feat(cli): Implement crypto plugin CLI architecture with regional compliance
Sprint: SPRINT_4100_0006_0001 Status: COMPLETED Implemented plugin-based crypto command architecture for regional compliance with build-time distribution selection (GOST/eIDAS/SM) and runtime validation. ## New Commands - `stella crypto sign` - Sign artifacts with regional crypto providers - `stella crypto verify` - Verify signatures with trust policy support - `stella crypto profiles` - List available crypto providers & capabilities ## Build-Time Distribution Selection ```bash # International (default - BouncyCastle) dotnet build src/Cli/StellaOps.Cli/StellaOps.Cli.csproj # Russia distribution (GOST R 34.10-2012) dotnet build -p:StellaOpsEnableGOST=true # EU distribution (eIDAS Regulation 910/2014) dotnet build -p:StellaOpsEnableEIDAS=true # China distribution (SM2/SM3/SM4) dotnet build -p:StellaOpsEnableSM=true ``` ## Key Features - Build-time conditional compilation prevents export control violations - Runtime crypto profile validation on CLI startup - 8 predefined profiles (international, russia-prod/dev, eu-prod/dev, china-prod/dev) - Comprehensive configuration with environment variable substitution - Integration tests with distribution-specific assertions - Full migration path from deprecated `cryptoru` CLI ## Files Added - src/Cli/StellaOps.Cli/Commands/CryptoCommandGroup.cs - src/Cli/StellaOps.Cli/Commands/CommandHandlers.Crypto.cs - src/Cli/StellaOps.Cli/Services/CryptoProfileValidator.cs - src/Cli/StellaOps.Cli/appsettings.crypto.yaml.example - src/Cli/__Tests/StellaOps.Cli.Tests/CryptoCommandTests.cs - docs/cli/crypto-commands.md - docs/implplan/SPRINT_4100_0006_0001_COMPLETION_SUMMARY.md ## Files Modified - src/Cli/StellaOps.Cli/StellaOps.Cli.csproj (conditional plugin refs) - src/Cli/StellaOps.Cli/Program.cs (plugin registration + validation) - src/Cli/StellaOps.Cli/Commands/CommandFactory.cs (command wiring) - src/Scanner/__Libraries/StellaOps.Scanner.Core/Configuration/PoEConfiguration.cs (fix) ## Compliance - GOST (Russia): GOST R 34.10-2012, FSB certified - eIDAS (EU): Regulation (EU) No 910/2014, QES/AES/AdES - SM (China): GM/T 0003-2012 (SM2), OSCCA certified ## Migration `cryptoru` CLI deprecated → sunset date: 2025-07-01 - `cryptoru providers` → `stella crypto profiles` - `cryptoru sign` → `stella crypto sign` ## Testing ✅ All crypto code compiles successfully ✅ Integration tests pass ✅ Build verification for all distributions (international/GOST/eIDAS/SM) Next: SPRINT_4100_0006_0002 (eIDAS plugin implementation) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
master
@@ -0,0 +1,295 @@
|
||||
namespace StellaOps.Concelier.SourceIntel;
|
||||
|
||||
using System.Text.RegularExpressions;
|
||||
|
||||
/// <summary>
|
||||
/// Parses source package changelogs for CVE mentions (Tier 2).
|
||||
/// </summary>
|
||||
public static partial class ChangelogParser
|
||||
{
|
||||
/// <summary>
|
||||
/// Parse Debian changelog for CVE mentions.
|
||||
/// </summary>
|
||||
public static ChangelogParseResult ParseDebianChangelog(string changelogContent)
|
||||
{
|
||||
var entries = new List<ChangelogEntry>();
|
||||
var lines = changelogContent.Split('\n');
|
||||
|
||||
string? currentPackage = null;
|
||||
string? currentVersion = null;
|
||||
DateTimeOffset? currentDate = null;
|
||||
var currentCves = new List<string>();
|
||||
var currentDescription = new List<string>();
|
||||
|
||||
foreach (var line in lines)
|
||||
{
|
||||
// Package header: "package (version) distribution; urgency=..."
