1hYmMiLCJpbWFnZURpZ2VzdCI6InNoYTI1NjpmZWVkZmFjZSIsImdlbmVyYXRlZEF0IjoiMjAyNS0xMC0xOVQxMjozNDo1NiswMDowMCIsInZlcmRpY3QiOiJibG9ja2VkIiwicG9saWN5Ijp7InJldmlzaW9uSWQiOiJyZXYtNDIiLCJkaWdlc3QiOiJkaWdlc3QtMTIzIn0sInN1bW1hcnkiOnsidG90YWwiOjEsImJsb2NrZWQiOjEsIndhcm5lZCI6MCwiaWdub3JlZCI6MCwicXVpZXRlZCI6MH0sInZlcmRpY3RzIjpbeyJmaW5kaW5nSWQiOiJmaW5kaW5nLTEiLCJzdGF0dXMiOiJCbG9ja2VkIiwic2NvcmUiOjQ3LjUsInNvdXJjZVRydXN0IjoiTlZEIiwicmVhY2hhYmlsaXR5IjoicnVudGltZSJ9XSwiaXNzdWVzIjpbXX0=",
|
"digest": "digest-123",
|
||||||
"signatures": [
|
"revisionId": "rev-42"
|
||||||
{
|
},
|
||||||
"keyId": "test-key",
|
"links": {
|
||||||
"algorithm": "hs256",
|
"report": {
|
||||||
"signature": "signature-value"
|
"ui": "https://scanner.example/ui/reports/report-abc",
|
||||||
|
"api": "https://scanner.example/api/v1/reports/report-abc"
|
||||||
|
},
|
||||||
|
"policy": {
|
||||||
|
"ui": "https://scanner.example/ui/policy/revisions/rev-42",
|
||||||
|
"api": "https://scanner.example/api/v1/policy/revisions/rev-42"
|
||||||
|
},
|
||||||
|
"attestation": {
|
||||||
|
"ui": "https://scanner.example/ui/attestations/report-abc",
|
||||||
|
"api": "https://scanner.example/api/v1/reports/report-abc/attestation"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"dsse": {
|
||||||
|
"payloadType": "application/vnd.stellaops.report+json",
|
||||||
|
"payload": "eyJyZXBvcnRJZCI6InJlcG9ydC1hYmMiLCJpbWFnZURpZ2VzdCI6InNoYTI1NjpmZWVkZmFjZSIsImdlbmVyYXRlZEF0IjoiMjAyNS0xMC0xOVQxMjozNDo1NiswMDowMCIsInZlcmRpY3QiOiJibG9ja2VkIiwicG9saWN5Ijp7InJldmlzaW9uSWQiOiJyZXYtNDIiLCJkaWdlc3QiOiJkaWdlc3QtMTIzIn0sInN1bW1hcnkiOnsidG90YWwiOjEsImJsb2NrZWQiOjEsIndhcm5lZCI6MCwiaWdub3JlZCI6MCwicXVpZXRlZCI6MH0sInZlcmRpY3RzIjpbeyJmaW5kaW5nSWQiOiJmaW5kaW5nLTEiLCJzdGF0dXMiOiJCbG9ja2VkIiwic2NvcmUiOjQ3LjUsInNvdXJjZVRydXN0IjoiTlZEIiwicmVhY2hhYmlsaXR5IjoicnVudGltZSJ9XSwiaXNzdWVzIjpbXX0=",
|
||||||
|
"signatures": [
|
||||||
|
{
|
||||||
|
"keyId": "test-key",
|
||||||
|
"algorithm": "hs256",
|
||||||
|
"signature": "signature-value"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"report": {
|
||||||
|
"reportId": "report-abc",
|
||||||
|
"generatedAt": "2025-10-19T12:34:56Z",
|
||||||
|
"imageDigest": "sha256:feedface",
|
||||||
|
"policy": {
|
||||||
|
"digest": "digest-123",
|
||||||
|
"revisionId": "rev-42"
|
||||||
|
},
|
||||||
|
"summary": {
|
||||||
|
"total": 1,
|
||||||
|
"blocked": 1,
|
||||||
|
"warned": 0,
|
||||||
|
"ignored": 0,
|
||||||
|
"quieted": 0
|
||||||
|
},
|
||||||
|
"verdict": "blocked",
|
||||||
|
"verdicts": [
|
||||||
|
{
|
||||||
|
"findingId": "finding-1",
|
||||||
|
"status": "Blocked",
|
||||||
|
"score": 47.5,
|
||||||
|
"sourceTrust": "NVD",
|
