stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

feat(audit): Apply TreatWarningsAsErrors=true to 160+ production csproj files

Browse Source 
Sprint: SPRINT_20251229_049_BE_csproj_audit_maint_tests
Tasks: AUDIT-0001 through AUDIT-0147 APPLY tasks (approved decisions 1-9)

Changes:
- Set TreatWarningsAsErrors=true for all production .NET projects
- Fixed nullable warnings in Scanner.EntryTrace, Scanner.Evidence,
  Scheduler.Worker, Concelier connectors, and other modules
- Injected TimeProvider/IGuidProvider for deterministic time/ID generation
- Added path traversal validation in AirGap.Bundle
- Fixed NULL handling in various cursor classes
- Third-party GostCryptography retains TreatWarningsAsErrors=false (preserves original)
- Test projects excluded per user decision (rejected decision 10)

Note: All 17 ACSC connector tests pass after snapshot fixture sync
This commit is contained in:
StellaOps Bot
2026-01-04 11:21:16 +02:00
parent bc4dd4f377
commit e411fde1a9
438 changed files with 2648 additions and 668 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Concelier/__Libraries/StellaOps.Concelier.BackportProof/StellaOps.Concelier.BackportProof.csproj
View File

@@ -5,7 +5,7 @@
<LangVersion>preview</LangVersion>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
<RootNamespace>StellaOps.Concelier.BackportProof</RootNamespace>
</PropertyGroup>

2
src/Concelier/__Libraries/StellaOps.Concelier.Cache.Valkey/StellaOps.Concelier.Cache.Valkey.csproj
View File

@@ -6,7 +6,7 @@
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<LangVersion>preview</LangVersion>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
<RootNamespace>StellaOps.Concelier.Cache.Valkey</RootNamespace>
<AssemblyName>StellaOps.Concelier.Cache.Valkey</AssemblyName>
<Description>Valkey/Redis caching for Concelier canonical advisories</Description>

22
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.Ubuntu/Internal/UbuntuCursor.cs
View File

@@ -1,5 +1,6 @@
using System;
using System.Collections.Generic;
using System.Globalization;
using System.Linq;
using StellaOps.Concelier.Documents;
@@ -32,7 +33,11 @@ internal sealed record UbuntuCursor(
lastPublished = value.DocumentType switch
{
DocumentType.DateTime => DateTime.SpecifyKind(value.ToUniversalTime(), DateTimeKind.Utc),
DocumentType.String when DateTimeOffset.TryParse(value.AsString, out var parsed) => parsed.ToUniversalTime(),
DocumentType.String when DateTimeOffset.TryParse(
value.AsString,
CultureInfo.InvariantCulture,
DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
out var parsed) => parsed.ToUniversalTime(),
_ => null
};
}
@@ -47,10 +52,14 @@ internal sealed record UbuntuCursor(
public DocumentObject ToDocumentObject()
{
// Sort collections for deterministic serialization
var sortedPendingDocs = PendingDocuments.OrderBy(id => id).Select(id => id.ToString());
var sortedPendingMaps = PendingMappings.OrderBy(id => id).Select(id => id.ToString());
var doc = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString()))
["pendingDocuments"] = new DocumentArray(sortedPendingDocs),
["pendingMappings"] = new DocumentArray(sortedPendingMaps)
};
if (LastPublished.HasValue)
@@ -60,13 +69,16 @@ internal sealed record UbuntuCursor(
if (ProcessedNoticeIds.Count > 0)
{
doc["processedIds"] = new DocumentArray(ProcessedNoticeIds);
// Sort processed IDs for deterministic output
var sortedProcessedIds = ProcessedNoticeIds.OrderBy(id => id, StringComparer.Ordinal);
doc["processedIds"] = new DocumentArray(sortedProcessedIds);
}
if (FetchCache.Count > 0)
{
var cacheDoc = new DocumentObject();
foreach (var (key, entry) in FetchCache)
// Sort fetch cache keys for deterministic output
foreach (var (key, entry) in FetchCache.OrderBy(kvp => kvp.Key, StringComparer.Ordinal))
{
cacheDoc[key] = entry.ToDocumentObject();
}

7
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.Ubuntu/Internal/UbuntuFetchCacheEntry.cs
View File

@@ -1,4 +1,5 @@
using System;
using System.Globalization;
using StellaOps.Concelier.Documents;
using StorageContracts = StellaOps.Concelier.Storage.Contracts;
@@ -31,7 +32,11 @@ internal sealed record UbuntuFetchCacheEntry(string? ETag, DateTimeOffset? LastM
lastModified = modifiedValue.DocumentType switch
{
DocumentType.DateTime => DateTime.SpecifyKind(modifiedValue.ToUniversalTime(), DateTimeKind.Utc),
DocumentType.String when DateTimeOffset.TryParse(modifiedValue.AsString, out var parsed) => parsed.ToUniversalTime(),
DocumentType.String when DateTimeOffset.TryParse(
modifiedValue.AsString,
CultureInfo.InvariantCulture,
DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
out var parsed) => parsed.ToUniversalTime(),
_ => null
};
}

3
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.Ubuntu/Internal/UbuntuNoticeParser.cs
View File

@@ -32,7 +32,8 @@ internal static class UbuntuNoticeParser
continue;
}
var published = ParseDate(noticeElement, "published") ?? DateTimeOffset.UtcNow;
// Use MinValue instead of UtcNow for deterministic fallback on invalid/missing dates
var published = ParseDate(noticeElement, "published") ?? DateTimeOffset.MinValue;
var title = noticeElement.TryGetProperty("title", out var titleElement)
? titleElement.GetString() ?? noticeId
: noticeId;

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.Ubuntu/StellaOps.Concelier.Connector.Distro.Ubuntu.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

27
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Distro.Ubuntu/UbuntuConnector.cs
View File

@@ -150,7 +150,8 @@ public sealed class UbuntuConnector : IFeedConnector
var dtoDocument = ToDocument(notice);
var sha256 = ComputeNoticeHash(dtoDocument);
var documentId = existing?.Id ?? Guid.NewGuid();
// Use existing ID or derive deterministic ID from source + uri hash
var documentId = existing?.Id ?? ComputeDeterministicId(SourceName, detailUri.AbsoluteUri);
var record = new DocumentRecord(
documentId,
SourceName,
@@ -167,7 +168,9 @@ public sealed class UbuntuConnector : IFeedConnector
await _documentStore.UpsertAsync(record, cancellationToken).ConfigureAwait(false);
var dtoRecord = new DtoRecord(Guid.NewGuid(), record.Id, SourceName, "ubuntu.notice.v1", dtoDocument, now);
// Derive deterministic DTO ID from document ID + schema
var dtoId = ComputeDeterministicId(record.Id.ToString(), "ubuntu.notice.v1");
var dtoRecord = new DtoRecord(dtoId, record.Id, SourceName, "ubuntu.notice.v1", dtoDocument, now);
await _dtoStore.UpsertAsync(dtoRecord, cancellationToken).ConfigureAwait(false);
pendingMappings.Add(record.Id);
@@ -435,6 +438,15 @@ public sealed class UbuntuConnector : IFeedConnector
return Convert.ToHexString(hash).ToLowerInvariant();
}
private Guid ComputeDeterministicId(string source, string identifier)
{
// Deterministic GUID based on SHA-256 hash of source + identifier
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
// Use first 16 bytes of hash as GUID
return new Guid(hash.AsSpan(0, 16));
}
private static DocumentObject ToDocument(UbuntuNoticeDto notice)
{
var packages = new DocumentArray();
@@ -486,14 +498,19 @@ public sealed class UbuntuConnector : IFeedConnector
private static UbuntuNoticeDto FromDocument(DocumentObject document)
{
var noticeId = document.GetValue("noticeId", string.Empty).AsString;
// Use MinValue instead of UtcNow for deterministic fallback on invalid/missing dates
var published = document.TryGetValue("published", out var publishedValue)
? publishedValue.DocumentType switch
{
DocumentType.DateTime => DateTime.SpecifyKind(publishedValue.ToUniversalTime(), DateTimeKind.Utc),
DocumentType.String when DateTimeOffset.TryParse(publishedValue.AsString, out var parsed) => parsed.ToUniversalTime(),
_ => DateTimeOffset.UtcNow
DocumentType.String when DateTimeOffset.TryParse(
publishedValue.AsString,
CultureInfo.InvariantCulture,
DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
out var parsed) => parsed.ToUniversalTime(),
_ => DateTimeOffset.MinValue
}
: DateTimeOffset.UtcNow;
: DateTimeOffset.MinValue;
var title = document.GetValue("title", noticeId).AsString;
var summary = document.GetValue("summary", string.Empty).AsString;

19
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Epss/Internal/EpssConnector.cs
View File

@@ -223,7 +223,8 @@ public sealed class EpssConnector : IFeedConnector
continue;
}
var publishedDate = session.PublishedDate ?? TryParseDateFromMetadata(document.Metadata) ?? DateOnly.FromDateTime(document.CreatedAt.UtcDateTime);
// Use MinValue as deterministic fallback when published date cannot be determined
var publishedDate = session.PublishedDate ?? TryParseDateFromMetadata(document.Metadata) ?? DateOnly.MinValue;
var modelVersion = string.IsNullOrWhiteSpace(session.ModelVersionTag) ? "unknown" : session.ModelVersionTag!;
var contentHash = session.DecompressedSha256 ?? string.Empty;
@@ -235,8 +236,10 @@ public sealed class EpssConnector : IFeedConnector
["contentHash"] = contentHash
};
// Derive deterministic DTO ID from document ID + schema
var dtoId = ComputeDeterministicId(document.Id.ToString(), DtoSchemaVersion);
var dtoRecord = new DtoRecord(
Guid.NewGuid(),
dtoId,
document.Id,
SourceName,
DtoSchemaVersion,
@@ -467,7 +470,8 @@ public sealed class EpssConnector : IFeedConnector
}
var existing = await _documentStore.FindBySourceAndUriAsync(SourceName, fetchResult.SourceUri, cancellationToken).ConfigureAwait(false);
var recordId = existing?.Id ?? Guid.NewGuid();
// Use existing ID or derive deterministic ID from source + uri
var recordId = existing?.Id ?? ComputeDeterministicId(SourceName, fetchResult.SourceUri);
await _rawDocumentStorage.UploadAsync(
SourceName,
@@ -760,6 +764,15 @@ public sealed class EpssConnector : IFeedConnector
return _stateRepository.UpdateCursorAsync(SourceName, document, _timeProvider.GetUtcNow(), cancellationToken);
}
private Guid ComputeDeterministicId(string source, string identifier)
{
// Deterministic GUID based on SHA-256 hash of source + identifier
var input = System.Text.Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
// Use first 16 bytes of hash as GUID
return new Guid(hash.AsSpan(0, 16));
}
private sealed record EpssFetchResult(
DateOnly SnapshotDate,
string SourceUri,

8
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Epss/Internal/EpssCursor.cs
View File

@@ -27,10 +27,14 @@ internal sealed record EpssCursor(
public DocumentObject ToDocumentObject()
{
// Sort collections for deterministic serialization
var sortedPendingDocs = PendingDocuments.OrderBy(id => id).Select(id => id.ToString());
var sortedPendingMaps = PendingMappings.OrderBy(id => id).Select(id => id.ToString());
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString()))
["pendingDocuments"] = new DocumentArray(sortedPendingDocs),
["pendingMappings"] = new DocumentArray(sortedPendingMaps)
};
if (!string.IsNullOrWhiteSpace(ModelVersion))

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Epss/StellaOps.Concelier.Connector.Epss.csproj
View File

@@ -5,6 +5,7 @@
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<LangVersion>preview</LangVersion>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

19
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ghsa/GhsaConnector.cs
View File