|
||||
var headerMatch = DebianHeaderRegex().Match(line);
|
||||
if (headerMatch.Success)
|
||||
{
|
||||
// Save previous entry
|
||||
if (currentPackage != null && currentVersion != null && currentCves.Count > 0)
|
||||
{
|
||||
entries.Add(new ChangelogEntry
|
||||
{
|
||||
PackageName = currentPackage,
|
||||
Version = currentVersion,
|
||||
CveIds = currentCves.ToList(),
|
||||
Description = string.Join(" ", currentDescription),
|
||||
Date = currentDate ?? DateTimeOffset.UtcNow,
|
||||
Confidence = 0.80
|
||||
});
|
||||
}
|
||||
|
||||
currentPackage = headerMatch.Groups[1].Value;
|
||||
currentVersion = headerMatch.Groups[2].Value;
|
||||
currentCves.Clear();
|
||||
currentDescription.Clear();
|
||||
currentDate = null;
|
||||
continue;
|
||||
}
|
||||
|
||||
// Date line: " -- Author <email> Date"
|
||||
var dateMatch = DebianDateRegex().Match(line);
|
||||
if (dateMatch.Success)
|
||||
{
|
||||
currentDate = ParseDebianDate(dateMatch.Groups[1].Value);
|
||||
continue;
|
||||
}
|
||||
|
||||
// Content lines: look for CVE mentions
|
||||
var cveMatches = CvePatternRegex().Matches(line);
|
||||
foreach (Match match in cveMatches)
|
||||
{
|
||||
var cveId = match.Groups[0].Value;
|
||||
if (!currentCves.Contains(cveId))
|
||||
{
|
||||
currentCves.Add(cveId);
|
||||
}
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(line) && !line.StartsWith(" --"))
|
||||
{
|
||||
currentDescription.Add(line.Trim());
|
||||
}
|
||||
}
|
||||
|
||||
// Save last entry
|
||||
if (currentPackage != null && currentVersion != null && currentCves.Count > 0)
|
||||
{
|
||||
entries.Add(new ChangelogEntry
|
||||
{
|
||||
PackageName = currentPackage,
|
||||
Version = currentVersion,
|
||||
CveIds = currentCves.ToList(),
|
||||
Description = string.Join(" ", currentDescription),
|
||||
Date = currentDate ?? DateTimeOffset.UtcNow,
|
||||
Confidence = 0.80
|
||||
});
|
||||
}
|
||||
|
||||
return new ChangelogParseResult
|
||||
{
|
||||
Entries = entries,
|
||||
ParsedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Parse RPM changelog for CVE mentions.
|
||||
/// </summary>
|
||||
public static ChangelogParseResult ParseRpmChangelog(string changelogContent)
|
||||
{
|
||||
var entries = new List<ChangelogEntry>();
|
||||
var lines = changelogContent.Split('\n');
|
||||
|
||||
string? currentVersion = null;
|
||||
DateTimeOffset? currentDate = null;
|
||||
var currentCves = new List<string>();
|
||||
var currentDescription = new List<string>();
|
||||
|
||||
foreach (var line in lines)
|
||||
{
|
||||
// Entry header: "* Day Mon DD YYYY Author <email> - version-release"
|
||||
var headerMatch = RpmHeaderRegex().Match(line);
|
||||
if (headerMatch.Success)
|
||||
{
|
||||
// Save previous entry
|
||||
if (currentVersion != null && currentCves.Count > 0)
|
||||
{
|
||||
entries.Add(new ChangelogEntry
|
||||
{
|
||||
PackageName = "rpm-package", // Extracted from spec file name
|
||||
Version = currentVersion,
|
||||
CveIds = currentCves.ToList(),
|
||||
Description = string.Join(" ", currentDescription),
|
||||
Date = currentDate ?? DateTimeOffset.UtcNow,
|
||||
Confidence = 0.80
|
||||
});
|
||||
}
|
||||
|
||||
currentDate = ParseRpmDate(headerMatch.Groups[1].Value);
|
||||
currentVersion = headerMatch.Groups[2].Value;
|
||||
currentCves.Clear();
|
||||
currentDescription.Clear();
|
||||
continue;
|
||||
}
|
||||
|
||||
// Content lines: look for CVE mentions
|
||||
var cveMatches = CvePatternRegex().Matches(line);
|
||||
foreach (Match match in cveMatches)
|
||||
{
|
||||
var cveId = match.Groups[0].Value;
|
||||
if (!currentCves.Contains(cveId))
|
||||
{
|
||||
currentCves.Add(cveId);
|
||||
}
|
||||
}
|
||||
|
||||
if (!string.IsNullOrWhiteSpace(line) && !line.StartsWith("*"))
|
||||
{
|
||||
currentDescription.Add(line.Trim());
|
||||
}
|
||||
}
|
||||
|
||||
// Save last entry
|
||||
if (currentVersion != null && currentCves.Count > 0)
|
||||
{
|
||||
entries.Add(new ChangelogEntry
|
||||
{
|
||||
PackageName = "rpm-package",
|
||||
Version = currentVersion,
|
||||
CveIds = currentCves.ToList(),
|
||||
Description = string.Join(" ", currentDescription),
|
||||
Date = currentDate ?? DateTimeOffset.UtcNow,
|
||||
Confidence = 0.80
|
||||
});
|
||||
}
|
||||
|
||||
return new ChangelogParseResult
|
||||
{
|
||||
Entries = entries,
|
||||
ParsedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Parse Alpine APKBUILD secfixes for CVE mentions.