||||||
|
"reachability": "runtime"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"issues": []
|
||||||
}
|
}
|
||||||
]
|
|
||||||
},
|
|
||||||
"report": {
|
|
||||||
"reportId": "report-abc",
|
|
||||||
"generatedAt": "2025-10-19T12:34:56Z",
|
|
||||||
"imageDigest": "sha256:feedface",
|
|
||||||
"policy": {
|
|
||||||
"digest": "digest-123",
|
|
||||||
"revisionId": "rev-42"
|
|
||||||
},
|
|
||||||
"summary": {
|
|
||||||
"total": 1,
|
|
||||||
"blocked": 1,
|
|
||||||
"warned": 0,
|
|
||||||
"ignored": 0,
|
|
||||||
"quieted": 0
|
|
||||||
},
|
|
||||||
"verdict": "blocked",
|
|
||||||
"verdicts": [
|
|
||||||
{
|
|
||||||
"findingId": "finding-1",
|
|
||||||
"status": "Blocked",
|
|
||||||
"score": 47.5,
|
|
||||||
"sourceTrust": "NVD",
|
|
||||||
"reachability": "runtime"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"issues": []
|
|
||||||
}
|
}
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,107 +1,107 @@
|
|||||||
{
|
{
|
||||||
"eventId": "08a6de24-4a94-4d14-8432-9d14f36f6da3",
|
"eventId": "08a6de24-4a94-4d14-8432-9d14f36f6da3",
|
||||||
"kind": "scanner.event.scan.completed",
|
"kind": "scanner.event.scan.completed",
|
||||||
"version": 1,
|
"version": 1,
|
||||||
"tenant": "tenant-alpha",
|
"tenant": "tenant-alpha",
|
||||||
"occurredAt": "2025-10-19T12:34:56Z",
|
"occurredAt": "2025-10-19T12:34:56Z",
|
||||||
"recordedAt": "2025-10-19T12:34:57Z",
|
"recordedAt": "2025-10-19T12:34:57Z",
|
||||||
"source": "scanner.webservice",
|
"source": "scanner.webservice",
|
||||||
"idempotencyKey": "scanner.event.scan.completed:tenant-alpha:report-abc",
|
"idempotencyKey": "scanner.event.scan.completed:tenant-alpha:report-abc",
|
||||||
"correlationId": "report-abc",
|
"correlationId": "report-abc",
|
||||||
"traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
|
"traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
|
||||||
"scope": {
|
"scope": {
|
||||||
"namespace": "acme/edge",
|
"namespace": "acme/edge",
|
||||||
"repo": "api",
|
"repo": "api",
|
||||||
"digest": "sha256:feedface"
|
"digest": "sha256:feedface"
|
||||||
},
|
|
||||||
"attributes": {
|
|
||||||
"reportId": "report-abc",
|
|
||||||
"policyRevisionId": "rev-42",
|
|
||||||
"policyDigest": "digest-123",
|
|
||||||
"verdict": "blocked"
|
|
||||||
},
|
|
||||||
"payload": {
|
|
||||||
"reportId": "report-abc",
|
|
||||||
"scanId": "report-abc",
|
|
||||||
"imageDigest": "sha256:feedface",
|
|
||||||
"verdict": "fail",
|
|
||||||
"summary": {
|
|
||||||
"total": 1,
|
|
||||||
"blocked": 1,
|
|
||||||
"warned": 0,
|
|
||||||
"ignored": 0,
|
|
||||||
"quieted": 0
|
|
||||||
},
|
},
|
||||||
"delta": {
|
"attributes": {
|
