stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
main
git.stella-ops.org/docs/features/checked/scanner/windows-chocolatey-package-analyzer.md
master e9aeadc040 save checkpoint
2026-02-14 09:11:48 +02:00

1.5 KiB
Raw Permalink Blame History

Windows Chocolatey Package Analyzer

Module

Scanner

Status

VERIFIED

Description

Discovers Chocolatey-installed packages by parsing .nuspec files in the Chocolatey lib directory, producing SBOM components with id, version, license URL, and dependency chains.

Implementation Details

  • Chocolatey Analyzer Plugin:
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS.Windows.Chocolatey/ChocolateyAnalyzerPlugin.cs - ChocolateyAnalyzerPlugin discovering Chocolatey-installed packages by parsing .nuspec files in the Chocolatey lib directory, extracting package id, version, license URL, and dependency chains
  • Tests:
    • src/Scanner/__Tests/StellaOps.Scanner.Analyzers.OS.Windows.Chocolatey.Tests/ChocolateyAnalyzerPluginTests.cs - Unit tests for Chocolatey package discovery

E2E Test Plan

  • Scan a Windows container image with Chocolatey packages installed and verify all packages are discovered from the lib directory
  • Verify each discovered package includes correct id, version, and license URL from the .nuspec file
  • Verify dependency chains are resolved from .nuspec dependency elements
  • Verify the analyzer correctly handles packages with no dependencies
  • Verify the analyzer produces valid SBOM components with correct PURLs for Chocolatey packages

Verification

Check Result
Tier 0 - Source files exist PASS
Tier 1 - Build + code review PASS
Tier 2 - Integration tests PASS
Verified 2026-02-13T18:10:00Z