stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

save checkpoint

Browse Source
This commit is contained in:
master
2026-02-14 09:11:48 +02:00
parent 9ca2de05df
commit e9aeadc040
1512 changed files with 30863 additions and 4728 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
docs/features/checked/scanner/windows-chocolatey-package-analyzer.md Normal file
View File

@@ -0,0 +1,34 @@
# Windows Chocolatey Package Analyzer
## Module
Scanner
## Status
VERIFIED
## Description
Discovers Chocolatey-installed packages by parsing .nuspec files in the Chocolatey lib directory, producing SBOM components with id, version, license URL, and dependency chains.
## Implementation Details
- **Chocolatey Analyzer Plugin**:
- `src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS.Windows.Chocolatey/ChocolateyAnalyzerPlugin.cs` - `ChocolateyAnalyzerPlugin` discovering Chocolatey-installed packages by parsing .nuspec files in the Chocolatey lib directory, extracting package id, version, license URL, and dependency chains
- **Tests**:
- `src/Scanner/__Tests/StellaOps.Scanner.Analyzers.OS.Windows.Chocolatey.Tests/ChocolateyAnalyzerPluginTests.cs` - Unit tests for Chocolatey package discovery
## E2E Test Plan
- [ ] Scan a Windows container image with Chocolatey packages installed and verify all packages are discovered from the lib directory
- [ ] Verify each discovered package includes correct id, version, and license URL from the .nuspec file
- [ ] Verify dependency chains are resolved from .nuspec dependency elements
- [ ] Verify the analyzer correctly handles packages with no dependencies
- [ ] Verify the analyzer produces valid SBOM components with correct PURLs for Chocolatey packages
---
## Verification
| Check | Result |
|-------|--------|
| Tier 0 - Source files exist | PASS |
| Tier 1 - Build + code review | PASS |
| Tier 2 - Integration tests | PASS |
| Verified | 2026-02-13T18:10:00Z |