||||||
"newCritical": 1,
|
"reportId": "report-abc",
|
||||||
"kev": [
|
"policyRevisionId": "rev-42",
|
||||||
"CVE-2024-9999"
|
"policyDigest": "digest-123",
|
||||||
]
|
"verdict": "blocked"
|
||||||
},
|
},
|
||||||
"policy": {
|
"payload": {
|
||||||
"digest": "digest-123",
|
"reportId": "report-abc",
|
||||||
"revisionId": "rev-42"
|
"scanId": "report-abc",
|
||||||
},
|
"imageDigest": "sha256:feedface",
|
||||||
"findings": [
|
"verdict": "fail",
|
||||||
{
|
"summary": {
|
||||||
"id": "finding-1",
|
"total": 1,
|
||||||
"severity": "Critical",
|
"blocked": 1,
|
||||||
"cve": "CVE-2024-9999",
|
"warned": 0,
|
||||||
"purl": "pkg:docker/acme/edge-api@sha256-feedface",
|
"ignored": 0,
|
||||||
"reachability": "runtime"
|
"quieted": 0
|
||||||
}
|
},
|
||||||
],
|
"delta": {
|
||||||
"links": {
|
"newCritical": 1,
|
||||||
"report": {
|
"kev": [
|
||||||
"ui": "https://scanner.example/ui/reports/report-abc",
|
"CVE-2024-9999"
|
||||||
"api": "https://scanner.example/api/v1/reports/report-abc"
|
]
|
||||||
},
|
},
|
||||||
"policy": {
|
"policy": {
|
||||||
"ui": "https://scanner.example/ui/policy/revisions/rev-42",
|
"digest": "digest-123",
|
||||||
"api": "https://scanner.example/api/v1/policy/revisions/rev-42"
|
"revisionId": "rev-42"
|
||||||
},
|
},
|
||||||
"attestation": {
|
"findings": [
|
||||||
"ui": "https://scanner.example/ui/attestations/report-abc",
|
{
|
||||||
"api": "https://scanner.example/api/v1/reports/report-abc/attestation"
|
"id": "finding-1",
|
||||||
}
|
"severity": "Critical",
|
||||||
},
|
"cve": "CVE-2024-9999",
|
||||||
"dsse": {
|
"purl": "pkg:docker/acme/edge-api@sha256-feedface",
|
||||||
"payloadType": "application/vnd.stellaops.report+json",
|
"reachability": "runtime"
|
||||||
"payload": "eyJyZXBvcnRJZCI6InJlcG9ydC1hYmMiLCJpbWFnZURpZ2VzdCI6InNoYTI1NjpmZWVkZmFjZSIsImdlbmVyYXRlZEF0IjoiMjAyNS0xMC0xOVQxMjozNDo1NiswMDowMCIsInZlcmRpY3QiOiJibG9ja2VkIiwicG9saWN5Ijp7InJldmlzaW9uSWQiOiJyZXYtNDIiLCJkaWdlc3QiOiJkaWdlc3QtMTIzIn0sInN1bW1hcnkiOnsidG90YWwiOjEsImJsb2NrZWQiOjEsIndhcm5lZCI6MCwiaWdub3JlZCI6MCwicXVpZXRlZCI6MH0sInZlcmRpY3RzIjpbeyJmaW5kaW5nSWQiOiJmaW5kaW5nLTEiLCJzdGF0dXMiOiJCbG9ja2VkIiwic2NvcmUiOjQ3LjUsInNvdXJjZVRydXN0IjoiTlZEIiwicmVhY2hhYmlsaXR5IjoicnVudGltZSJ9XSwiaXNzdWVzIjpbXX0=",
|
}
|
||||||
"signatures": [
|
],
|
||||||
{
|
"links": {
|
||||||
"keyId": "test-key",
|
"report": {
|
||||||
"algorithm": "hs256",
|
"ui": "https://scanner.example/ui/reports/report-abc",
|
||||||
"signature": "signature-value"
|
"api": "https://scanner.example/api/v1/reports/report-abc"
|
||||||
|
},
|
||||||
|
"policy": {
|
||||||
|
"ui": "https://scanner.example/ui/policy/revisions/rev-42",
|
||||||
