stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
main
git.stella-ops.org/docs/features/checked/scanner/oci-ancestry-extraction.md
master e9aeadc040 save checkpoint
2026-02-14 09:11:48 +02:00

1.6 KiB
Raw Permalink Blame History

OCI Ancestry Extraction

Module

Scanner

Status

VERIFIED

Description

Extract base image references from OCI manifest config.history to populate lineage parent relationships.

Implementation Details

  • Ancestry Extractor:
    • src/Scanner/__Libraries/StellaOps.Scanner.Storage.Oci/IOciAncestryExtractor.cs - IOciAncestryExtractor interface defining the ancestry extraction contract
    • src/Scanner/__Libraries/StellaOps.Scanner.Storage.Oci/OciAncestryExtractor.cs - OciAncestryExtractor extracts base image references from OCI manifest config.history to populate lineage parent relationships
  • Layer Dependency Graph:
    • src/Scanner/__Libraries/StellaOps.Scanner.Core/Models/LayerDependencyGraph.cs - LayerDependencyGraph models parent-child layer relationships from ancestry data

E2E Test Plan

  • Scan a container image built from a known base image and verify the OCI ancestry extractor identifies the base image reference from config.history
  • Verify lineage parent relationships are populated correctly linking child image to base image
  • Verify multi-stage build ancestry is correctly resolved (identifying intermediate build stages)
  • Verify images with LABEL or org.opencontainers.image.base.name annotations use those for ancestry when available
  • Verify images without config.history (scratch-based) are handled gracefully with no parent relationship

Verification

Check Result
Tier 0 - Source files exist PASS
Tier 1 - Build + code review PASS
Tier 2 - Integration tests PASS
Verified 2026-02-13T18:10:00Z