@@ -2,6 +2,7 @@ using System.Collections.Generic;
using System.Globalization;
using System.Linq;
using System.Net.Http;
using System.Text;
using System.Text.Json;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
@@ -14,6 +15,7 @@ using StellaOps.Concelier.Connector.Ghsa.Internal;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Core.Canonical;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Ghsa;
@@ -36,6 +38,7 @@ public sealed class GhsaConnector : IFeedConnector
private readonly GhsaDiagnostics _diagnostics;
private readonly TimeProvider _timeProvider;
private readonly ILogger<GhsaConnector> _logger;
private readonly ICryptoHash _hash;
private readonly ICanonicalAdvisoryService? _canonicalService;
private readonly object _rateLimitWarningLock = new();
private readonly Dictionary<(string Phase, string Resource), bool> _rateLimitWarnings = new();
@@ -51,6 +54,7 @@ public sealed class GhsaConnector : IFeedConnector
GhsaDiagnostics diagnostics,
TimeProvider? timeProvider,
ILogger<GhsaConnector> logger,
ICryptoHash cryptoHash,
ICanonicalAdvisoryService? canonicalService = null)
{
_fetchService = fetchService ?? throw new ArgumentNullException(nameof(fetchService));
@@ -64,6 +68,7 @@ public sealed class GhsaConnector : IFeedConnector
_diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
_timeProvider = timeProvider ?? TimeProvider.System;
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
_hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
_canonicalService = canonicalService; // Optional - canonical ingest
}
@@ -322,8 +327,9 @@ public sealed class GhsaConnector : IFeedConnector
}
var payload = DocumentObject.Parse(JsonSerializer.Serialize(dto, SerializerOptions));
var dtoId = ComputeDeterministicId(document.Id.ToString(), "ghsa/1.0");
var dtoRecord = new DtoRecord(
Guid.NewGuid(),
dtoId,
document.Id,
SourceName,
"ghsa/1.0",
@@ -640,4 +646,15 @@ public sealed class GhsaConnector : IFeedConnector
}
}
}
/// <summary>
/// Computes a deterministic GUID from source and identifier using SHA-256 hash.
/// </summary>
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
// Use first 16 bytes of hash as GUID
return new Guid(hash.AsSpan(0, 16));
}
}

4
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ghsa/Internal/GhsaCursor.cs
View File

@@ -28,8 +28,8 @@ internal sealed record GhsaCursor(
var document = new DocumentObject
{
["nextPage"] = NextPage,
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
};
if (LastUpdatedExclusive.HasValue)

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ghsa/StellaOps.Concelier.Connector.Ghsa.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

20
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ics.Cisa/IcsCisaConnector.cs
View File

@@ -28,6 +28,7 @@ using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Normalization.SemVer;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Ics.Cisa;
@@ -52,6 +53,7 @@ public sealed class IcsCisaConnector : IFeedConnector
private readonly IcsCisaDiagnostics _diagnostics;
private readonly TimeProvider _timeProvider;
private readonly ILogger<IcsCisaConnector> _logger;
private readonly ICryptoHash _hash;
private readonly HtmlContentSanitizer _htmlSanitizer = new();
private readonly HtmlParser _htmlParser = new();
@@ -66,7 +68,8 @@ public sealed class IcsCisaConnector : IFeedConnector
IcsCisaFeedParser parser,
IcsCisaDiagnostics diagnostics,
TimeProvider? timeProvider,
ILogger<IcsCisaConnector> logger)
ILogger<IcsCisaConnector> logger,
ICryptoHash cryptoHash)
{
_fetchService = fetchService ?? throw new ArgumentNullException(nameof(fetchService));
_rawDocumentStorage = rawDocumentStorage ?? throw new ArgumentNullException(nameof(rawDocumentStorage));
@@ -80,6 +83,7 @@ public sealed class IcsCisaConnector : IFeedConnector
_diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
_timeProvider = timeProvider ?? TimeProvider.System;
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
_hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
}
public string SourceName => IcsCisaConnectorPlugin.SourceName;
@@ -323,8 +327,9 @@ public sealed class IcsCisaConnector : IFeedConnector
WriteIndented = false,
});
var doc = DocumentObject.Parse(json);
var dtoId = ComputeDeterministicId(document.Id.ToString(), SchemaVersion);
var dtoRecord = new DtoRecord(
Guid.NewGuid(),
dtoId,
document.Id,
SourceName,
SchemaVersion,
@@ -1416,4 +1421,15 @@ public sealed class IcsCisaConnector : IFeedConnector
private Task UpdateCursorAsync(IcsCisaCursor cursor, CancellationToken cancellationToken)
=> _stateRepository.UpdateCursorAsync(SourceName, cursor.ToDocumentObject(), _timeProvider.GetUtcNow(), cancellationToken);
/// <summary>
/// Computes a deterministic GUID from source and identifier using SHA-256 hash.
/// </summary>
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
// Use first 16 bytes of hash as GUID
return new Guid(hash.AsSpan(0, 16));
}
}

4
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ics.Cisa/Internal/IcsCisaCursor.cs
View File

@@ -16,8 +16,8 @@ internal sealed record IcsCisaCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(static id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(static id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(static id => id).Select(static id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(static id => id).Select(static id => id.ToString())),
};
if (LastPublished.HasValue)

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ics.Cisa/StellaOps.Concelier.Connector.Ics.Cisa.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

6
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ics.Kaspersky/Internal/KasperskyCursor.cs
View File

@@ -21,8 +21,8 @@ internal sealed record KasperskyCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
};
if (LastPublished.HasValue)
@@ -33,7 +33,7 @@ internal sealed record KasperskyCursor(
if (FetchCache.Count > 0)
{
var cacheArray = new DocumentArray();
foreach (var (uri, metadata) in FetchCache)
foreach (var (uri, metadata) in FetchCache.OrderBy(kvp => kvp.Key, StringComparer.Ordinal))
{
var cacheDocument = new DocumentObject
{

23
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ics.Kaspersky/KasperskyConnector.cs
View File

@@ -1,6 +1,7 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Text.Json;
using System.Threading;
using System.Threading.Tasks;
@@ -16,6 +17,7 @@ using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Ics.Kaspersky;
@@ -39,6 +41,7 @@ public sealed class KasperskyConnector : IFeedConnector
private readonly KasperskyOptions _options;
private readonly TimeProvider _timeProvider;
private readonly ILogger<KasperskyConnector> _logger;
private readonly ICryptoHash _hash;
public KasperskyConnector(
KasperskyFeedClient feedClient,
@@ -50,7 +53,8 @@ public sealed class KasperskyConnector : IFeedConnector
ISourceStateRepository stateRepository,
IOptions<KasperskyOptions> options,
TimeProvider? timeProvider,
ILogger<KasperskyConnector> logger)
ILogger<KasperskyConnector> logger,
ICryptoHash cryptoHash)
{
_feedClient = feedClient ?? throw new ArgumentNullException(nameof(feedClient));
_fetchService = fetchService ?? throw new ArgumentNullException(nameof(fetchService));
@@ -63,6 +67,7 @@ public sealed class KasperskyConnector : IFeedConnector
_options.Validate();
_timeProvider = timeProvider ?? TimeProvider.System;
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
_hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
}
public string SourceName => KasperskyConnectorPlugin.SourceName;
@@ -255,7 +260,7 @@ public sealed class KasperskyConnector : IFeedConnector
: document.FetchedAt;
var summary = metadata.TryGetValue("kaspersky.summary", out var summaryValue) ? summaryValue : null;
var slug = metadata.TryGetValue("kaspersky.slug", out var slugValue) ? slugValue : ExtractSlug(new Uri(link, UriKind.Absolute));
var advisoryKey = string.IsNullOrWhiteSpace(slug) ? Guid.NewGuid().ToString("N") : slug;
var advisoryKey = string.IsNullOrWhiteSpace(slug) ? ComputeDeterministicId(document.Id.ToString(), "kaspersky.advisory").ToString("N") : slug;
byte[] rawBytes;
try
@@ -270,7 +275,8 @@ public sealed class KasperskyConnector : IFeedConnector
var dto = KasperskyAdvisoryParser.Parse(advisoryKey, title, link, published, summary, rawBytes);
var payload = DocumentObject.Parse(JsonSerializer.Serialize(dto, SerializerOptions));
var dtoRecord = new DtoRecord(Guid.NewGuid(), document.Id, SourceName, "ics.kaspersky/1", payload, _timeProvider.GetUtcNow());
var dtoId = ComputeDeterministicId(document.Id.ToString(), "ics.kaspersky/1");
var dtoRecord = new DtoRecord(dtoId, document.Id, SourceName, "ics.kaspersky/1", payload, _timeProvider.GetUtcNow());
await _dtoStore.UpsertAsync(dtoRecord, cancellationToken).ConfigureAwait(false);
await _documentStore.UpdateStatusAsync(document.Id, DocumentStatuses.PendingMap, cancellationToken).ConfigureAwait(false);
@@ -461,4 +467,15 @@ public sealed class KasperskyConnector : IFeedConnector
var last = segments[^1].Trim('/');
return string.IsNullOrWhiteSpace(last) && segments.Length > 1 ? segments[^2].Trim('/') : last;
}
/// <summary>
/// Computes a deterministic GUID from source and identifier using SHA-256 hash.
/// </summary>
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
// Use first 16 bytes of hash as GUID
return new Guid(hash.AsSpan(0, 16));
}
}

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ics.Kaspersky/StellaOps.Concelier.Connector.Ics.Kaspersky.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

4
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Jvn/Internal/JvnCursor.cs
View File

@@ -31,8 +31,8 @@ internal sealed record JvnCursor(
document["lastCompletedWindowEnd"] = LastCompletedWindowEnd.Value.UtcDateTime;
}
document["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(static id => id.ToString()));
document["pendingMappings"] = new DocumentArray(PendingMappings.Select(static id => id.ToString()));
document["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(static id => id.ToString()));
document["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(static id => id.ToString()));
return document;
}

14
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Jvn/JvnConnector.cs
View File

@@ -1,5 +1,6 @@
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Text.Json;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
@@ -14,6 +15,7 @@ using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.JpFlags;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Jvn;
@@ -35,6 +37,7 @@ public sealed class JvnConnector : IFeedConnector
private readonly IAdvisoryStore _advisoryStore;
private readonly IJpFlagStore _jpFlagStore;
private readonly ISourceStateRepository _stateRepository;
private readonly ICryptoHash _hash;
private readonly TimeProvider _timeProvider;
private readonly JvnOptions _options;
private readonly ILogger<JvnConnector> _logger;
@@ -48,6 +51,7 @@ public sealed class JvnConnector : IFeedConnector
IAdvisoryStore advisoryStore,
IJpFlagStore jpFlagStore,
ISourceStateRepository stateRepository,
ICryptoHash cryptoHash,
IOptions<JvnOptions> options,
TimeProvider? timeProvider,
ILogger<JvnConnector> logger)
@@ -60,6 +64,7 @@ public sealed class JvnConnector : IFeedConnector
_advisoryStore = advisoryStore ?? throw new ArgumentNullException(nameof(advisoryStore));
_jpFlagStore = jpFlagStore ?? throw new ArgumentNullException(nameof(jpFlagStore));
_stateRepository = stateRepository ?? throw new ArgumentNullException(nameof(stateRepository));
_hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
_options = (options ?? throw new ArgumentNullException(nameof(options))).Value ?? throw new ArgumentNullException(nameof(options));
_options.Validate();
_timeProvider = timeProvider ?? TimeProvider.System;
@@ -225,7 +230,7 @@ public sealed class JvnConnector : IFeedConnector
var sanitizedJson = JsonSerializer.Serialize(detail, SerializerOptions);
var payload = DocumentObject.Parse(sanitizedJson);
var dtoRecord = new DtoRecord(
Guid.NewGuid(),
ComputeDeterministicId(document.Id.ToString(), "jvn/1.0"),
document.Id,
SourceName,
JvnConstants.DtoSchemaVersion,
@@ -322,4 +327,11 @@ public sealed class JvnConnector : IFeedConnector
var cursorDocument = cursor.ToDocumentObject();
await _stateRepository.UpdateCursorAsync(SourceName, cursorDocument, _timeProvider.GetUtcNow(), cancellationToken).ConfigureAwait(false);
}
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hash.AsSpan()[..16]);
}
}

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Jvn/StellaOps.Concelier.Connector.Jvn.csproj
View File

@@ -4,6 +4,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<EmbeddedResource Include="Schemas\*.xsd" />

4
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Kev/Internal/KevCursor.cs
View File

@@ -17,8 +17,8 @@ internal sealed record KevCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(static id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(static id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(static id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(static id => id.ToString())),
};
if (!string.IsNullOrEmpty(CatalogVersion))

14
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Kev/KevConnector.cs
View File

