2d08f52715
- Introduced README.md for Zastava Evidence Locker Plan detailing artifacts to sign and post-signing steps. - Added example JSON schemas for observer events and webhook admissions. - Updated implementor guidelines with checklist for CI linting, determinism, secrets management, and schema control. - Created alert rules for Vuln Explorer to monitor API latency and projection errors. - Developed analytics ingestion plan for Vuln Explorer, focusing on telemetry and PII guardrails. - Implemented Grafana dashboard configuration for Vuln Explorer metrics visualization. - Added expected projection SHA256 for vulnerability events. - Created k6 load testing script for Vuln Explorer API. - Added sample projection and replay event data for testing. - Implemented ReplayInputsLock for deterministic replay inputs management. - Developed tests for ReplayInputsLock to ensure stable hash computation. - Created SurfaceManifestDeterminismVerifier to validate manifest determinism and integrity. - Added unit tests for SurfaceManifestDeterminismVerifier to ensure correct functionality. - Implemented Angular tests for VulnerabilityHttpClient and VulnerabilityDetailComponent to verify API interactions and UI rendering.
33 lines
879 B
Bash
33 lines
879 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Minimal verifier sample for AIRGAP-VERIFY-510-014. Adjust paths to your kit.
|
|
|
|
KIT_ROOT=${1:-./offline-kit}
|
|
MANIFEST="$KIT_ROOT/manifest.json"
|
|
SIG="$KIT_ROOT/manifest.dsse"
|
|
|
|
echo "[*] Verifying manifest signature..."
|
|
cosign verify-blob --key trust-roots/manifest.pub --signature "$SIG" "$MANIFEST"
|
|
|
|
echo "[*] Checking chunk hashes..."
|
|
python - <<'PY'
|
|
import json, hashlib, sys, os
|
|
manifest_path=os.environ.get('MANIFEST') or sys.argv[1]
|
|
with open(manifest_path) as f:
|
|
data=json.load(f)
|
|
ok=True
|
|
for entry in data.get('chunks', []):
|
|
path=os.path.join(os.path.dirname(manifest_path), entry['path'])
|
|
h=hashlib.sha256()
|
|
with open(path,'rb') as fh:
|
|
h.update(fh.read())
|
|
if h.hexdigest()!=entry['sha256']:
|
|
ok=False
|
|
print(f"HASH MISMATCH {entry['path']}")
|
|
if not ok:
|
|
sys.exit(4)
|
|
PY
|
|
|
|
echo "[*] Done."
|