|
"api": "https://scanner.example/api/v1/policy/revisions/rev-42"
|
||||||
|
},
|
||||||
|
"attestation": {
|
||||||
|
"ui": "https://scanner.example/ui/attestations/report-abc",
|
||||||
|
"api": "https://scanner.example/api/v1/reports/report-abc/attestation"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"dsse": {
|
||||||
|
"payloadType": "application/vnd.stellaops.report+json",
|
||||||
|
"payload": "eyJyZXBvcnRJZCI6InJlcG9ydC1hYmMiLCJpbWFnZURpZ2VzdCI6InNoYTI1NjpmZWVkZmFjZSIsImdlbmVyYXRlZEF0IjoiMjAyNS0xMC0xOVQxMjozNDo1NiswMDowMCIsInZlcmRpY3QiOiJibG9ja2VkIiwicG9saWN5Ijp7InJldmlzaW9uSWQiOiJyZXYtNDIiLCJkaWdlc3QiOiJkaWdlc3QtMTIzIn0sInN1bW1hcnkiOnsidG90YWwiOjEsImJsb2NrZWQiOjEsIndhcm5lZCI6MCwiaWdub3JlZCI6MCwicXVpZXRlZCI6MH0sInZlcmRpY3RzIjpbeyJmaW5kaW5nSWQiOiJmaW5kaW5nLTEiLCJzdGF0dXMiOiJCbG9ja2VkIiwic2NvcmUiOjQ3LjUsInNvdXJjZVRydXN0IjoiTlZEIiwicmVhY2hhYmlsaXR5IjoicnVudGltZSJ9XSwiaXNzdWVzIjpbXX0=",
|
||||||
|
"signatures": [
|
||||||
|
{
|
||||||
|
"keyId": "test-key",
|
||||||
|
"algorithm": "hs256",
|
||||||
|
"signature": "signature-value"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"report": {
|
||||||
|
"reportId": "report-abc",
|
||||||
|
"generatedAt": "2025-10-19T12:34:56Z",
|
||||||
|
"imageDigest": "sha256:feedface",
|
||||||
|
"policy": {
|
||||||
|
"digest": "digest-123",
|
||||||
|
"revisionId": "rev-42"
|
||||||
|
},
|
||||||
|
"summary": {
|
||||||
|
"total": 1,
|
||||||
|
"blocked": 1,
|
||||||
|
"warned": 0,
|
||||||
|
"ignored": 0,
|
||||||
|
"quieted": 0
|
||||||
|
},
|
||||||
|
"verdict": "blocked",
|
||||||
|
"verdicts": [
|
||||||
|
{
|
||||||
|
"findingId": "finding-1",
|
||||||
|
"status": "Blocked",
|
||||||
|
"score": 47.5,
|
||||||
|
"sourceTrust": "NVD",
|
||||||
|
"reachability": "runtime"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"issues": []
|
||||||
}
|
}
|
||||||
]
|
|
||||||
},
|
|
||||||
"report": {
|
|
||||||
"reportId": "report-abc",
|
|
||||||
"generatedAt": "2025-10-19T12:34:56Z",
|
|
||||||
"imageDigest": "sha256:feedface",
|
|
||||||
"policy": {
|
|
||||||
"digest": "digest-123",
|
|
||||||
"revisionId": "rev-42"
|
|
||||||
},
|
|
||||||
"summary": {
|
|
||||||
"total": 1,
|
|
||||||
"blocked": 1,
|
|
||||||
"warned": 0,
|
|
||||||
"ignored": 0,
|
|
||||||
"quieted": 0
|
|
||||||
},
|
|
||||||
"verdict": "blocked",
|
|
||||||
"verdicts": [
|
|
||||||
{
|
|
||||||
"findingId": "finding-1",
|
|
||||||
"status": "Blocked",
|
|
||||||
"score": 47.5,
|
|
||||||
"sourceTrust": "NVD",
|
|
||||||
"reachability": "runtime"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"issues": []
|
|
||||||
}
|
}
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user