@@ -1,6 +1,7 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Text.Json;
using System.Text.Json.Serialization;
using System.Threading;
@@ -18,6 +19,7 @@ using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Kev;
@@ -40,6 +42,7 @@ public sealed class KevConnector : IFeedConnector
private readonly ISourceStateRepository _stateRepository;
private readonly KevOptions _options;
private readonly IJsonSchemaValidator _schemaValidator;
private readonly ICryptoHash _hash;
private readonly TimeProvider _timeProvider;
private readonly ILogger<KevConnector> _logger;
private readonly KevDiagnostics _diagnostics;
@@ -53,6 +56,7 @@ public sealed class KevConnector : IFeedConnector
ISourceStateRepository stateRepository,
IOptions<KevOptions> options,
IJsonSchemaValidator schemaValidator,
ICryptoHash cryptoHash,
KevDiagnostics diagnostics,
TimeProvider? timeProvider,
ILogger<KevConnector> logger)
@@ -66,6 +70,7 @@ public sealed class KevConnector : IFeedConnector
_options = options?.Value ?? throw new ArgumentNullException(nameof(options));
_options.Validate();
_schemaValidator = schemaValidator ?? throw new ArgumentNullException(nameof(schemaValidator));
_hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
_diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
_timeProvider = timeProvider ?? TimeProvider.System;
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
@@ -273,7 +278,7 @@ public sealed class KevConnector : IFeedConnector
_diagnostics.CatalogParsed(catalog.CatalogVersion, entryCount);
var dtoRecord = new DtoRecord(
Guid.NewGuid(),
ComputeDeterministicId(document.Id.ToString(), "kev/1.0"),
document.Id,
SourceName,
SchemaVersion,
@@ -438,4 +443,11 @@ public sealed class KevConnector : IFeedConnector
private static Uri? TryParseUri(string? value)
=> Uri.TryCreate(value, UriKind.Absolute, out var uri) ? uri : null;
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hash.AsSpan()[..16]);
}
}

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Kev/StellaOps.Concelier.Connector.Kev.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

6
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Kisa/Internal/KisaCursor.cs
View File

@@ -36,9 +36,9 @@ internal sealed record KisaCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["knownIds"] = new DocumentArray(KnownIds),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
["knownIds"] = new DocumentArray(KnownIds.OrderBy(id => id, StringComparer.Ordinal)),
};
if (LastPublished.HasValue)

14
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Kisa/KisaConnector.cs
View File

@@ -1,6 +1,7 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Text.Json;
using System.Threading;
using System.Threading.Tasks;
@@ -15,6 +16,7 @@ using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Kisa;
@@ -37,6 +39,7 @@ public sealed class KisaConnector : IFeedConnector
private readonly ISourceStateRepository _stateRepository;
private readonly KisaOptions _options;
private readonly KisaDiagnostics _diagnostics;
private readonly ICryptoHash _hash;
private readonly TimeProvider _timeProvider;
private readonly ILogger<KisaConnector> _logger;
@@ -51,6 +54,7 @@ public sealed class KisaConnector : IFeedConnector
ISourceStateRepository stateRepository,
IOptions<KisaOptions> options,
KisaDiagnostics diagnostics,
ICryptoHash cryptoHash,
TimeProvider? timeProvider,
ILogger<KisaConnector> logger)
{
@@ -65,6 +69,7 @@ public sealed class KisaConnector : IFeedConnector
_options = (options ?? throw new ArgumentNullException(nameof(options))).Value ?? throw new ArgumentNullException(nameof(options));
_options.Validate();
_diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
_hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
_timeProvider = timeProvider ?? TimeProvider.System;
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
}
@@ -288,7 +293,7 @@ public sealed class KisaConnector : IFeedConnector
_logger.LogDebug("KISA parsed detail for {DocumentId} ({Category})", document.Id, category ?? "unknown");
var dtoDoc = DocumentObject.Parse(JsonSerializer.Serialize(parsed, SerializerOptions));
var dtoRecord = new DtoRecord(Guid.NewGuid(), document.Id, SourceName, "kisa.detail.v1", dtoDoc, now);
var dtoRecord = new DtoRecord(ComputeDeterministicId(document.Id.ToString(), "kisa/1.0"), document.Id, SourceName, "kisa.detail.v1", dtoDoc, now);
await _dtoStore.UpsertAsync(dtoRecord, cancellationToken).ConfigureAwait(false);
await _documentStore.UpdateStatusAsync(document.Id, DocumentStatuses.PendingMap, cancellationToken).ConfigureAwait(false);
@@ -421,4 +426,11 @@ public sealed class KisaConnector : IFeedConnector
var completedAt = cursor.LastFetchAt ?? _timeProvider.GetUtcNow();
return _stateRepository.UpdateCursorAsync(SourceName, document, completedAt, cancellationToken);
}
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hash.AsSpan()[..16]);
}
}

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Kisa/StellaOps.Concelier.Connector.Kisa.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

4
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Nvd/Internal/NvdCursor.cs
View File

@@ -15,8 +15,8 @@ internal sealed record NvdCursor(
{
var document = new DocumentObject();
Window.WriteTo(document);
document["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString()));
document["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString()));
document["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString()));
document["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString()));
return document;
}

11
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Nvd/NvdConnector.cs
View File

@@ -213,7 +213,7 @@ public sealed class NvdConnector : IFeedConnector
var payload = DocumentObject.Parse(sanitized);
var dtoRecord = new DtoRecord(
Guid.NewGuid(),
ComputeDeterministicId(document.Id.ToString(), "nvd/1.0"),
document.Id,
SourceName,
"nvd.cve.v2",
@@ -473,7 +473,7 @@ public sealed class NvdConnector : IFeedConnector
: document.Sha256;
var record = new ChangeHistoryRecord(
Guid.NewGuid(),
ComputeDeterministicId($"{current.AdvisoryKey}:{document.Id}", "nvd-change/1.0"),
SourceName,
current.AdvisoryKey,
document.Id,
@@ -544,6 +544,13 @@ public sealed class NvdConnector : IFeedConnector
return $"sha256:{hex}";
}
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hash.AsSpan()[..16]);
}
private async Task<NvdCursor> GetCursorAsync(CancellationToken cancellationToken)
{
var record = await _stateRepository.TryGetAsync(SourceName, cancellationToken).ConfigureAwait(false);

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Nvd/StellaOps.Concelier.Connector.Nvd.csproj
View File

@@ -4,6 +4,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<EmbeddedResource Include="Schemas\nvd-vulnerability.schema.json" />

12
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Osv/Internal/OsvCursor.cs
View File

@@ -27,14 +27,14 @@ internal sealed record OsvCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
};
if (LastModifiedByEcosystem.Count > 0)
{
var lastModifiedDoc = new DocumentObject();
foreach (var (ecosystem, timestamp) in LastModifiedByEcosystem)
foreach (var (ecosystem, timestamp) in LastModifiedByEcosystem.OrderBy(kvp => kvp.Key, StringComparer.Ordinal))
{
lastModifiedDoc[ecosystem] = timestamp.HasValue ? DocumentValue.Create(timestamp.Value.UtcDateTime) : DocumentNull.Value;
}
@@ -45,9 +45,9 @@ internal sealed record OsvCursor(
if (ProcessedIdsByEcosystem.Count > 0)
{
var processedDoc = new DocumentObject();
foreach (var (ecosystem, ids) in ProcessedIdsByEcosystem)
foreach (var (ecosystem, ids) in ProcessedIdsByEcosystem.OrderBy(kvp => kvp.Key, StringComparer.Ordinal))
{
processedDoc[ecosystem] = new DocumentArray(ids.Select(id => id));
processedDoc[ecosystem] = new DocumentArray(ids.OrderBy(id => id, StringComparer.Ordinal).Select(id => id));
}
document["processed"] = processedDoc;
@@ -56,7 +56,7 @@ internal sealed record OsvCursor(
if (ArchiveMetadataByEcosystem.Count > 0)
{
var metadataDoc = new DocumentObject();
foreach (var (ecosystem, metadata) in ArchiveMetadataByEcosystem)
foreach (var (ecosystem, metadata) in ArchiveMetadataByEcosystem.OrderBy(kvp => kvp.Key, StringComparer.Ordinal))
{
var element = new DocumentObject();
if (!string.IsNullOrWhiteSpace(metadata.ETag))

11
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Osv/OsvConnector.cs
View File

@@ -192,7 +192,7 @@ public sealed class OsvConnector : IFeedConnector
var sanitized = JsonSerializer.Serialize(dto, SerializerOptions);
var payload = StellaOps.Concelier.Documents.DocumentObject.Parse(sanitized);
var dtoRecord = new DtoRecord(
Guid.NewGuid(),
ComputeDeterministicId(document.Id.ToString(), "osv/1.0"),
document.Id,
SourceName,
"osv.v1",
@@ -434,7 +434,7 @@ public sealed class OsvConnector : IFeedConnector
continue;
}
var recordId = existing?.Id ?? Guid.NewGuid();
var recordId = existing?.Id ?? ComputeDeterministicId(documentUri, "osv-doc/1.0");
_ = await _rawDocumentStorage.UploadAsync(SourceName, documentUri, bytes, "application/json", null, cancellationToken, recordId).ConfigureAwait(false);
var metadata = new Dictionary<string, string>(StringComparer.Ordinal)
{
@@ -613,4 +613,11 @@ public sealed class OsvConnector : IFeedConnector
}
}
}
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = System.Text.Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hash.AsSpan()[..16]);
}
}

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Osv/StellaOps.Concelier.Connector.Osv.csproj
View File

@@ -4,6 +4,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />

4
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ru.Bdu/Internal/RuBduCursor.cs
View File

@@ -24,8 +24,8 @@ internal sealed record RuBduCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
};
if (LastSuccessfulFetch.HasValue)

11
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ru.Bdu/RuBduConnector.cs
View File

@@ -269,7 +269,7 @@ public sealed class RuBduConnector : IFeedConnector
}
var doc = StellaOps.Concelier.Documents.DocumentObject.Parse(JsonSerializer.Serialize(dto, SerializerOptions));
var dtoRecord = new DtoRecord(Guid.NewGuid(), document.Id, SourceName, "ru-bdu.v1", doc, _timeProvider.GetUtcNow());
var dtoRecord = new DtoRecord(ComputeDeterministicId(document.Id.ToString(), "ru-bdu/1.0"), document.Id, SourceName, "ru-bdu.v1", doc, _timeProvider.GetUtcNow());
await _dtoStore.UpsertAsync(dtoRecord, cancellationToken).ConfigureAwait(false);
await _documentStore.UpdateStatusAsync(document.Id, DocumentStatuses.PendingMap, cancellationToken).ConfigureAwait(false);
_diagnostics.ParseSuccess(
@@ -411,7 +411,7 @@ public sealed class RuBduConnector : IFeedConnector
continue;
}
var recordId = existing?.Id ?? Guid.NewGuid();
var recordId = existing?.Id ?? ComputeDeterministicId(documentUri, "ru-bdu-doc/1.0");
_ = await _rawDocumentStorage.UploadAsync(SourceName, documentUri, payload, "application/json", null, cancellationToken, recordId).ConfigureAwait(false);
var metadata = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
@@ -530,4 +530,11 @@ public sealed class RuBduConnector : IFeedConnector
var completedAt = cursor.LastSuccessfulFetch ?? _timeProvider.GetUtcNow();
return _stateRepository.UpdateCursorAsync(SourceName, document, completedAt, cancellationToken);
}
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = System.Text.Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hash.AsSpan()[..16]);
}
}

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ru.Bdu/StellaOps.Concelier.Connector.Ru.Bdu.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

6
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ru.Nkcki/Internal/RuNkckiCursor.cs
View File

@@ -29,9 +29,9 @@ internal sealed record RuNkckiCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["knownBulletins"] = new DocumentArray(KnownBulletins),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
["knownBulletins"] = new DocumentArray(KnownBulletins.OrderBy(id => id, StringComparer.Ordinal)),
};
if (LastListingFetchAt.HasValue)

30
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ru.Nkcki/RuNkckiConnector.cs
View File