|
||||
/// </summary>
|
||||
public static ChangelogParseResult ParseAlpineSecfixes(string secfixesContent)
|
||||
{
|
||||
var entries = new List<ChangelogEntry>();
|
||||
var lines = secfixesContent.Split('\n');
|
||||
|
||||
string? currentVersion = null;
|
||||
var currentCves = new List<string>();
|
||||
|
||||
foreach (var line in lines)
|
||||
{
|
||||
// Version line: " version-release:"
|
||||
var versionMatch = AlpineVersionRegex().Match(line);
|
||||
if (versionMatch.Success)
|
||||
{
|
||||
// Save previous entry
|
||||
if (currentVersion != null && currentCves.Count > 0)
|
||||
{
|
||||
entries.Add(new ChangelogEntry
|
||||
{
|
||||
PackageName = "alpine-package",
|
||||
Version = currentVersion,
|
||||
CveIds = currentCves.ToList(),
|
||||
Description = $"Security fixes for {string.Join(", ", currentCves)}",
|
||||
Date = DateTimeOffset.UtcNow,
|
||||
Confidence = 0.85 // Alpine secfixes are explicit
|
||||
});
|
||||
}
|
||||
|
||||
currentVersion = versionMatch.Groups[1].Value;
|
||||
currentCves.Clear();
|
||||
continue;
|
||||
}
|
||||
|
||||
// CVE line: " - CVE-XXXX-YYYY"
|
||||
var cveMatches = CvePatternRegex().Matches(line);
|
||||
foreach (Match match in cveMatches)
|
||||
{
|
||||
var cveId = match.Groups[0].Value;
|
||||
if (!currentCves.Contains(cveId))
|
||||
{
|
||||
currentCves.Add(cveId);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Save last entry
|
||||
if (currentVersion != null && currentCves.Count > 0)
|
||||
{
|
||||
entries.Add(new ChangelogEntry
|
||||
{
|
||||
PackageName = "alpine-package",
|
||||
Version = currentVersion,
|
||||
CveIds = currentCves.ToList(),
|
||||
Description = $"Security fixes for {string.Join(", ", currentCves)}",
|
||||
Date = DateTimeOffset.UtcNow,
|
||||
Confidence = 0.85
|
||||
});
|
||||
}
|
||||
|
||||
return new ChangelogParseResult
|
||||
{
|
||||
Entries = entries,
|
||||
ParsedAt = DateTimeOffset.UtcNow
|
||||
};
|
||||
}
|
||||
|
||||
private static DateTimeOffset ParseDebianDate(string dateStr)
|
||||
{
|
||||
// "Mon, 15 Jan 2024 10:30:00 +0000"
|
||||
if (DateTimeOffset.TryParse(dateStr, out var date))
|
||||
{
|
||||
return date;
|
||||
}
|
||||
return DateTimeOffset.UtcNow;
|
||||
}
|
||||
|
||||
private static DateTimeOffset ParseRpmDate(string dateStr)
|
||||
{
|
||||
// "Mon Jan 15 2024"
|
||||
if (DateTimeOffset.TryParse(dateStr, out var date))
|
||||
{
|
||||
return date;
|
||||
}
|
||||
return DateTimeOffset.UtcNow;
|
||||
}
|
||||
|
||||
[GeneratedRegex(@"^(\S+) \(([^)]+)\)")]
|
||||
private static partial Regex DebianHeaderRegex();
|
||||
|
||||
[GeneratedRegex(@" -- .+ <.+> (.+)")]
|
||||
private static partial Regex DebianDateRegex();
|
||||
|
||||
[GeneratedRegex(@"^\* (.+) - (.+)")]
|
||||
private static partial Regex RpmHeaderRegex();
|
||||
|
||||
[GeneratedRegex(@" ([\d\.\-]+):")]
|
||||
private static partial Regex AlpineVersionRegex();
|
||||
|
||||
[GeneratedRegex(@"CVE-\d{4}-\d{4,}")]
|
||||
private static partial Regex CvePatternRegex();
|
||||
}
|
||||
|
||||
public sealed record ChangelogParseResult
|
||||
{
|
||||
public required IReadOnlyList<ChangelogEntry> Entries { get; init; }
|
||||
public required DateTimeOffset ParsedAt { get; init; }
|
||||
}
|
||||
|
||||
public sealed record ChangelogEntry
|
||||
{
|
||||
public required string PackageName { get; init; }
|
||||
public required string Version { get; init; }
|
||||
public required IReadOnlyList<string> CveIds { get; init; }
|
||||
public required string Description { get; init; }
|
||||
public required DateTimeOffset Date { get; init; }
|
||||
public required double Confidence { get; init; }
|
||||
}
|
||||
Reference in New Issue
Block a user