feat(cli): Implement crypto plugin CLI architecture with regional compliance
Sprint: SPRINT_4100_0006_0001 Status: COMPLETED Implemented plugin-based crypto command architecture for regional compliance with build-time distribution selection (GOST/eIDAS/SM) and runtime validation. ## New Commands - `stella crypto sign` - Sign artifacts with regional crypto providers - `stella crypto verify` - Verify signatures with trust policy support - `stella crypto profiles` - List available crypto providers & capabilities ## Build-Time Distribution Selection ```bash # International (default - BouncyCastle) dotnet build src/Cli/StellaOps.Cli/StellaOps.Cli.csproj # Russia distribution (GOST R 34.10-2012) dotnet build -p:StellaOpsEnableGOST=true # EU distribution (eIDAS Regulation 910/2014) dotnet build -p:StellaOpsEnableEIDAS=true # China distribution (SM2/SM3/SM4) dotnet build -p:StellaOpsEnableSM=true ``` ## Key Features - Build-time conditional compilation prevents export control violations - Runtime crypto profile validation on CLI startup - 8 predefined profiles (international, russia-prod/dev, eu-prod/dev, china-prod/dev) - Comprehensive configuration with environment variable substitution - Integration tests with distribution-specific assertions - Full migration path from deprecated `cryptoru` CLI ## Files Added - src/Cli/StellaOps.Cli/Commands/CryptoCommandGroup.cs - src/Cli/StellaOps.Cli/Commands/CommandHandlers.Crypto.cs - src/Cli/StellaOps.Cli/Services/CryptoProfileValidator.cs - src/Cli/StellaOps.Cli/appsettings.crypto.yaml.example - src/Cli/__Tests/StellaOps.Cli.Tests/CryptoCommandTests.cs - docs/cli/crypto-commands.md - docs/implplan/SPRINT_4100_0006_0001_COMPLETION_SUMMARY.md ## Files Modified - src/Cli/StellaOps.Cli/StellaOps.Cli.csproj (conditional plugin refs) - src/Cli/StellaOps.Cli/Program.cs (plugin registration + validation) - src/Cli/StellaOps.Cli/Commands/CommandFactory.cs (command wiring) - src/Scanner/__Libraries/StellaOps.Scanner.Core/Configuration/PoEConfiguration.cs (fix) ## Compliance - GOST (Russia): GOST R 34.10-2012, FSB certified - eIDAS (EU): Regulation (EU) No 910/2014, QES/AES/AdES - SM (China): GM/T 0003-2012 (SM2), OSCCA certified ## Migration `cryptoru` CLI deprecated → sunset date: 2025-07-01 - `cryptoru providers` → `stella crypto profiles` - `cryptoru sign` → `stella crypto sign` ## Testing ✅ All crypto code compiles successfully ✅ Integration tests pass ✅ Build verification for all distributions (international/GOST/eIDAS/SM) Next: SPRINT_4100_0006_0002 (eIDAS plugin implementation) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
master
@@ -0,0 +1,216 @@
|
||||
// Copyright (c) StellaOps. Licensed under AGPL-3.0-or-later.
|
||||
|
||||
using System.Security.Cryptography;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using Moq;
|
||||
using StellaOps.Attestor;
|
||||
using StellaOps.Scanner.Core.Configuration;
|
||||
using StellaOps.Scanner.Reachability;
|
||||
using StellaOps.Scanner.Reachability.Models;
|
||||
using StellaOps.Scanner.Worker.Orchestration;
|
||||
using StellaOps.Signals.Storage;
|
||||
using Xunit;
|
||||
|
||||
namespace StellaOps.Scanner.Integration.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// Integration tests for end-to-end PoE generation pipeline.
|
||||
/// Tests the full workflow from scan → subgraph extraction → PoE generation → storage.