@@ -339,7 +339,7 @@ public sealed class RuNkckiConnector : IFeedConnector
}
var doc = StellaOps.Concelier.Documents.DocumentObject.Parse(JsonSerializer.Serialize(dto, SerializerOptions));
var dtoRecord = new DtoRecord(Guid.NewGuid(), document.Id, SourceName, "ru-nkcki.v1", doc, _timeProvider.GetUtcNow());
var dtoRecord = new DtoRecord(ComputeDeterministicId(document.Id.ToString(), "ru-nkcki/1.0"), document.Id, SourceName, "ru-nkcki.v1", doc, _timeProvider.GetUtcNow());
await _dtoStore.UpsertAsync(dtoRecord, cancellationToken).ConfigureAwait(false);
await _documentStore.UpdateStatusAsync(document.Id, DocumentStatuses.PendingMap, cancellationToken).ConfigureAwait(false);
@@ -609,7 +609,7 @@ public sealed class RuNkckiConnector : IFeedConnector
return false;
}
var recordId = existing?.Id ?? Guid.NewGuid();
var recordId = existing?.Id ?? ComputeDeterministicId(documentUri, "ru-nkcki-doc/1.0");
_ = await _rawDocumentStorage.UploadAsync(SourceName, documentUri, payload, "application/json", null, cancellationToken, recordId).ConfigureAwait(false);
var metadata = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
@@ -725,12 +725,12 @@ public sealed class RuNkckiConnector : IFeedConnector
return new ListingPageResult(attachments, uniquePagination);
}
private static string DeriveBulletinId(Uri uri)
private string DeriveBulletinId(Uri uri)
{
var fileName = Path.GetFileName(uri.AbsolutePath);
if (string.IsNullOrWhiteSpace(fileName))
{
return Guid.NewGuid().ToString("N");
return ComputeDeterministicSlug(uri.AbsoluteUri, "bulletin-id");
}
if (fileName.EndsWith(".zip", StringComparison.OrdinalIgnoreCase))
@@ -746,7 +746,7 @@ public sealed class RuNkckiConnector : IFeedConnector
return fileName.Replace('_', '-');
}
private static string BuildDocumentUri(RuNkckiVulnerabilityDto dto)
private string BuildDocumentUri(RuNkckiVulnerabilityDto dto)
{
if (!string.IsNullOrWhiteSpace(dto.FstecId))
{
@@ -761,7 +761,10 @@ public sealed class RuNkckiConnector : IFeedConnector
return $"https://nvd.nist.gov/vuln/detail/{dto.MitreId}";
}
return $"https://cert.gov.ru/materialy/uyazvimosti/{Guid.NewGuid():N}";
// Fallback: deterministic slug based on dto content
var dtoJson = JsonSerializer.Serialize(dto, SerializerOptions);
var slug2 = ComputeDeterministicSlug(dtoJson, "nkcki-doc");
return $"https://cert.gov.ru/materialy/uyazvimosti/{slug2}";
}
private string ResolveCacheDirectory(string? configuredPath)
@@ -791,7 +794,7 @@ public sealed class RuNkckiConnector : IFeedConnector
private string GetBulletinCachePath(string bulletinId)
{
var fileStem = string.IsNullOrWhiteSpace(bulletinId)
? Guid.NewGuid().ToString("N")
? ComputeDeterministicSlug("unknown-bulletin", _timeProvider.GetUtcNow().ToString("O"))
: Uri.EscapeDataString(bulletinId);
return Path.Combine(_cacheDirectory, $"{fileStem}.json.zip");
}
@@ -947,4 +950,17 @@ public sealed class RuNkckiConnector : IFeedConnector
return new ListingFetchSummary(attachments, visited);
}
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hash.AsSpan()[..16]);
}
private string ComputeDeterministicSlug(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
return _hash.ComputeHashHex(input, HashAlgorithms.Sha256)[..32];
}
}

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Ru.Nkcki/StellaOps.Concelier.Connector.Ru.Nkcki.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

4
src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror/Internal/StellaOpsMirrorCursor.cs
View File

@@ -25,8 +25,8 @@ internal sealed record StellaOpsMirrorCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
};
if (!string.IsNullOrWhiteSpace(ExportId))

1
src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror/StellaOps.Concelier.Connector.StellaOpsMirror.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

11
src/Concelier/__Libraries/StellaOps.Concelier.Connector.StellaOpsMirror/StellaOpsMirrorConnector.cs
View File

@@ -226,7 +226,7 @@ public sealed class StellaOpsMirrorConnector : IFeedConnector
return existing;
}
var recordId = existing?.Id ?? Guid.NewGuid();
var recordId = existing?.Id ?? ComputeDeterministicId(absolute, "mirror-doc/1.0");
_ = await _rawDocumentStorage.UploadAsync(Source, absolute, payload, contentType, ExpiresAt: null, cancellationToken, recordId).ConfigureAwait(false);
var now = _timeProvider.GetUtcNow();
var sha = ComputeSha256(payload);
@@ -423,7 +423,7 @@ public sealed class StellaOpsMirrorConnector : IFeedConnector
}
var dtoDoc = DocumentObject.Parse(json);
var dtoRecord = new DtoRecord(Guid.NewGuid(), document.Id, Source, BundleDtoSchemaVersion, dtoDoc, now);
var dtoRecord = new DtoRecord(ComputeDeterministicId(document.Id.ToString(), "mirror/1.0"), document.Id, Source, BundleDtoSchemaVersion, dtoDoc, now);
await _dtoStore.UpsertAsync(dtoRecord, cancellationToken).ConfigureAwait(false);
await _documentStore.UpdateStatusAsync(document.Id, DocumentStatuses.PendingMap, cancellationToken).ConfigureAwait(false);
@@ -566,6 +566,13 @@ public sealed class StellaOpsMirrorConnector : IFeedConnector
pendingMappings.Count);
}
}
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hash.AsSpan()[..16]);
}
}
file static class UriExtensions

13
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Adobe/AdobeConnector.cs
View File

@@ -21,6 +21,7 @@ using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.PsirtFlags;
using StellaOps.Concelier.Models;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Vndr.Adobe;
@@ -39,6 +40,7 @@ public sealed class AdobeConnector : IFeedConnector
private readonly TimeProvider _timeProvider;
private readonly IHttpClientFactory _httpClientFactory;
private readonly AdobeDiagnostics _diagnostics;
private readonly ICryptoHash _hash;
private readonly ILogger<AdobeConnector> _logger;
private static readonly JsonSchema Schema = AdobeSchemaProvider.Schema;
@@ -61,6 +63,7 @@ public sealed class AdobeConnector : IFeedConnector
TimeProvider? timeProvider,
IHttpClientFactory httpClientFactory,
AdobeDiagnostics diagnostics,
ICryptoHash cryptoHash,
ILogger<AdobeConnector> logger)
{
_fetchService = fetchService ?? throw new ArgumentNullException(nameof(fetchService));
@@ -76,6 +79,7 @@ public sealed class AdobeConnector : IFeedConnector
_timeProvider = timeProvider ?? TimeProvider.System;
_httpClientFactory = httpClientFactory ?? throw new ArgumentNullException(nameof(httpClientFactory));
_diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
_hash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
_logger = logger ?? throw new ArgumentNullException(nameof(logger));
}
@@ -497,7 +501,7 @@ public sealed class AdobeConnector : IFeedConnector
var payload = StellaOps.Concelier.Documents.DocumentObject.Parse(json);
var dtoRecord = new DtoRecord(
Guid.NewGuid(),
ComputeDeterministicId(document.Id.ToString(), "adobe/1.0"),
document.Id,
SourceName,
"adobe.bulletin.v1",
@@ -754,4 +758,11 @@ public sealed class AdobeConnector : IFeedConnector
return rules.Count == 0 ? Array.Empty<NormalizedVersionRule>() : rules.ToArray();
}
private Guid ComputeDeterministicId(string source, string identifier)
{
var input = Encoding.UTF8.GetBytes($"{source}:{identifier}");
var hash = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hash.AsSpan()[..16]);
}
}

6
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Adobe/Internal/AdobeCursor.cs
View File

@@ -21,13 +21,13 @@ internal sealed record AdobeCursor(
document["lastPublished"] = LastPublished.Value.UtcDateTime;
}
document["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString()));
document["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString()));
document["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString()));
document["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString()));
if (FetchCache is { Count: > 0 })
{
var cacheDocument = new DocumentObject();
foreach (var (key, entry) in FetchCache)
foreach (var (key, entry) in FetchCache.OrderBy(kvp => kvp.Key, StringComparer.Ordinal))
{
cacheDocument[key] = entry.ToDocument();
}

3
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Adobe/StellaOps.Concelier.Connector.Vndr.Adobe.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
@@ -17,7 +18,7 @@
<ItemGroup>
<ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
<ProjectReference Include="../StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />
<ProjectReference Include="../StellaOps.Concelier.Models/StellaOps.Concelier.Models.csproj" />
</ItemGroup>

17
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Apple/AppleConnector.cs
View File

@@ -2,6 +2,7 @@ using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Text;
using System.Text.Json;
using System.Text.Json.Serialization;
using System.Threading;
@@ -17,6 +18,7 @@ using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.PsirtFlags;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Vndr.Apple;
@@ -36,6 +38,7 @@ public sealed class AppleConnector : IFeedConnector
private readonly IAdvisoryStore _advisoryStore;
private readonly IPsirtFlagStore _psirtFlagStore;
private readonly ISourceStateRepository _stateRepository;
private readonly ICryptoHash _hash;
private readonly AppleOptions _options;
private readonly AppleDiagnostics _diagnostics;
private readonly TimeProvider _timeProvider;
@@ -49,6 +52,7 @@ public sealed class AppleConnector : IFeedConnector
IAdvisoryStore advisoryStore,
IPsirtFlagStore psirtFlagStore,
ISourceStateRepository stateRepository,
ICryptoHash hash,
AppleDiagnostics diagnostics,
IOptions<AppleOptions> options,
TimeProvider? timeProvider,
@@ -61,6 +65,7 @@ public sealed class AppleConnector : IFeedConnector
_advisoryStore = advisoryStore ?? throw new ArgumentNullException(nameof(advisoryStore));
_psirtFlagStore = psirtFlagStore ?? throw new ArgumentNullException(nameof(psirtFlagStore));
_stateRepository = stateRepository ?? throw new ArgumentNullException(nameof(stateRepository));
_hash = hash ?? throw new ArgumentNullException(nameof(hash));
_diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
_options = (options ?? throw new ArgumentNullException(nameof(options))).Value ?? throw new ArgumentNullException(nameof(options));
_options.Validate();
@@ -70,6 +75,16 @@ public sealed class AppleConnector : IFeedConnector
public string SourceName => VndrAppleConnectorPlugin.SourceName;
/// <summary>
/// Computes a deterministic GUID from the source namespace and identifier using SHA-256.
/// </summary>
private Guid ComputeDeterministicId(string identifier, string sourceNamespace)
{
var input = Encoding.UTF8.GetBytes($"{sourceNamespace}:{identifier}");
var hashBytes = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hashBytes[..16]);
}
public async Task FetchAsync(IServiceProvider services, CancellationToken cancellationToken)
{
ArgumentNullException.ThrowIfNull(services);
@@ -259,7 +274,7 @@ public sealed class AppleConnector : IFeedConnector
var existingDto = await _dtoStore.FindByDocumentIdAsync(document.Id, cancellationToken).ConfigureAwait(false);
var dtoRecord = existingDto is null
? new DtoRecord(Guid.NewGuid(), document.Id, SourceName, "apple.security.update.v1", payload, validatedAt)
? new DtoRecord(ComputeDeterministicId(document.Id.ToString(), "apple/1.0"), document.Id, SourceName, "apple.security.update.v1", payload, validatedAt)
: existingDto with
{
Payload = payload,

6
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Apple/Internal/AppleCursor.cs
View File

@@ -20,8 +20,8 @@ internal sealed record AppleCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
};
if (LastPosted.HasValue)
@@ -31,7 +31,7 @@ internal sealed record AppleCursor(
if (ProcessedIds.Count > 0)
{
document["processedIds"] = new DocumentArray(ProcessedIds);
document["processedIds"] = new DocumentArray(ProcessedIds.OrderBy(id => id, StringComparer.Ordinal));
}
return document;

2
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Apple/StellaOps.Concelier.Connector.Vndr.Apple.csproj
View File

@@ -5,9 +5,11 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
<ProjectReference Include="../StellaOps.Concelier.Core/StellaOps.Concelier.Core.csproj" />

16
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Chromium/ChromiumConnector.cs
View File

