stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 12 Releases Wiki Activity
Files
0e8655cbb17376bae811e97ec99dbbf2ee416cf1
git.stella-ops.org/docs/modules/scanner
History
master c2c6b58b41 feat: Add Promotion-Time Attestations for Stella Ops 
- Introduced a new document for promotion-time attestations, detailing the purpose, predicate schema, producer workflow, verification flow, APIs, and security considerations.
- Implemented the `stella.ops/promotion@v1` predicate schema to capture promotion evidence including image digest, SBOM/VEX artifacts, and Rekor proof.
- Defined producer responsibilities and workflows for CLI orchestration, signer responsibilities, and Export Center integration.
- Added verification steps for auditors to validate promotion attestations offline.

feat: Create Symbol Manifest v1 Specification

- Developed a specification for Symbol Manifest v1 to provide a deterministic format for publishing debug symbols and source maps.
- Defined the manifest structure, including schema, entries, source maps, toolchain, and provenance.
- Outlined upload and verification processes, resolve APIs, runtime proxy, caching, and offline bundle generation.
- Included security considerations and related tasks for implementation.

chore: Add Ruby Analyzer with Git Sources

- Created a Gemfile and Gemfile.lock for Ruby analyzer with dependencies on git-gem, httparty, and path-gem.
- Implemented main application logic to utilize the defined gems and output their versions.
- Added expected JSON output for the Ruby analyzer to validate the integration of the new gems and their functionalities.
- Developed internal observation classes for Ruby packages, runtime edges, and capabilities, including serialization logic for observations.

test: Add tests for Ruby Analyzer

- Created test fixtures for Ruby analyzer, including Gemfile, Gemfile.lock, main application, and expected JSON output.
- Ensured that the tests validate the correct integration and functionality of the Ruby analyzer with the specified gems.
2025-11-11 15:30:22 +02:00
..
design
feat: Add Promotion-Time Attestations for Stella Ops
2025-11-11 15:30:22 +02:00
operations
feat: Implement Runtime Facts ingestion service and NDJSON reader
2025-11-10 07:56:15 +02:00
AGENTS.md
Update AGENTS.md files across multiple modules to standardize task status update instructions and introduce a new document for Secret Leak Detection operations.
2025-11-05 11:58:32 +02:00
architecture.md
feat(docs): Add comprehensive documentation for Vexer, Vulnerability Explorer, and Zastava modules
2025-10-30 00:09:39 +02:00
determinism-score.md
feat: Add Promotion-Time Attestations for Stella Ops
2025-11-11 15:30:22 +02:00
deterministic-sbom-compose.md
Add support for ГОСТ Р 34.10 digital signatures
2025-11-09 21:59:57 +02:00
entropy.md
feat: Add Promotion-Time Attestations for Stella Ops
2025-11-11 15:30:22 +02:00
implementation_plan.md
Align AOC tasks for Excititor and Concelier
2025-10-31 18:50:15 +02:00
README.md
feat: Implement Runtime Facts ingestion service and NDJSON reader
2025-11-10 07:56:15 +02:00

README.md

StellaOps Scanner

Scanner analyses container images layer-by-layer, producing deterministic SBOM fragments, diffs, and signed reports.

Latest updates (2025-11-09)

  • Node analyzer now ingests npm/yarn/pnpm lockfiles, emitting DeclaredOnly components with lock provenance. The CLI companion command stella node lock-validate runs the collector offline, surfaces declared-only or missing-lock packages, and emits telemetry via stellaops.cli.node.lock_validate.count.
  • Python analyzer picks up requirements*.txt, Pipfile.lock, and poetry.lock, tagging installed distributions with lock provenance and generating declared-only components for policy. Use stella python lock-validate to run the same checks locally before images are built.
  • Java analyzer now parses gradle.lockfile, gradle/dependency-locks/**/*.lockfile, and pom.xml dependencies via the new JavaLockFileCollector, merging lock metadata onto jar evidence and emitting declared-only components when jars are absent. The new CLI verb stella java lock-validate reuses that collector offline (table/JSON output) and records stellaops.cli.java.lock_validate.count{outcome} for observability.
  • Worker/WebService now resolve cache roots and feature flags via StellaOps.Scanner.Surface.Env; misconfiguration warnings are documented in docs/modules/scanner/design/surface-env.md and surfaced through startup validation.
  • Platform events rollout (2025-10-19) continues to publish scanner.report.ready@1 and scanner.scan.completed@1 envelopes with embedded DSSE payloads (see docs/updates/2025-10-19-scanner-policy.md and docs/updates/2025-10-19-platform-events.md). Service and consumer tests should round-trip the canonical samples under docs/events/samples/.

Responsibilities

  • Expose APIs (WebService) for scan orchestration, diffing, and artifact retrieval.
  • Run Worker analyzers for OS, language, and native ecosystems with restart-only plug-ins.
  • Store SBOM fragments and artifacts in RustFS/object storage.
  • Publish DSSE-ready metadata for Signer/Attestor and downstream policy evaluation.

Key components

  • StellaOps.Scanner.WebService minimal API host.
  • StellaOps.Scanner.Worker analyzer executor.
  • Analyzer libraries under StellaOps.Scanner.Analyzers.*.

Integrations & dependencies

  • Scheduler for job intake and retries.
  • Policy Engine for evidence handoff.
  • Export Center / Offline Kit for artifact packaging.

Operational notes

  • CAS caches, bounded retries, DSSE integration.
  • Monitoring dashboards (see ./operations/analyzers-grafana-dashboard.json).
  • RustFS migration playbook.

Related resources

  • ./operations/analyzers.md
  • ./operations/analyzers-grafana-dashboard.json
  • ./operations/rustfs-migration.md
  • ./operations/entrypoint.md
  • ./operations/secret-leak-detection.md
  • ./operations/dsse-rekor-operator-guide.md
  • ./design/macos-analyzer.md
  • ./design/windows-analyzer.md
  • ../benchmarks/scanner/deep-dives/macos.md
  • ../benchmarks/scanner/deep-dives/windows.md
  • ../benchmarks/scanner/windows-macos-demand.md
  • ../benchmarks/scanner/windows-macos-interview-template.md
  • ./operations/field-engagement.md
  • ./design/README.md

Backlog references

  • DOCS-SCANNER updates tracked in ../../TASKS.md.
  • Analyzer parity work in src/Scanner/**/TASKS.md.

Epic alignment

  • Epic 6 – Vulnerability Explorer: provide policy-aware scan outputs, explain traces, and findings ledger hooks for triage workflows.
  • Epic 10 – Export Center: generate export-ready artefacts, manifests, and DSSE metadata for bundles.