|
||||
/// </summary>
|
||||
public class PoEPipelineTests : IDisposable
|
||||
{
|
||||
private readonly string _tempCasRoot;
|
||||
private readonly Mock<IReachabilityResolver> _resolverMock;
|
||||
private readonly Mock<IProofEmitter> _emitterMock;
|
||||
private readonly PoECasStore _casStore;
|
||||
private readonly PoEOrchestrator _orchestrator;
|
||||
|
||||
public PoEPipelineTests()
|
||||
{
|
||||
_tempCasRoot = Path.Combine(Path.GetTempPath(), $"poe-test-{Guid.NewGuid()}");
|
||||
Directory.CreateDirectory(_tempCasRoot);
|
||||
|
||||
_resolverMock = new Mock<IReachabilityResolver>();
|
||||
_emitterMock = new Mock<IProofEmitter>();
|
||||
_casStore = new PoECasStore(_tempCasRoot, NullLogger<PoECasStore>.Instance);
|
||||
_orchestrator = new PoEOrchestrator(
|
||||
_resolverMock.Object,
|
||||
_emitterMock.Object,
|
||||
_casStore,
|
||||
NullLogger<PoEOrchestrator>.Instance
|
||||
);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ScanWithVulnerability_GeneratesPoE_StoresInCas()
|
||||
{
|
||||
// Arrange
|
||||
var context = CreateScanContext();
|
||||
var vulnerabilities = new List<VulnerabilityMatch>
|
||||
{
|
||||
new VulnerabilityMatch(
|
||||
VulnId: "CVE-2021-44228",
|
||||
ComponentRef: "pkg:maven/log4j@2.14.1",
|
||||
IsReachable: true,
|
||||
Severity: "Critical")
|
||||
};
|
||||
|
||||
var subgraph = CreateTestSubgraph("CVE-2021-44228", "pkg:maven/log4j@2.14.1");
|
||||
var poeBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"poe\"}");
|
||||
var dsseBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"dsse\"}");
|
||||
var poeHash = "blake3:abc123";
|
||||
|
||||
_resolverMock
|
||||
.Setup(x => x.ResolveBatchAsync(It.IsAny<IReadOnlyList<ReachabilityResolutionRequest>>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new Dictionary<string, Subgraph?> { ["CVE-2021-44228"] = subgraph });
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.EmitPoEAsync(It.IsAny<Subgraph>(), It.IsAny<ProofMetadata>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(poeBytes);
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.ComputePoEHash(poeBytes))
|
||||
.Returns(poeHash);
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.SignPoEAsync(poeBytes, It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(dsseBytes);
|
||||
|
||||
var configuration = PoEConfiguration.Enabled;
|
||||
|
||||
// Act
|
||||
var results = await _orchestrator.GeneratePoEArtifactsAsync(
|
||||
context,
|
||||
vulnerabilities,
|
||||
configuration);
|
||||
|
||||
// Assert
|
||||
Assert.Single(results);
|
||||
var result = results[0];
|
||||
|
||||
Assert.Equal("CVE-2021-44228", result.VulnId);
|
||||
Assert.Equal(poeHash, result.PoeHash);
|
||||
|
||||
// Verify stored in CAS
|
||||
var artifact = await _casStore.FetchAsync(poeHash);
|
||||
Assert.NotNull(artifact);
|
||||
Assert.Equal(poeBytes, artifact.PoeBytes);
|
||||
Assert.Equal(dsseBytes, artifact.DsseBytes);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ScanWithUnreachableVuln_DoesNotGeneratePoE()
|
||||
{
|
||||
// Arrange
|
||||
var context = CreateScanContext();
|
||||
var vulnerabilities = new List<VulnerabilityMatch>
|
||||
{
|
||||
new VulnerabilityMatch(
|
||||
VulnId: "CVE-9999-99999",
|
||||
ComponentRef: "pkg:maven/safe-lib@1.0.0",
|
||||
IsReachable: false,
|
||||
Severity: "High")
|
||||
};
|
||||
|
||||
var configuration = new PoEConfiguration { Enabled = true, EmitOnlyReachable = true };
|
||||
|
||||
// Act
|
||||
var results = await _orchestrator.GeneratePoEArtifactsAsync(
|
||||
context,
|
||||
vulnerabilities,
|
||||
configuration);
|
||||
|
||||
// Assert
|
||||
Assert.Empty(results);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task PoEGeneration_ProducesDeterministicHash()
|
||||
{
|
||||
// Arrange
|
||||
var poeJson = await File.ReadAllTextAsync(
|
||||
"../../../../tests/Reachability/PoE/Fixtures/log4j-cve-2021-44228.poe.golden.json");