@@ -17,6 +17,7 @@ using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.PsirtFlags;
using StellaOps.Cryptography;
using StellaOps.Plugin;
using Json.Schema;
@@ -40,6 +41,7 @@ public sealed class ChromiumConnector : IFeedConnector
private readonly IPsirtFlagStore _psirtFlagStore;
private readonly ISourceStateRepository _stateRepository;
private readonly IJsonSchemaValidator _schemaValidator;
private readonly ICryptoHash _hash;
private readonly ChromiumOptions _options;
private readonly TimeProvider _timeProvider;
private readonly ChromiumDiagnostics _diagnostics;
@@ -55,6 +57,7 @@ public sealed class ChromiumConnector : IFeedConnector
IPsirtFlagStore psirtFlagStore,
ISourceStateRepository stateRepository,
IJsonSchemaValidator schemaValidator,
ICryptoHash hash,
IOptions<ChromiumOptions> options,
TimeProvider? timeProvider,
ChromiumDiagnostics diagnostics,
@@ -69,6 +72,7 @@ public sealed class ChromiumConnector : IFeedConnector
_psirtFlagStore = psirtFlagStore ?? throw new ArgumentNullException(nameof(psirtFlagStore));
_stateRepository = stateRepository ?? throw new ArgumentNullException(nameof(stateRepository));
_schemaValidator = schemaValidator ?? throw new ArgumentNullException(nameof(schemaValidator));
_hash = hash ?? throw new ArgumentNullException(nameof(hash));
_options = options?.Value ?? throw new ArgumentNullException(nameof(options));
_options.Validate();
_timeProvider = timeProvider ?? TimeProvider.System;
@@ -78,6 +82,16 @@ public sealed class ChromiumConnector : IFeedConnector
public string SourceName => VndrChromiumConnectorPlugin.SourceName;
/// <summary>
/// Computes a deterministic GUID from the source namespace and identifier using SHA-256.
/// </summary>
private Guid ComputeDeterministicId(string identifier, string sourceNamespace)
{
var input = Encoding.UTF8.GetBytes($"{sourceNamespace}:{identifier}");
var hashBytes = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hashBytes[..16]);
}
public async Task FetchAsync(IServiceProvider services, CancellationToken cancellationToken)
{
var cursor = await GetCursorAsync(cancellationToken).ConfigureAwait(false);
@@ -261,7 +275,7 @@ public sealed class ChromiumConnector : IFeedConnector
var validatedAt = _timeProvider.GetUtcNow();
var dtoRecord = existingDto is null
? new DtoRecord(Guid.NewGuid(), document.Id, SourceName, "chromium.post.v1", payload, validatedAt)
? new DtoRecord(ComputeDeterministicId(document.Id.ToString(), "chromium/1.0"), document.Id, SourceName, "chromium.post.v1", payload, validatedAt)
: existingDto with
{
Payload = payload,

6
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Chromium/Internal/ChromiumCursor.cs
View File

@@ -20,13 +20,13 @@ internal sealed record ChromiumCursor(
document["lastPublished"] = LastPublished.Value.UtcDateTime;
}
document["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString()));
document["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString()));
document["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString()));
document["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString()));
if (FetchCache.Count > 0)
{
var cacheDocument = new DocumentObject();
foreach (var (key, entry) in FetchCache)
foreach (var (key, entry) in FetchCache.OrderBy(kvp => kvp.Key, StringComparer.Ordinal))
{
cacheDocument[key] = entry.ToDocument();
}

2
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Chromium/StellaOps.Concelier.Connector.Vndr.Chromium.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
@@ -17,6 +18,7 @@
</ItemGroup>
<ItemGroup>
<ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
<ProjectReference Include="../StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />

36
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco/CiscoConnector.cs
View File

@@ -1,6 +1,6 @@
using System.Globalization;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Text.Json.Serialization;
using Microsoft.Extensions.Logging;
@@ -14,6 +14,7 @@ using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Vndr.Cisco;
@@ -45,6 +46,7 @@ public sealed class CiscoConnector : IFeedConnector
private readonly IAdvisoryStore _advisoryStore;
private readonly ISourceStateRepository _stateRepository;
private readonly CiscoDtoFactory _dtoFactory;
private readonly ICryptoHash _hash;
private readonly CiscoDiagnostics _diagnostics;
private readonly IOptions<CiscoOptions> _options;
private readonly TimeProvider _timeProvider;
@@ -58,6 +60,7 @@ public sealed class CiscoConnector : IFeedConnector
IAdvisoryStore advisoryStore,
ISourceStateRepository stateRepository,
CiscoDtoFactory dtoFactory,
ICryptoHash hash,
CiscoDiagnostics diagnostics,
IOptions<CiscoOptions> options,
TimeProvider? timeProvider,
@@ -70,6 +73,7 @@ public sealed class CiscoConnector : IFeedConnector
_advisoryStore = advisoryStore ?? throw new ArgumentNullException(nameof(advisoryStore));
_stateRepository = stateRepository ?? throw new ArgumentNullException(nameof(stateRepository));
_dtoFactory = dtoFactory ?? throw new ArgumentNullException(nameof(dtoFactory));
_hash = hash ?? throw new ArgumentNullException(nameof(hash));
_diagnostics = diagnostics ?? throw new ArgumentNullException(nameof(diagnostics));
_options = options ?? throw new ArgumentNullException(nameof(options));
_timeProvider = timeProvider ?? TimeProvider.System;
@@ -78,6 +82,25 @@ public sealed class CiscoConnector : IFeedConnector
public string SourceName => VndrCiscoConnectorPlugin.SourceName;
/// <summary>
/// Computes a deterministic GUID from the source namespace and identifier using SHA-256.
/// </summary>
private Guid ComputeDeterministicId(string identifier, string sourceNamespace)
{
var input = Encoding.UTF8.GetBytes($"{sourceNamespace}:{identifier}");
var hashBytes = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hashBytes[..16]);
}
/// <summary>
/// Computes a SHA-256 hash of the payload and returns it as a lowercase hex string.
/// </summary>
private string ComputeSha256(byte[] payload)
{
var hashBytes = _hash.ComputeHash(payload, HashAlgorithms.Sha256);
return Convert.ToHexString(hashBytes).ToLowerInvariant();
}
public async Task FetchAsync(IServiceProvider services, CancellationToken cancellationToken)
{
ArgumentNullException.ThrowIfNull(services);
@@ -137,7 +160,7 @@ public sealed class CiscoConnector : IFeedConnector
continue;
}
var recordId = existing?.Id ?? Guid.NewGuid();
var recordId = existing?.Id ?? ComputeDeterministicId(documentUri, "cisco-doc/1.0");
_ = await _rawDocumentStorage.UploadAsync(
SourceName,
documentUri,
@@ -326,7 +349,7 @@ public sealed class CiscoConnector : IFeedConnector
{
var dtoJson = JsonSerializer.Serialize(dto, DtoSerializerOptions);
var dtoDoc = DocumentObject.Parse(dtoJson);
var dtoRecord = new DtoRecord(Guid.NewGuid(), document.Id, SourceName, DtoSchemaVersion, dtoDoc, _timeProvider.GetUtcNow());
var dtoRecord = new DtoRecord(ComputeDeterministicId(document.Id.ToString(), "cisco/1.0"), document.Id, SourceName, DtoSchemaVersion, dtoDoc, _timeProvider.GetUtcNow());
await _dtoStore.UpsertAsync(dtoRecord, cancellationToken).ConfigureAwait(false);
await _documentStore.UpdateStatusAsync(document.Id, DocumentStatuses.PendingMap, cancellationToken).ConfigureAwait(false);
pendingDocuments.Remove(documentId);
@@ -463,13 +486,6 @@ public sealed class CiscoConnector : IFeedConnector
}
}
private static string ComputeSha256(byte[] payload)
{
Span<byte> hash = stackalloc byte[32];
SHA256.HashData(payload, hash);
return Convert.ToHexString(hash).ToLowerInvariant();
}
private static bool ShouldProcess(CiscoAdvisoryItem advisory, DateTimeOffset? checkpoint, string? checkpointId)
{
if (checkpoint is null || advisory.LastUpdated is null)

4
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco/Internal/CiscoCursor.cs
View File

@@ -16,8 +16,8 @@ internal sealed record CiscoCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
};
if (LastModified.HasValue)

2
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Cisco/StellaOps.Concelier.Connector.Vndr.Cisco.csproj
View File

@@ -5,9 +5,11 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
<ProjectReference Include="../StellaOps.Concelier.Core/StellaOps.Concelier.Core.csproj" />
<ProjectReference Include="../StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />

4
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Msrc/Internal/MsrcCursor.cs
View File

@@ -27,8 +27,8 @@ internal sealed record MsrcCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
};
if (LastModifiedCursor.HasValue)

31
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Msrc/MsrcConnector.cs
View File

@@ -1,7 +1,7 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Net.Http;
using System.Text.Json;
using System.Threading;
@@ -18,6 +18,7 @@ using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Vndr.Msrc;
@@ -39,6 +40,7 @@ public sealed class MsrcConnector : IFeedConnector
private readonly IAdvisoryStore _advisoryStore;
private readonly ISourceStateRepository _stateRepository;
private readonly MsrcOptions _options;
private readonly ICryptoHash _hash;
private readonly TimeProvider _timeProvider;
private readonly ILogger<MsrcConnector> _logger;
private readonly MsrcDiagnostics _diagnostics;
@@ -52,6 +54,7 @@ public sealed class MsrcConnector : IFeedConnector
IDtoStore dtoStore,
IAdvisoryStore advisoryStore,
ISourceStateRepository stateRepository,
ICryptoHash hash,
IOptions<MsrcOptions> options,
TimeProvider? timeProvider,
MsrcDiagnostics diagnostics,
@@ -65,6 +68,7 @@ public sealed class MsrcConnector : IFeedConnector
_dtoStore = dtoStore ?? throw new ArgumentNullException(nameof(dtoStore));
_advisoryStore = advisoryStore ?? throw new ArgumentNullException(nameof(advisoryStore));
_stateRepository = stateRepository ?? throw new ArgumentNullException(nameof(stateRepository));
_hash = hash ?? throw new ArgumentNullException(nameof(hash));
_options = (options ?? throw new ArgumentNullException(nameof(options))).Value ?? throw new ArgumentNullException(nameof(options));
_options.Validate();
_timeProvider = timeProvider ?? TimeProvider.System;
@@ -74,6 +78,25 @@ public sealed class MsrcConnector : IFeedConnector
public string SourceName => MsrcConnectorPlugin.SourceName;
/// <summary>
/// Computes a deterministic GUID from the source namespace and identifier using SHA-256.
/// </summary>
private Guid ComputeDeterministicId(string identifier, string sourceNamespace)
{
var input = Encoding.UTF8.GetBytes($"{sourceNamespace}:{identifier}");
var hashBytes = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hashBytes[..16]);
}
/// <summary>
/// Computes a SHA-256 hash of the payload and returns it as a lowercase hex string.
/// </summary>
private string ComputeSha256(byte[] payload)
{
var hashBytes = _hash.ComputeHash(payload, HashAlgorithms.Sha256);
return Convert.ToHexString(hashBytes).ToLowerInvariant();
}
public async Task FetchAsync(IServiceProvider services, CancellationToken cancellationToken)
{
ArgumentNullException.ThrowIfNull(services);
@@ -139,9 +162,9 @@ public sealed class MsrcConnector : IFeedConnector
}
var bytes = await _apiClient.FetchDetailAsync(vulnerabilityId, cancellationToken).ConfigureAwait(false);
var sha = Convert.ToHexString(SHA256.HashData(bytes)).ToLowerInvariant();
var sha = ComputeSha256(bytes);
var documentId = existing?.Id ?? Guid.NewGuid();
var documentId = existing?.Id ?? ComputeDeterministicId(detailUri, "msrc-doc/1.0");
_ = await _rawDocumentStorage.UploadAsync(
SourceName,
@@ -294,7 +317,7 @@ public sealed class MsrcConnector : IFeedConnector
var dto = _detailParser.Parse(detail);
var doc = DocumentObject.Parse(JsonSerializer.Serialize(dto, SerializerOptions));
var dtoRecord = new DtoRecord(Guid.NewGuid(), document.Id, SourceName, "msrc.detail.v1", doc, now);
var dtoRecord = new DtoRecord(ComputeDeterministicId(document.Id.ToString(), "msrc/1.0"), document.Id, SourceName, "msrc.detail.v1", doc, now);
await _dtoStore.UpsertAsync(dtoRecord, cancellationToken).ConfigureAwait(false);
await _documentStore.UpdateStatusAsync(document.Id, DocumentStatuses.PendingMap, cancellationToken).ConfigureAwait(false);
remainingDocuments.Remove(documentId);

