Files

StellaOps Bot 35c8f9216f Add tests and implement timeline ingestion options with NATS and Redis subscribers

- Introduced `BinaryReachabilityLifterTests` to validate binary lifting functionality.
- Created `PackRunWorkerOptions` for configuring worker paths and execution persistence.
- Added `TimelineIngestionOptions` for configuring NATS and Redis ingestion transports.
- Implemented `NatsTimelineEventSubscriber` for subscribing to NATS events.
- Developed `RedisTimelineEventSubscriber` for reading from Redis Streams.
- Added `TimelineEnvelopeParser` to normalize incoming event envelopes.
- Created unit tests for `TimelineEnvelopeParser` to ensure correct field mapping.
- Implemented `TimelineAuthorizationAuditSink` for logging authorization outcomes.

2025-12-03 09:46:48 +02:00

__pycache__

feat: Add VEX compact fixture and implement offline verifier for Findings Ledger exports

2025-12-02 21:08:01 +02:00

check_signing_prereqs.sh

blocked 4

2025-11-23 17:53:41 +02:00

ci-sign.sh

feat: Add DigestUpsertRequest and LockEntity models

2025-12-03 07:51:50 +02:00

mirror-create.sh

Add tests and implement timeline ingestion options with NATS and Redis subscribers

2025-12-03 09:46:48 +02:00

mirror-verify.sh

Add tests and implement timeline ingestion options with NATS and Redis subscribers

2025-12-03 09:46:48 +02:00

README.md

Add tests and implement timeline ingestion options with NATS and Redis subscribers

2025-12-03 09:46:48 +02:00

sign_thin_bundle.py

feat: Add DigestUpsertRequest and LockEntity models

2025-12-03 07:51:50 +02:00

verify_oci_layout.py

blockers 2

2025-11-23 14:54:17 +02:00

verify_thin_bundle.py

feat: Add DigestUpsertRequest and LockEntity models

2025-12-03 07:51:50 +02:00

README.md

Mirror signing helpers

make-thin-v1.sh: builds thin bundle v1, computes checksums, emits bundle meta (offline/rekor/mirror gaps), optional DSSE+TUF signing when SIGN_KEY is set, and runs verifier.
sign_thin_bundle.py: signs manifest (DSSE), bundle meta (DSSE), and root/targets/snapshot/timestamp JSON using an Ed25519 PEM key.
verify_thin_bundle.py: checks SHA256 sidecars, manifest schema, tar determinism, required layers, optional bundle meta and DSSE signatures; accepts --bundle-meta, --pubkey, --tenant, --environment.
ci-sign.sh: CI wrapper. Set MIRROR_SIGN_KEY_B64 (base64-encoded Ed25519 PEM) and run; it builds, signs, and verifies in one step, emitting milestone.json with manifest/tar/bundle hashes.
verify_oci_layout.py: validates OCI layout/index/manifest and blob digests when OCI=1 is used.
mirror-create.sh: convenience wrapper to build + verify thin bundles (optional SIGN_KEY, time anchor, OCI flag).
mirror-verify.sh: wrapper around verify_thin_bundle.py for quick hash/DSSE checks.

Artifacts live under out/mirror/thin/.