|
||||
var poeBytes = System.Text.Encoding.UTF8.GetBytes(poeJson);
|
||||
|
||||
// Act - Compute hash twice
|
||||
var hash1 = ComputeBlake3Hash(poeBytes);
|
||||
var hash2 = ComputeBlake3Hash(poeBytes);
|
||||
|
||||
// Assert
|
||||
Assert.Equal(hash1, hash2);
|
||||
Assert.StartsWith("blake3:", hash1);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task PoEStorage_PersistsToCas_RetrievesCorrectly()
|
||||
{
|
||||
// Arrange
|
||||
var poeBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"poe\"}");
|
||||
var dsseBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"dsse\"}");
|
||||
|
||||
// Act - Store
|
||||
var poeHash = await _casStore.StoreAsync(poeBytes, dsseBytes);
|
||||
|
||||
// Act - Retrieve
|
||||
var artifact = await _casStore.FetchAsync(poeHash);
|
||||
|
||||
// Assert
|
||||
Assert.NotNull(artifact);
|
||||
Assert.Equal(poeHash, artifact.PoeHash);
|
||||
Assert.Equal(poeBytes, artifact.PoeBytes);
|
||||
Assert.Equal(dsseBytes, artifact.DsseBytes);
|
||||
}
|
||||
|
||||
private ScanContext CreateScanContext()
|
||||
{
|
||||
return new ScanContext(
|
||||
ScanId: "scan-test-123",
|
||||
GraphHash: "blake3:graph123",
|
||||
BuildId: "gnu-build-id:build123",
|
||||
ImageDigest: "sha256:image123",
|
||||
PolicyId: "test-policy-v1",
|
||||
PolicyDigest: "sha256:policy123",
|
||||
ScannerVersion: "1.0.0-test",
|
||||
ConfigPath: "etc/scanner.yaml"
|
||||
);
|
||||
}
|
||||
|
||||
private Subgraph CreateTestSubgraph(string vulnId, string componentRef)
|
||||
{
|
||||
return new Subgraph(
|
||||
BuildId: "gnu-build-id:test",
|
||||
ComponentRef: componentRef,
|
||||
VulnId: vulnId,
|
||||
Nodes: new List<FunctionId>
|
||||
{
|
||||
new FunctionId("sha256:mod1", "main", "0x401000", null, null),
|
||||
new FunctionId("sha256:mod2", "vulnerable", "0x402000", null, null)
|
||||
},
|
||||
Edges: new List<Edge>
|
||||
{
|
||||
new Edge("main", "vulnerable", Array.Empty<string>(), 0.95)
|
||||
},
|
||||
EntryRefs: new[] { "main" },
|
||||
SinkRefs: new[] { "vulnerable" },
|
||||
PolicyDigest: "sha256:policy123",
|
||||
ToolchainDigest: "sha256:tool123"
|
||||
);
|
||||
}
|
||||
|
||||
private string ComputeBlake3Hash(byte[] data)
|
||||
{
|
||||
// Using SHA256 as BLAKE3 placeholder
|
||||
using var sha = SHA256.Create();
|
||||
var hashBytes = sha.ComputeHash(data);
|
||||
var hashHex = Convert.ToHexString(hashBytes).ToLowerInvariant();
|
||||
return $"blake3:{hashHex}";
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
if (Directory.Exists(_tempCasRoot))
|
||||
{
|
||||
Directory.Delete(_tempCasRoot, recursive: true);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,338 @@
|
||||
// Copyright (c) StellaOps. Licensed under AGPL-3.0-or-later.
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using System.Threading;
|
||||
using System.Threading.Tasks;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using Microsoft.Extensions.Options;
|
||||
using Moq;
|
||||
using StellaOps.Attestor;
|
||||
using StellaOps.Scanner.Core.Configuration;
|
||||
using StellaOps.Scanner.Core.Contracts;
|
||||
using StellaOps.Scanner.Reachability;
|
||||
using StellaOps.Scanner.Reachability.Models;
|
||||
using StellaOps.Scanner.Worker.Orchestration;
|
||||
using StellaOps.Scanner.Worker.Processing;
|
||||
using StellaOps.Scanner.Worker.Processing.PoE;
|
||||
using StellaOps.Signals.Storage;
|
||||
using Xunit;
|
||||
|
||||
namespace StellaOps.Scanner.Worker.Tests.PoE;
|
||||
|
||||
public class PoEGenerationStageExecutorTests : IDisposable
|
||||
{
|
||||
private readonly string _tempCasRoot;
|
||||
private readonly Mock<IReachabilityResolver> _resolverMock;
|
||||
private readonly Mock<IProofEmitter> _emitterMock;
|
||||
private readonly PoECasStore _casStore;
|
||||
private readonly PoEOrchestrator _orchestrator;
|
||||
private readonly Mock<IOptionsMonitor<PoEConfiguration>> _configMonitorMock;
|
||||