2
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Msrc/StellaOps.Concelier.Connector.Vndr.Msrc.csproj
View File

@@ -5,9 +5,11 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
<ProjectReference Include="../StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />

6
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Oracle/Internal/OracleCursor.cs
View File

@@ -23,8 +23,8 @@ internal sealed record OracleCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
};
if (LastProcessed.HasValue)
@@ -35,7 +35,7 @@ internal sealed record OracleCursor(
if (FetchCache.Count > 0)
{
var cacheDocument = new DocumentObject();
foreach (var (key, entry) in FetchCache)
foreach (var (key, entry) in FetchCache.OrderBy(kvp => kvp.Key, StringComparer.Ordinal))
{
cacheDocument[key] = entry.ToDocumentObject();
}

17
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Oracle/OracleConnector.cs
View File

@@ -1,6 +1,7 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Text.Json;
using System.Threading;
using System.Threading.Tasks;
@@ -15,6 +16,7 @@ using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage.Contracts;
using StellaOps.Concelier.Storage.PsirtFlags;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Vndr.Oracle;
@@ -35,6 +37,7 @@ public sealed class OracleConnector : IFeedConnector
private readonly IPsirtFlagStore _psirtFlagStore;
private readonly ISourceStateRepository _stateRepository;
private readonly OracleCalendarFetcher _calendarFetcher;
private readonly ICryptoHash _hash;
private readonly OracleOptions _options;
private readonly TimeProvider _timeProvider;
private readonly ILogger<OracleConnector> _logger;
@@ -48,6 +51,7 @@ public sealed class OracleConnector : IFeedConnector
IPsirtFlagStore psirtFlagStore,
ISourceStateRepository stateRepository,
OracleCalendarFetcher calendarFetcher,
ICryptoHash hash,
IOptions<OracleOptions> options,
TimeProvider? timeProvider,
ILogger<OracleConnector> logger)
@@ -60,6 +64,7 @@ public sealed class OracleConnector : IFeedConnector
_psirtFlagStore = psirtFlagStore ?? throw new ArgumentNullException(nameof(psirtFlagStore));
_stateRepository = stateRepository ?? throw new ArgumentNullException(nameof(stateRepository));
_calendarFetcher = calendarFetcher ?? throw new ArgumentNullException(nameof(calendarFetcher));
_hash = hash ?? throw new ArgumentNullException(nameof(hash));
_options = (options ?? throw new ArgumentNullException(nameof(options))).Value ?? throw new ArgumentNullException(nameof(options));
_options.Validate();
_timeProvider = timeProvider ?? TimeProvider.System;
@@ -68,6 +73,16 @@ public sealed class OracleConnector : IFeedConnector
public string SourceName => VndrOracleConnectorPlugin.SourceName;
/// <summary>
/// Computes a deterministic GUID from the source namespace and identifier using SHA-256.
/// </summary>
private Guid ComputeDeterministicId(string identifier, string sourceNamespace)
{
var input = Encoding.UTF8.GetBytes($"{sourceNamespace}:{identifier}");
var hashBytes = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hashBytes[..16]);
}
public async Task FetchAsync(IServiceProvider services, CancellationToken cancellationToken)
{
var cursor = await GetCursorAsync(cancellationToken).ConfigureAwait(false);
@@ -227,7 +242,7 @@ public sealed class OracleConnector : IFeedConnector
var existingDto = await _dtoStore.FindByDocumentIdAsync(document.Id, cancellationToken).ConfigureAwait(false);
var dtoRecord = existingDto is null
? new DtoRecord(Guid.NewGuid(), document.Id, SourceName, "oracle.advisory.v1", payload, validatedAt)
? new DtoRecord(ComputeDeterministicId(document.Id.ToString(), "oracle/1.0"), document.Id, SourceName, "oracle.advisory.v1", payload, validatedAt)
: existingDto with
{
Payload = payload,

2
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Oracle/StellaOps.Concelier.Connector.Vndr.Oracle.csproj
View File

@@ -5,9 +5,11 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
<ProjectReference Include="../StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />

8
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Vmware/Internal/VmwareCursor.cs
View File

@@ -23,8 +23,8 @@ internal sealed record VmwareCursor(
{
var document = new DocumentObject
{
["pendingDocuments"] = new DocumentArray(PendingDocuments.Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.Select(id => id.ToString())),
["pendingDocuments"] = new DocumentArray(PendingDocuments.OrderBy(id => id).Select(id => id.ToString())),
["pendingMappings"] = new DocumentArray(PendingMappings.OrderBy(id => id).Select(id => id.ToString())),
};
if (LastModified.HasValue)
@@ -34,13 +34,13 @@ internal sealed record VmwareCursor(
if (ProcessedIds.Count > 0)
{
document["processedIds"] = new DocumentArray(ProcessedIds);
document["processedIds"] = new DocumentArray(ProcessedIds.OrderBy(id => id, StringComparer.Ordinal));
}
if (FetchCache.Count > 0)
{
var cacheDocument = new DocumentObject();
foreach (var (key, entry) in FetchCache)
foreach (var (key, entry) in FetchCache.OrderBy(kvp => kvp.Key, StringComparer.Ordinal))
{
cacheDocument[key] = entry.ToDocumentObject();
}

2
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Vmware/StellaOps.Concelier.Connector.Vndr.Vmware.csproj
View File

@@ -5,9 +5,11 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
<ProjectReference Include="../StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />
<ProjectReference Include="../StellaOps.Concelier.Models/StellaOps.Concelier.Models.csproj" />

17
src/Concelier/__Libraries/StellaOps.Concelier.Connector.Vndr.Vmware/VmwareConnector.cs
View File

@@ -2,6 +2,7 @@ using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Text;
using System.Text.Json;
using System.Threading;
using System.Threading.Tasks;
@@ -18,6 +19,7 @@ using StellaOps.Concelier.Storage;
using StellaOps.Concelier.Storage.Advisories;
using StellaOps.Concelier.Storage.Contracts;
using StellaOps.Concelier.Storage.PsirtFlags;
using StellaOps.Cryptography;
using StellaOps.Plugin;
namespace StellaOps.Concelier.Connector.Vndr.Vmware;
@@ -39,6 +41,7 @@ public sealed class VmwareConnector : IFeedConnector
private readonly ISourceStateRepository _stateRepository;
private readonly IPsirtFlagStore _psirtFlagStore;
private readonly VmwareOptions _options;
private readonly ICryptoHash _hash;
private readonly TimeProvider _timeProvider;
private readonly VmwareDiagnostics _diagnostics;
private readonly ILogger<VmwareConnector> _logger;
@@ -52,6 +55,7 @@ public sealed class VmwareConnector : IFeedConnector
IAdvisoryStore advisoryStore,
ISourceStateRepository stateRepository,
IPsirtFlagStore psirtFlagStore,
ICryptoHash hash,
IOptions<VmwareOptions> options,
TimeProvider? timeProvider,
VmwareDiagnostics diagnostics,
@@ -65,6 +69,7 @@ public sealed class VmwareConnector : IFeedConnector
_advisoryStore = advisoryStore ?? throw new ArgumentNullException(nameof(advisoryStore));
_stateRepository = stateRepository ?? throw new ArgumentNullException(nameof(stateRepository));
_psirtFlagStore = psirtFlagStore ?? throw new ArgumentNullException(nameof(psirtFlagStore));
_hash = hash ?? throw new ArgumentNullException(nameof(hash));
_options = (options ?? throw new ArgumentNullException(nameof(options))).Value ?? throw new ArgumentNullException(nameof(options));
_options.Validate();
_timeProvider = timeProvider ?? TimeProvider.System;
@@ -74,6 +79,16 @@ public sealed class VmwareConnector : IFeedConnector
public string SourceName => VmwareConnectorPlugin.SourceName;
/// <summary>
/// Computes a deterministic GUID from the source namespace and identifier using SHA-256.
/// </summary>
private Guid ComputeDeterministicId(string identifier, string sourceNamespace)
{
var input = Encoding.UTF8.GetBytes($"{sourceNamespace}:{identifier}");
var hashBytes = _hash.ComputeHash(input, HashAlgorithms.Sha256);
return new Guid(hashBytes[..16]);
}
public async Task FetchAsync(IServiceProvider services, CancellationToken cancellationToken)
{
ArgumentNullException.ThrowIfNull(services);
@@ -343,7 +358,7 @@ public sealed class VmwareConnector : IFeedConnector
var sanitized = JsonSerializer.Serialize(detail, SerializerOptions);
var payload = StellaOps.Concelier.Documents.DocumentObject.Parse(sanitized);
var dtoRecord = new DtoRecord(Guid.NewGuid(), document.Id, SourceName, "vmware.v1", payload, _timeProvider.GetUtcNow());
var dtoRecord = new DtoRecord(ComputeDeterministicId(document.Id.ToString(), "vmware/1.0"), document.Id, SourceName, "vmware.v1", payload, _timeProvider.GetUtcNow());
await _dtoStore.UpsertAsync(dtoRecord, cancellationToken).ConfigureAwait(false);
await _documentStore.UpdateStatusAsync(document.Id, DocumentStatuses.PendingMap, cancellationToken).ConfigureAwait(false);

16
src/Concelier/__Libraries/StellaOps.Concelier.Core/AirGap/BundleTimelineEmitter.cs
View File

@@ -1,4 +1,6 @@
using System.Diagnostics;
using System.Security.Cryptography;
using System.Text;
using Microsoft.Extensions.Logging;
using StellaOps.Concelier.Core.AirGap.Models;
@@ -53,9 +55,12 @@ public sealed class BundleTimelineEmitter : IBundleTimelineEmitter
ArgumentNullException.ThrowIfNull(request);
ArgumentNullException.ThrowIfNull(result);
var occurredAt = _timeProvider.GetUtcNow();
var eventId = ComputeDeterministicEventId(request, occurredAt);
var timelineEvent = new BundleImportTimelineEvent
{
EventId = Guid.NewGuid(),
EventId = eventId,
TenantId = request.TenantId,
BundleId = request.Bundle.BundleId,
SourceId = request.Bundle.SourceId,
@@ -65,7 +70,7 @@ public sealed class BundleTimelineEmitter : IBundleTimelineEmitter
Stats = result.Stats,
EvidenceBundleRef = result.EvidenceBundleRef,
ContentHash = request.Bundle.ContentHash,
OccurredAt = _timeProvider.GetUtcNow(),
OccurredAt = occurredAt,
TraceId = request.TraceId ?? Activity.Current?.TraceId.ToString()
};
@@ -74,6 +79,13 @@ public sealed class BundleTimelineEmitter : IBundleTimelineEmitter
return timelineEvent;
}
private static Guid ComputeDeterministicEventId(BundleImportRequest request, DateTimeOffset occurredAt)
{
var input = $"bundle-import:{request.TenantId}:{request.Bundle.BundleId}:{request.Bundle.ContentHash}:{occurredAt:O}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input));
return new Guid(hashBytes[..16]);
}
private async Task EmitToSinkAsync(
IBundleTimelineEventSink sink,
BundleImportTimelineEvent timelineEvent,

14
src/Concelier/__Libraries/StellaOps.Concelier.Core/Events/AdvisoryEventLog.cs
View File

@@ -175,7 +175,7 @@ public sealed class AdvisoryEventLog : IAdvisoryEventLog
var (provenance, trust) = ResolveStatementMetadata(advisory, statement.Provenance, statement.Trust);
entries.Add(new AdvisoryStatementEntry(
statement.StatementId ?? Guid.NewGuid(),
statement.StatementId ?? ComputeDeterministicId(hashBytes.AsSpan(), "statement"),
vulnerabilityKey,
advisoryKey,
canonicalJson,
@@ -219,7 +219,7 @@ public sealed class AdvisoryEventLog : IAdvisoryEventLog
: ImmutableArray<Guid>.Empty;
entries.Add(new AdvisoryConflictEntry(
conflict.ConflictId ?? Guid.NewGuid(),
conflict.ConflictId ?? ComputeDeterministicId(hashBytes.AsSpan(), "conflict"),
vulnerabilityKey,
canonicalJson,
hashBytes,
@@ -269,6 +269,16 @@ public sealed class AdvisoryEventLog : IAdvisoryEventLog
return ImmutableArray.Create(hash);
}
private static Guid ComputeDeterministicId(ReadOnlySpan<byte> contentHash, string prefix)
{
Span<byte> prefixedInput = stackalloc byte[prefix.Length + 1 + contentHash.Length];
Encoding.UTF8.GetBytes(prefix, prefixedInput);
prefixedInput[prefix.Length] = (byte)':';
contentHash.CopyTo(prefixedInput[(prefix.Length + 1)..]);
var finalHash = SHA256.HashData(prefixedInput);
return new Guid(finalHash[..16]);
}
private static string Canonicalize(JsonElement element)
{
using var stream = new MemoryStream();

12
src/Concelier/__Libraries/StellaOps.Concelier.Core/Jobs/InMemoryJobStore.cs
View File

@@ -1,4 +1,6 @@
using System.Collections.Concurrent;
using System.Security.Cryptography;
using System.Text;
namespace StellaOps.Concelier.Core.Jobs;
@@ -11,8 +13,9 @@ public sealed class InMemoryJobStore : IJobStore
public Task<JobRunSnapshot> CreateAsync(JobRunCreateRequest request, CancellationToken cancellationToken)
{
var runId = ComputeDeterministicRunId(request);
var run = new JobRunSnapshot(
Guid.NewGuid(),
runId,
request.Kind,
JobRunStatus.Pending,
request.CreatedAt,
@@ -29,6 +32,13 @@ public sealed class InMemoryJobStore : IJobStore
return Task.FromResult(run);
}
private static Guid ComputeDeterministicRunId(JobRunCreateRequest request)
{
var input = $"job-run:{request.Kind}:{request.ParametersHash}:{request.CreatedAt:O}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input));
return new Guid(hashBytes[..16]);
}
public Task<JobRunSnapshot?> TryStartAsync(Guid runId, DateTimeOffset startedAt, CancellationToken cancellationToken)
{
if (_runs.TryGetValue(runId, out var run))

10
src/Concelier/__Libraries/StellaOps.Concelier.Core/Linksets/AdvisoryLinksetUpdatedEvent.cs
View File

@@ -50,9 +50,10 @@ public sealed record AdvisoryLinksetUpdatedEvent(
var tenantMetadata = BuildTenantMetadata(linkset.TenantId, tenantUrn);
var confidenceSummary = BuildConfidenceSummary(linkset.Confidence, conflicts.Length);
var idempotencyKey = ComputeIdempotencyKey(linksetId, linkset, delta);
var eventId = ComputeDeterministicEventId(idempotencyKey);
return new AdvisoryLinksetUpdatedEvent(
EventId: Guid.NewGuid(),
EventId: eventId,
IdempotencyKey: idempotencyKey,
TenantId: tenantUrn,
TenantMetadata: tenantMetadata,
@@ -71,6 +72,13 @@ public sealed record AdvisoryLinksetUpdatedEvent(
TraceId: traceId);
}
private static Guid ComputeDeterministicEventId(string idempotencyKey)
{
var input = Encoding.UTF8.GetBytes($"linkset-event:{idempotencyKey}");
var hash = SHA256.HashData(input);
return new Guid(hash[..16]);
}
/// <summary>
/// Computes a deterministic idempotency key for safe replay.
/// The key is derived from linkset identity + content hash so replaying the same change yields the same key.

10
src/Concelier/__Libraries/StellaOps.Concelier.Core/Observations/AdvisoryObservationUpdatedEvent.cs
View File

@@ -39,9 +39,10 @@ public sealed record AdvisoryObservationUpdatedEvent(
var tenantUrn = observation.Tenant.StartsWith("urn:tenant:", StringComparison.Ordinal)
? observation.Tenant
: $"urn:tenant:{observation.Tenant}";
var eventId = ComputeDeterministicEventId(observation.ObservationId, observationHash);
return new AdvisoryObservationUpdatedEvent(
EventId: Guid.NewGuid(),
EventId: eventId,
TenantId: tenantUrn,
ObservationId: observation.ObservationId,
AdvisoryId: observation.Upstream.UpstreamId,
@@ -55,6 +56,13 @@ public sealed record AdvisoryObservationUpdatedEvent(
TraceId: traceId);
}
private static Guid ComputeDeterministicEventId(string observationId, string observationHash)
{
var input = $"observation-event:{observationId}:{observationHash}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input));
return new Guid(hashBytes[..16]);
}
private static AdvisoryObservationLinksetSummary BuildSummary(
AdvisoryObservationLinkset linkset,
RawLinkset rawLinkset)

15
src/Concelier/__Libraries/StellaOps.Concelier.Core/Orchestration/ConnectorWorker.cs
View File

@@ -1,3 +1,5 @@
using System.Security.Cryptography;
using System.Text;
using Microsoft.Extensions.Logging;
namespace StellaOps.Concelier.Core.Orchestration;
@@ -56,7 +58,8 @@ public sealed class ConnectorWorker : IConnectorWorker
/// <inheritdoc />
public async Task StartRunAsync(CancellationToken cancellationToken)
{
_runId = Guid.NewGuid();
var startTime = _timeProvider.GetUtcNow();
_runId = ComputeDeterministicRunId(_tenant, _connectorId, startTime);
_sequence = 0;
_status = OrchestratorHeartbeatStatus.Starting;
_lastAckedCommandSequence = 0;
@@ -308,6 +311,16 @@ public sealed class ConnectorWorker : IConnectorWorker
await _store.AppendHeartbeatAsync(heartbeat, cancellationToken).ConfigureAwait(false);
}
/// <summary>
/// Computes a deterministic run ID from tenant, connector ID, and start time.
/// </summary>
private static Guid ComputeDeterministicRunId(string tenant, string connectorId, DateTimeOffset startTime)
{
var input = $"connector-run:{tenant}:{connectorId}:{startTime:O}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input));
return new Guid(hashBytes[..16]);
}
}
/// <summary>

21
src/Concelier/__Libraries/StellaOps.Concelier.Core/Risk/AdvisoryFieldChangeEmitter.cs
View File

@@ -2,6 +2,8 @@ using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Extensions.Logging;
@@ -56,9 +58,10 @@ public sealed class AdvisoryFieldChangeEmitter : IAdvisoryFieldChangeEmitter
var now = _timeProvider.GetUtcNow();
var changeType = DetermineChangeType(changes);
var provenance = BuildProvenance(previousSignal, currentSignal);
var notificationId = ComputeDeterministicNotificationId(tenantId, observationId, changeType, now);
var notification = new AdvisoryFieldChangeNotification(
NotificationId: Guid.NewGuid(),
NotificationId: notificationId,
TenantId: tenantId,
AdvisoryId: currentSignal.AdvisoryId,
ObservationId: observationId,
@@ -161,8 +164,11 @@ public sealed class AdvisoryFieldChangeEmitter : IAdvisoryFieldChangeEmitter
Category: AdvisoryFieldChangeCategory.Metadata,
Provenance: provenance);
var notificationId = ComputeDeterministicNotificationId(
tenantId, previousSignal.ObservationId, AdvisoryFieldChangeType.ObservationWithdrawn, now);
var notification = new AdvisoryFieldChangeNotification(
NotificationId: Guid.NewGuid(),
NotificationId: notificationId,
TenantId: tenantId,
AdvisoryId: previousSignal.AdvisoryId,
ObservationId: previousSignal.ObservationId,
@@ -376,4 +382,15 @@ public sealed class AdvisoryFieldChangeEmitter : IAdvisoryFieldChangeEmitter
UpstreamId: provenance.UpstreamId,
PreviousObservationHash: previousHash);
}
private static Guid ComputeDeterministicNotificationId(
string tenantId,
string observationId,
AdvisoryFieldChangeType changeType,
DateTimeOffset timestamp)
{
var input = $"field-change:{tenantId}:{observationId}:{changeType}:{timestamp:O}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input));
return new Guid(hashBytes[..16]);
}
}

3
src/Concelier/__Libraries/StellaOps.Concelier.Core/StellaOps.Concelier.Core.csproj
View File

@@ -5,7 +5,7 @@
<LangVersion>preview</LangVersion>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Extensions.Caching.Memory" />
@@ -22,6 +22,7 @@
<ProjectReference Include="..\..\..\__Libraries\StellaOps.Ingestion.Telemetry\StellaOps.Ingestion.Telemetry.csproj" />
<ProjectReference Include="..\..\..\__Libraries\StellaOps.Provenance\StellaOps.Provenance.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
<ProjectReference Include="../../../Aoc/__Libraries/StellaOps.Aoc/StellaOps.Aoc.csproj" />
</ItemGroup>
</Project>

2
src/Concelier/__Libraries/StellaOps.Concelier.Exporter.Json/StellaOps.Concelier.Exporter.Json.csproj
View File

@@ -5,7 +5,7 @@
<LangVersion>preview</LangVersion>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\StellaOps.Concelier.Models\StellaOps.Concelier.Models.csproj" />

3
src/Concelier/__Libraries/StellaOps.Concelier.Exporter.TrivyDb/StellaOps.Concelier.Exporter.TrivyDb.csproj
View File

@@ -5,7 +5,7 @@
<LangVersion>preview</LangVersion>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\StellaOps.Concelier.Exporter.Json\StellaOps.Concelier.Exporter.Json.csproj" />
@@ -13,6 +13,7 @@
<ProjectReference Include="..\StellaOps.Concelier.Core\StellaOps.Concelier.Core.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.DependencyInjection/StellaOps.DependencyInjection.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Plugin/StellaOps.Plugin.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />

2
src/Concelier/__Libraries/StellaOps.Concelier.Federation/StellaOps.Concelier.Federation.csproj
View File

@@ -5,7 +5,7 @@
<LangVersion>preview</LangVersion>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />

2
src/Concelier/__Libraries/StellaOps.Concelier.Interest/StellaOps.Concelier.Interest.csproj
View File

@@ -6,7 +6,7 @@
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<LangVersion>preview</LangVersion>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
<RootNamespace>StellaOps.Concelier.Interest</RootNamespace>
<AssemblyName>StellaOps.Concelier.Interest</AssemblyName>
<Description>Interest scoring for Concelier canonical advisories</Description>

13
src/Concelier/__Libraries/StellaOps.Concelier.Merge/Backport/ProvenanceScopeService.cs
View File

@@ -5,6 +5,8 @@
// Description: Service for managing provenance scope lifecycle
// -----------------------------------------------------------------------------
using System.Security.Cryptography;
using System.Text;
using System.Text.RegularExpressions;
using Microsoft.Extensions.Logging;
@@ -79,7 +81,7 @@ public sealed partial class ProvenanceScopeService : IProvenanceScopeService
// 4. Prepare scope data
var scope = new ProvenanceScope
{
Id = existing?.Id ?? Guid.NewGuid(),
Id = existing?.Id ?? ComputeDeterministicScopeId(request.CanonicalId, distroRelease),
CanonicalId = request.CanonicalId,
DistroRelease = distroRelease,
BackportSemver = evidence?.BackportVersion ?? request.FixedVersion,
@@ -144,7 +146,7 @@ public sealed partial class ProvenanceScopeService : IProvenanceScopeService
var scope = new ProvenanceScope
{
Id = existing?.Id ?? Guid.NewGuid(),
Id = existing?.Id ?? ComputeDeterministicScopeId(canonicalId, evidence.DistroRelease),
CanonicalId = canonicalId,
DistroRelease = evidence.DistroRelease,
BackportSemver = evidence.BackportVersion,
@@ -306,6 +308,13 @@ public sealed partial class ProvenanceScopeService : IProvenanceScopeService
[GeneratedRegex(@"[0-9a-f]{40}", RegexOptions.IgnoreCase)]
private static partial Regex CommitShaRegex();
private static Guid ComputeDeterministicScopeId(Guid canonicalId, string distroRelease)
{
var input = $"provenance-scope:{canonicalId}:{distroRelease}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input));
return new Guid(hashBytes[..16]);
}
#endregion
}

25
src/Concelier/__Libraries/StellaOps.Concelier.Merge/Services/AdvisoryMergeService.cs
View File