private readonly PoEGenerationStageExecutor _executor;
|
||||
|
||||
public PoEGenerationStageExecutorTests()
|
||||
{
|
||||
_tempCasRoot = Path.Combine(Path.GetTempPath(), $"poe-stage-test-{Guid.NewGuid()}");
|
||||
Directory.CreateDirectory(_tempCasRoot);
|
||||
|
||||
_resolverMock = new Mock<IReachabilityResolver>();
|
||||
_emitterMock = new Mock<IProofEmitter>();
|
||||
_casStore = new PoECasStore(_tempCasRoot, NullLogger<PoECasStore>.Instance);
|
||||
_orchestrator = new PoEOrchestrator(
|
||||
_resolverMock.Object,
|
||||
_emitterMock.Object,
|
||||
_casStore,
|
||||
NullLogger<PoEOrchestrator>.Instance
|
||||
);
|
||||
|
||||
_configMonitorMock = new Mock<IOptionsMonitor<PoEConfiguration>>();
|
||||
_configMonitorMock.Setup(m => m.CurrentValue).Returns(PoEConfiguration.Enabled);
|
||||
|
||||
_executor = new PoEGenerationStageExecutor(
|
||||
_orchestrator,
|
||||
_configMonitorMock.Object,
|
||||
NullLogger<PoEGenerationStageExecutor>.Instance
|
||||
);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void StageName_ShouldBeGeneratePoE()
|
||||
{
|
||||
Assert.Equal(ScanStageNames.GeneratePoE, _executor.StageName);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExecuteAsync_WhenDisabled_ShouldSkipGeneration()
|
||||
{
|
||||
// Arrange
|
||||
var config = new PoEConfiguration { Enabled = false };
|
||||
_configMonitorMock.Setup(m => m.CurrentValue).Returns(config);
|
||||
|
||||
var context = CreateScanContext();
|
||||
|
||||
// Act
|
||||
await _executor.ExecuteAsync(context, CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
Assert.False(context.Analysis.TryGet<IReadOnlyList<PoEResult>>(ScanAnalysisKeys.PoEResults, out _));
|
||||
_resolverMock.Verify(r => r.ResolveBatchAsync(It.IsAny<IReadOnlyList<ReachabilityResolutionRequest>>(), It.IsAny<CancellationToken>()), Times.Never);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExecuteAsync_NoVulnerabilities_ShouldSkipGeneration()
|
||||
{
|
||||
// Arrange
|
||||
var context = CreateScanContext();
|
||||
// No vulnerabilities in analysis store
|
||||
|
||||
// Act
|
||||
await _executor.ExecuteAsync(context, CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
Assert.False(context.Analysis.TryGet<IReadOnlyList<PoEResult>>(ScanAnalysisKeys.PoEResults, out _));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExecuteAsync_WithReachableVulnerability_ShouldGeneratePoE()
|
||||
{
|
||||
// Arrange
|
||||
var context = CreateScanContext();
|
||||
var vulnerabilities = new List<VulnerabilityMatch>
|
||||
{
|
||||
new VulnerabilityMatch(
|
||||
VulnId: "CVE-2021-44228",
|
||||
ComponentRef: "pkg:maven/log4j@2.14.1",
|
||||
IsReachable: true,
|
||||
Severity: "Critical")
|
||||
};
|
||||
context.Analysis.Set(ScanAnalysisKeys.VulnerabilityMatches, vulnerabilities);
|
||||
|
||||
var subgraph = CreateTestSubgraph("CVE-2021-44228", "pkg:maven/log4j@2.14.1");
|
||||
var poeBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"poe\"}");
|
||||
var dsseBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"dsse\"}");
|
||||
var poeHash = "blake3:abc123";
|
||||
|
||||
_resolverMock
|
||||
.Setup(x => x.ResolveBatchAsync(It.IsAny<IReadOnlyList<ReachabilityResolutionRequest>>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new Dictionary<string, Subgraph?> { ["CVE-2021-44228"] = subgraph });
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.EmitPoEAsync(It.IsAny<Subgraph>(), It.IsAny<ProofMetadata>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(poeBytes);
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.ComputePoEHash(poeBytes))
|
||||
.Returns(poeHash);
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.SignPoEAsync(poeBytes, It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(dsseBytes);
|
||||
|
||||
// Act
|
||||
await _executor.ExecuteAsync(context, CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
Assert.True(context.Analysis.TryGet<IReadOnlyList<PoEResult>>(ScanAnalysisKeys.PoEResults, out var results));
|
||||
Assert.Single(results!);
|
||||
Assert.Equal("CVE-2021-44228", results[0].VulnId);
|
||||
Assert.Equal(poeHash, results[0].PoeHash);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExecuteAsync_EmitOnlyReachable_ShouldFilterUnreachableVulnerabilities()
|
||||
{
|
||||
// Arrange
|
||||
var config = new PoEConfiguration { Enabled = true, EmitOnlyReachable = true };
|
||||
_configMonitorMock.Setup(m => m.CurrentValue).Returns(config);
|
||||
|
||||
var context = CreateScanContext();
|
||||
var vulnerabilities = new List<VulnerabilityMatch>
|
||||
{
|
||||
new VulnerabilityMatch(
|
||||
VulnId: "CVE-2021-44228",
|
||||
ComponentRef: "pkg:maven/log4j@2.14.1",
|
||||
IsReachable: true,
|
||||
Severity: "Critical"),
|
||||
new VulnerabilityMatch(
|
||||
VulnId: "CVE-9999-99999",
|
||||
ComponentRef: "pkg:maven/safe-lib@1.0.0",
|
||||
IsReachable: false,
|
||||
Severity: "High")
|
||||
};
|
||||
context.Analysis.Set(ScanAnalysisKeys.VulnerabilityMatches, vulnerabilities);
|
||||
|
||||
var subgraph = CreateTestSubgraph("CVE-2021-44228", "pkg:maven/log4j@2.14.1");
|
||||
var poeBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"poe\"}");
|
||||
var dsseBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"dsse\"}");
|
||||
var poeHash = "blake3:abc123";
|
||||
|
||||
_resolverMock
|
||||
.Setup(x => x.ResolveBatchAsync(It.Is<IReadOnlyList<ReachabilityResolutionRequest>>(r => r.Count == 1), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new Dictionary<string, Subgraph?> { ["CVE-2021-44228"] = subgraph });
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.EmitPoEAsync(It.IsAny<Subgraph>(), It.IsAny<ProofMetadata>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(poeBytes);
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.ComputePoEHash(poeBytes))
|
||||
.Returns(poeHash);
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.SignPoEAsync(poeBytes, It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(dsseBytes);
|
||||
|
||||
// Act
|
||||
await _executor.ExecuteAsync(context, CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
Assert.True(context.Analysis.TryGet<IReadOnlyList<PoEResult>>(ScanAnalysisKeys.PoEResults, out var results));
|
||||
Assert.Single(results!);
|
||||
Assert.Equal("CVE-2021-44228", results[0].VulnId);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExecuteAsync_MultipleVulnerabilities_ShouldGenerateMultiplePoEs()
|
||||
{
|
||||
// Arrange
|
||||
var context = CreateScanContext();
|
||||
var vulnerabilities = new List<VulnerabilityMatch>
|
||||
{
|
||||
new VulnerabilityMatch(
|
||||
VulnId: "CVE-2021-44228",
|
||||
ComponentRef: "pkg:maven/log4j@2.14.1",
|
||||
IsReachable: true,
|
||||
Severity: "Critical"),
|
||||
new VulnerabilityMatch(
|
||||
VulnId: "CVE-2023-12345",
|
||||
ComponentRef: "pkg:maven/vulnerable-lib@1.0.0",
|
||||
IsReachable: true,
|
||||
Severity: "High")
|
||||
};
|
||||
context.Analysis.Set(ScanAnalysisKeys.VulnerabilityMatches, vulnerabilities);
|
||||
|
||||
var subgraph1 = CreateTestSubgraph("CVE-2021-44228", "pkg:maven/log4j@2.14.1");
|
||||
var subgraph2 = CreateTestSubgraph("CVE-2023-12345", "pkg:maven/vulnerable-lib@1.0.0");
|
||||
var poeBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"poe\"}");
|
||||
var dsseBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"dsse\"}");
|
||||
|
||||
_resolverMock
|
||||
.Setup(x => x.ResolveBatchAsync(It.IsAny<IReadOnlyList<ReachabilityResolutionRequest>>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new Dictionary<string, Subgraph?>
|
||||
{
|
||||
["CVE-2021-44228"] = subgraph1,
|
||||
["CVE-2023-12345"] = subgraph2
|
||||
});
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.EmitPoEAsync(It.IsAny<Subgraph>(), It.IsAny<ProofMetadata>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(poeBytes);