@@ -3,6 +3,8 @@ using System.Collections.Generic;
using System.Collections.Immutable;
using System.Diagnostics.Metrics;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Extensions.Logging;
@@ -246,7 +248,7 @@ public sealed class AdvisoryMergeService
foreach (var advisory in inputs)
{
var statementId = Guid.NewGuid();
var statementId = ComputeDeterministicStatementId(vulnerabilityKey, advisory);
statementIds[advisory] = statementId;
var (provenance, trust) = ResolveDsseMetadata(advisory);
statements.Add(new AdvisoryStatementInput(
@@ -260,7 +262,7 @@ public sealed class AdvisoryMergeService
Trust: trust));
}
var canonicalStatementId = Guid.NewGuid();
var canonicalStatementId = ComputeDeterministicStatementId(vulnerabilityKey, merged);
statementIds[merged] = canonicalStatementId;
var (canonicalProvenance, canonicalTrust) = ResolveDsseMetadata(merged);
statements.Add(new AdvisoryStatementInput(
@@ -352,9 +354,9 @@ public sealed class AdvisoryMergeService
var canonicalJson = explainer.ToCanonicalJson();
var document = JsonDocument.Parse(canonicalJson);
var asOf = (detail.Primary.Modified ?? detail.Suppressed.Modified ?? recordedAt).ToUniversalTime();
var conflictId = Guid.NewGuid();
var statementIdArray = ImmutableArray.CreateRange(related);
var conflictHash = explainer.ComputeHashHex(canonicalJson);
var conflictId = ComputeDeterministicConflictId(vulnerabilityKey, conflictHash);
var statementIdArray = ImmutableArray.CreateRange(related);
inputs.Add(new AdvisoryConflictInput(
vulnerabilityKey,
@@ -572,6 +574,21 @@ public sealed class AdvisoryMergeService
return component.SeedAdvisoryKey;
}
private static Guid ComputeDeterministicStatementId(string vulnerabilityKey, Advisory advisory)
{
var canonicalJson = CanonicalJsonSerializer.Serialize(advisory);
var input = $"statement:{vulnerabilityKey}:{advisory.AdvisoryKey}:{canonicalJson}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input));
return new Guid(hashBytes[..16]);
}
private static Guid ComputeDeterministicConflictId(string vulnerabilityKey, string conflictHash)
{
var input = $"conflict:{vulnerabilityKey}:{conflictHash}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input));
return new Guid(hashBytes[..16]);
}
}
public sealed record AdvisoryMergeResult(

11
src/Concelier/__Libraries/StellaOps.Concelier.Merge/Services/MergeEventWriter.cs
View File

@@ -2,6 +2,7 @@ namespace StellaOps.Concelier.Merge.Services;
using System.Security.Cryptography;
using System.Linq;
using System.Text;
using Microsoft.Extensions.Logging;
using StellaOps.Concelier.Merge.Backport;
using StellaOps.Concelier.Models;
@@ -69,9 +70,10 @@ public sealed class MergeEventWriter
// Convert backport evidence to audit decisions
var evidenceDecisions = ConvertToAuditDecisions(backportEvidence);
var eventId = ComputeDeterministicEventId(advisoryKey, afterHash, timestamp);
var record = new MergeEventRecord(
Guid.NewGuid(),
eventId,
advisoryKey,
beforeHash,
afterHash,
@@ -123,4 +125,11 @@ public sealed class MergeEventWriter
e.ProofId,
e.EvidenceDate)).ToArray();
}
private static Guid ComputeDeterministicEventId(string advisoryKey, byte[] afterHash, DateTimeOffset timestamp)
{
var input = $"merge-event:{advisoryKey}:{Convert.ToHexString(afterHash)}:{timestamp:O}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input));
return new Guid(hashBytes[..16]);
}
}

2
src/Concelier/__Libraries/StellaOps.Concelier.Merge/StellaOps.Concelier.Merge.csproj
View File

@@ -5,6 +5,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>
@@ -18,5 +19,6 @@
<ProjectReference Include="../../../Router/__Libraries/StellaOps.Messaging/StellaOps.Messaging.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Provcache/StellaOps.Provcache.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.VersionComparison/StellaOps.VersionComparison.csproj" />
<ProjectReference Include="../../../__Libraries/StellaOps.Cryptography/StellaOps.Cryptography.csproj" />
</ItemGroup>
</Project>

2
src/Concelier/__Libraries/StellaOps.Concelier.Models/StellaOps.Concelier.Models.csproj
View File

@@ -4,7 +4,7 @@
<LangVersion>preview</LangVersion>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
<EnableDefaultCompileItems>false</EnableDefaultCompileItems>
</PropertyGroup>
<ItemGroup>

1
src/Concelier/__Libraries/StellaOps.Concelier.Normalization/StellaOps.Concelier.Normalization.csproj
View File

@@ -5,6 +5,7 @@
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

4
src/Concelier/__Libraries/StellaOps.Concelier.Persistence/Postgres/Repositories/AdvisoryRepository.cs
View File

@@ -271,8 +271,8 @@ public sealed class AdvisoryRepository : RepositoryBase<ConcelierDataSource>, IA
severity, published_at, modified_at, withdrawn_at, provenance::text, raw_Payload::text,
created_at, updated_at
FROM vuln.advisories
WHERE modified_at > @since
ORDER BY modified_at, id
WHERE COALESCE(modified_at, published_at, created_at) > @since
ORDER BY COALESCE(modified_at, published_at, created_at), id
LIMIT @limit
""";

2
src/Concelier/__Libraries/StellaOps.Concelier.Persistence/StellaOps.Concelier.Persistence.csproj
View File

@@ -6,7 +6,7 @@
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<LangVersion>preview</LangVersion>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
<RootNamespace>StellaOps.Concelier.Persistence</RootNamespace>
<AssemblyName>StellaOps.Concelier.Persistence</AssemblyName>
<Description>Consolidated persistence layer for StellaOps Concelier module (EF Core + Raw SQL)</Description>

1
src/Concelier/__Libraries/StellaOps.Concelier.ProofService.Postgres/StellaOps.Concelier.ProofService.Postgres.csproj
View File

@@ -4,6 +4,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

1
src/Concelier/__Libraries/StellaOps.Concelier.ProofService/StellaOps.Concelier.ProofService.csproj
View File

@@ -4,6 +4,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>

2
src/Concelier/__Libraries/StellaOps.Concelier.RawModels/StellaOps.Concelier.RawModels.csproj
View File

@@ -4,6 +4,6 @@
<LangVersion>preview</LangVersion>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
</Project>

26
src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/Matching/SbomAdvisoryMatcher.cs
View File

@@ -6,6 +6,8 @@
// -----------------------------------------------------------------------------
using System.Collections.Concurrent;
using System.Security.Cryptography;
using System.Text;
using Microsoft.Extensions.Logging;
using StellaOps.Concelier.Core.Canonical;
using StellaOps.Concelier.SbomIntegration.Models;
@@ -132,7 +134,7 @@ public sealed class SbomAdvisoryMatcher : ISbomAdvisoryMatcher
return new SbomAdvisoryMatch
{
Id = Guid.NewGuid(),
Id = ComputeDeterministicMatchId(string.Empty, purl, canonicalId),
SbomId = Guid.Empty, // Not applicable for single check
SbomDigest = string.Empty,
CanonicalId = canonicalId,
@@ -168,7 +170,7 @@ public sealed class SbomAdvisoryMatcher : ISbomAdvisoryMatcher
return advisories.Select(advisory => new SbomAdvisoryMatch
{
Id = Guid.NewGuid(),
Id = ComputeDeterministicMatchId(sbomDigest, purl, advisory.Id),
SbomId = sbomId,
SbomDigest = sbomDigest,
CanonicalId = advisory.Id,
@@ -267,4 +269,24 @@ public sealed class SbomAdvisoryMatcher : ISbomAdvisoryMatcher
return normalized;
}
/// <summary>
/// Computes a deterministic match ID from SBOM digest, PURL, and canonical advisory ID.
/// </summary>
private static Guid ComputeDeterministicMatchId(string sbomDigest, string purl, Guid canonicalId)
{
var input = $"SBOM_MATCH:{sbomDigest}:{purl}:{canonicalId}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input))[..16];
return new Guid(hashBytes);
}
/// <summary>
/// Computes a deterministic match ID from SBOM digest, PURL, and canonical advisory ID string.
/// </summary>
private static Guid ComputeDeterministicMatchId(string sbomDigest, string purl, string canonicalIdStr)
{
var input = $"SBOM_MATCH:{sbomDigest}:{purl}:{canonicalIdStr}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input))[..16];
return new Guid(hashBytes);
}
}

26
src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/SbomAdvisoryMatcher.cs
View File

@@ -6,6 +6,8 @@
// -----------------------------------------------------------------------------
using System.Collections.Concurrent;
using System.Security.Cryptography;
using System.Text;
using Microsoft.Extensions.Logging;
using StellaOps.Concelier.Core.Canonical;
using StellaOps.Concelier.SbomIntegration.Models;
@@ -132,7 +134,7 @@ public sealed class SbomAdvisoryMatcher : ISbomAdvisoryMatcher
return new SbomAdvisoryMatch
{
Id = Guid.NewGuid(),
Id = ComputeDeterministicMatchId(string.Empty, purl, canonicalId),
SbomId = Guid.Empty, // Not applicable for single check
SbomDigest = string.Empty,
CanonicalId = canonicalId,
@@ -168,7 +170,7 @@ public sealed class SbomAdvisoryMatcher : ISbomAdvisoryMatcher
return advisories.Select(advisory => new SbomAdvisoryMatch
{
Id = Guid.NewGuid(),
Id = ComputeDeterministicMatchId(sbomDigest, purl, advisory.Id),
SbomId = sbomId,
SbomDigest = sbomDigest,
CanonicalId = advisory.Id,
@@ -267,4 +269,24 @@ public sealed class SbomAdvisoryMatcher : ISbomAdvisoryMatcher
return normalized;
}
/// <summary>
/// Computes a deterministic match ID from SBOM digest, PURL, and canonical advisory ID.
/// </summary>
private static Guid ComputeDeterministicMatchId(string sbomDigest, string purl, Guid canonicalId)
{
var input = $"SBOM_MATCH:{sbomDigest}:{purl}:{canonicalId}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input))[..16];
return new Guid(hashBytes);
}
/// <summary>
/// Computes a deterministic match ID from SBOM digest, PURL, and canonical advisory ID string.
/// </summary>
private static Guid ComputeDeterministicMatchId(string sbomDigest, string purl, string canonicalIdStr)
{
var input = $"SBOM_MATCH:{sbomDigest}:{purl}:{canonicalIdStr}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input))[..16];
return new Guid(hashBytes);
}
}

14
src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/SbomRegistryService.cs
View File

@@ -6,6 +6,8 @@
// -----------------------------------------------------------------------------
using System.Diagnostics;
using System.Security.Cryptography;
using System.Text;
using Microsoft.Extensions.Logging;
using StellaOps.Concelier.Interest;
using StellaOps.Concelier.SbomIntegration.Events;
@@ -62,7 +64,7 @@ public sealed class SbomRegistryService : ISbomRegistryService
var registration = new SbomRegistration
{
Id = Guid.NewGuid(),
Id = ComputeDeterministicRegistrationId(input.Digest, input.TenantId),
Digest = input.Digest,
Format = input.Format,
SpecVersion = input.SpecVersion,
@@ -526,4 +528,14 @@ public sealed class SbomRegistryService : ISbomRegistryService
}
#endregion
/// <summary>
/// Computes a deterministic registration ID from SBOM digest and tenant.
/// </summary>
private static Guid ComputeDeterministicRegistrationId(string digest, string tenantId)
{
var input = $"SBOM_REG:{tenantId}:{digest}";
var hashBytes = SHA256.HashData(Encoding.UTF8.GetBytes(input))[..16];
return new Guid(hashBytes);
}
}

2
src/Concelier/__Libraries/StellaOps.Concelier.SbomIntegration/StellaOps.Concelier.SbomIntegration.csproj
View File

@@ -6,7 +6,7 @@
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<LangVersion>preview</LangVersion>
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
<RootNamespace>StellaOps.Concelier.SbomIntegration</RootNamespace>
<AssemblyName>StellaOps.Concelier.SbomIntegration</AssemblyName>
<Description>SBOM integration for Concelier advisory matching and interest scoring</Description>

1
src/Concelier/__Libraries/StellaOps.Concelier.SourceIntel/StellaOps.Concelier.SourceIntel.csproj
View File

@@ -4,6 +4,7 @@
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>
<Nullable>enable</Nullable>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>
<ItemGroup>