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.ComputePoEHash(poeBytes))
|
||||
.Returns((byte[] data) => $"blake3:{Guid.NewGuid():N}");
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.SignPoEAsync(poeBytes, It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(dsseBytes);
|
||||
|
||||
// Act
|
||||
await _executor.ExecuteAsync(context, CancellationToken.None);
|
||||
|
||||
// Assert
|
||||
Assert.True(context.Analysis.TryGet<IReadOnlyList<PoEResult>>(ScanAnalysisKeys.PoEResults, out var results));
|
||||
Assert.Equal(2, results!.Count);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ExecuteAsync_ConfigurationInAnalysisStore_ShouldUseStoredConfiguration()
|
||||
{
|
||||
// Arrange
|
||||
var storedConfig = new PoEConfiguration { Enabled = true, EmitOnlyReachable = false };
|
||||
var context = CreateScanContext();
|
||||
context.Analysis.Set(ScanAnalysisKeys.PoEConfiguration, storedConfig);
|
||||
|
||||
var vulnerabilities = new List<VulnerabilityMatch>
|
||||
{
|
||||
new VulnerabilityMatch(
|
||||
VulnId: "CVE-2021-44228",
|
||||
ComponentRef: "pkg:maven/log4j@2.14.1",
|
||||
IsReachable: false,
|
||||
Severity: "Critical")
|
||||
};
|
||||
context.Analysis.Set(ScanAnalysisKeys.VulnerabilityMatches, vulnerabilities);
|
||||
|
||||
var subgraph = CreateTestSubgraph("CVE-2021-44228", "pkg:maven/log4j@2.14.1");
|
||||
var poeBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"poe\"}");
|
||||
var dsseBytes = System.Text.Encoding.UTF8.GetBytes("{\"test\":\"dsse\"}");
|
||||
var poeHash = "blake3:abc123";
|
||||
|
||||
_resolverMock
|
||||
.Setup(x => x.ResolveBatchAsync(It.IsAny<IReadOnlyList<ReachabilityResolutionRequest>>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(new Dictionary<string, Subgraph?> { ["CVE-2021-44228"] = subgraph });
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.EmitPoEAsync(It.IsAny<Subgraph>(), It.IsAny<ProofMetadata>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(poeBytes);
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.ComputePoEHash(poeBytes))
|
||||
.Returns(poeHash);
|
||||
|
||||
_emitterMock
|
||||
.Setup(x => x.SignPoEAsync(poeBytes, It.IsAny<string>(), It.IsAny<CancellationToken>()))
|
||||
.ReturnsAsync(dsseBytes);
|
||||
|
||||
// Act
|
||||
await _executor.ExecuteAsync(context, CancellationToken.None);
|
||||
|
||||
// Assert - should generate PoE even for unreachable because EmitOnlyReachable = false
|
||||
Assert.True(context.Analysis.TryGet<IReadOnlyList<PoEResult>>(ScanAnalysisKeys.PoEResults, out var results));
|
||||
Assert.Single(results!);
|
||||
}
|
||||
|
||||
private ScanJobContext CreateScanContext()
|
||||
{
|
||||
var leaseMock = new Mock<IScanJobLease>();
|
||||
leaseMock.Setup(l => l.JobId).Returns("job-123");
|
||||
leaseMock.Setup(l => l.ScanId).Returns("scan-abc123");
|
||||
|
||||
return new ScanJobContext(
|
||||
leaseMock.Object,
|
||||
TimeProvider.System,
|
||||
DateTimeOffset.UtcNow,
|
||||
CancellationToken.None
|
||||
);
|
||||
}
|
||||
|
||||
private Subgraph CreateTestSubgraph(string vulnId, string componentRef)
|
||||
{
|
||||
return new Subgraph(
|
||||
BuildId: "gnu-build-id:test",
|
||||
ComponentRef: componentRef,
|
||||
VulnId: vulnId,
|
||||
Nodes: new List<FunctionId>
|
||||
{
|
||||
new FunctionId("sha256:mod1", "main", "0x401000", null, null),
|
||||
new FunctionId("sha256:mod2", "vulnerable", "0x402000", null, null)
|
||||
},
|
||||
Edges: new List<Edge>
|
||||
{
|
||||
new Edge("main", "vulnerable", Array.Empty<string>(), 0.95)
|
||||
},
|
||||
EntryRefs: new[] { "main" },
|
||||
SinkRefs: new[] { "vulnerable" },
|
||||
PolicyDigest: "sha256:policy123",
|
||||
ToolchainDigest: "sha256:tool123"
|
||||
);
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
if (Directory.Exists(_tempCasRoot))
|
||||
{
|
||||
Directory.Delete(_tempCasRoot, recursive: true);
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user