3a2100aa78
- Implemented comprehensive unit tests for VexCandidateEmitter to validate candidate emission logic based on various scenarios including absent and present APIs, confidence thresholds, and rate limiting. - Added integration tests for SmartDiff PostgreSQL repositories, covering snapshot storage and retrieval, candidate storage, and material risk change handling. - Ensured tests validate correct behavior for storing, retrieving, and querying snapshots and candidates, including edge cases and expected outcomes.
113 lines
6.1 KiB
Markdown
Executable File
113 lines
6.1 KiB
Markdown
Executable File
# 14 · Glossary of Terms — Stella Ops
|
||
|
||
|
||
---
|
||
|
||
### 0 Purpose
|
||
A concise, single‑page **“what does that acronym actually mean?”** reference for
|
||
developers, DevOps engineers, IT managers and auditors who are new to the
|
||
Stella Ops documentation set.
|
||
|
||
*If you meet a term in any Stella Ops doc that is **not** listed here, please
|
||
open a PR and append it alphabetically.*
|
||
|
||
---
|
||
|
||
## A – C
|
||
|
||
| Term | Short definition | Links / notes |
|
||
|------|------------------|---------------|
|
||
| **ADR** | *Architecture Decision Record* – lightweight Markdown file that captures one irreversible design decision. | ADR template lives at `/docs/adr/` |
|
||
| **AIRE** | *AI Risk Evaluator* – optional Plus/Pro plug‑in that suggests mute rules using an ONNX model. | Commercial feature |
|
||
| **Azure‑Pipelines** | CI/CD service in Microsoft Azure DevOps. | Recipe in Pipeline Library |
|
||
| **BDU** | Russian (FSTEC) national vulnerability database: *База данных уязвимостей*. | Merged with NVD by Concelier (vulnerability ingest/merge/export service) |
|
||
| **BuildKit** | Modern Docker build engine with caching and concurrency. | Needed for layer cache patterns |
|
||
| **CI** | *Continuous Integration* – automated build/test pipeline. | Stella integrates via CLI |
|
||
| **Cosign** | Open‑source Sigstore tool that signs & verifies container images **and files**. | Images & OUK tarballs |
|
||
| **CWV / CLS** | *Core Web Vitals* metric – Cumulative Layout Shift. | UI budget ≤ 0.1 |
|
||
| **CycloneDX** | Open SBOM (BOM) standard alternative to SPDX. | Planned report format plug‑in |
|
||
|
||
---
|
||
|
||
## D – G
|
||
|
||
| Term | Definition | Notes |
|
||
|------|------------|-------|
|
||
| **Digest (image)** | SHA‑256 hash uniquely identifying a container image or layer. | Pin digests for reproducible builds |
|
||
| **Docker‑in‑Docker (DinD)** | Running Docker daemon inside a CI container. | Used in GitHub / GitLab recipes |
|
||
| **DTO** | *Data Transfer Object* – C# record serialised to JSON. | Schemas in doc 11 |
|
||
| **Concelier** | Vulnerability ingest/merge/export service consolidating OVN, GHSA, NVD 2.0, CNNVD, CNVD, ENISA, JVN and BDU feeds into the canonical PostgreSQL store and export artifacts. | Cron default `0 1 * * *` |
|
||
| **FSTEC** | Russian regulator issuing SOBIT certificates. | Pro GA target |
|
||
| **Gitea** | Self‑hosted Git service – mirrors GitHub repo. | OSS hosting |
|
||
| **GOST TLS** | TLS cipher‑suites defined by Russian GOST R 34.10‑2012 / 34.11‑2012. | Provided by `OpenSslGost` or CryptoPro |
|
||
| **Grype** | Alternative OSS vulnerability scanner; can be hot‑loaded as plug‑in. | Scanner interface `IScannerRunner` |
|
||
|
||
---
|
||
|
||
## H – L
|
||
|
||
| Term | Definition | Notes |
|
||
|------|------------|-------|
|
||
| **Helm** | Kubernetes package manager (charts). | Beta chart under `/charts/core` |
|
||
| **Hot‑load** | Runtime discovery & loading of plug‑ins **without restart**. | Cosign‑signed DLLs |
|
||
| **Hyperfine** | CLI micro‑benchmark tool used in Performance Workbook. | Outputs CSV |
|
||
| **JWT** | *JSON Web Token* – bearer auth token issued by OpenIddict. | Scope `scanner`, `admin`, `ui` |
|
||
| **K3s / RKE2** | Lightweight Kubernetes distributions (Rancher). | Supported in K8s guide |
|
||
| **Kubernetes NetworkPolicy** | K8s resource controlling pod traffic. | Redis/PostgreSQL isolation |
|
||
|
||
---
|
||
|
||
## M – O
|
||
|
||
| Term | Definition | Notes |
|
||
|------|------------|-------|
|
||
| **PostgreSQL** | Relational DB storing history and audit logs. | Required for production |
|
||
| **Mute rule** | JSON object that suppresses specific CVEs until expiry. | Schema `mute-rule‑1.json` |
|
||
| **NVD** | US‑based *National Vulnerability Database*. | Primary CVE source |
|
||
| **ONNX** | Portable neural‑network model format; used by AIRE. | Runs in‑process |
|
||
| **OpenIddict** | .NET library that implements OAuth2 / OIDC in Stella backend. | Embedded IdP |
|
||
| **OUK** | *Offline Update Kit* – signed tarball with images + feeds for air‑gap. | Admin guide #24 |
|
||
| **OTLP** | *OpenTelemetry Protocol* – exporter for traces & metrics. | `/metrics` endpoint |
|
||
|
||
---
|
||
|
||
## P – S
|
||
|
||
| Term | Definition | Notes |
|
||
|------|------------|-------|
|
||
| **P95** | 95th‑percentile latency metric. | Target ≤ 5 s SBOM path |
|
||
| **PDF SAR** | *Security Assessment Report* PDF produced by Pro edition. | Cosign‑signed |
|
||
| **Plug‑in** | Hot‑loadable DLL implementing a Stella contract (`IScannerRunner`, `ITlsProvider`, etc.). | Signed with Cosign |
|
||
| **Problem Details** | RFC 7807 JSON error format returned by API. | See API ref §0 |
|
||
| **Redis** | In‑memory datastore used for queue + cache. | Port 6379 |
|
||
| **Rekor** | Sigstore transparency log; future work for signature anchoring. | Road‑map P4 |
|
||
| **RPS** | *Requests Per Second*. | Backend perf budget 40 rps |
|
||
| **SBOM** | *Software Bill of Materials* – inventory of packages in an image. | Trivy JSON v2 |
|
||
| **Stella CLI** | Lightweight CLI that submits SBOMs for vulnerability scanning. | See CI recipes |
|
||
| **Seccomp** | Linux syscall filter JSON profile. | Backend shipped non‑root |
|
||
| **SLA** | *Service‑Level Agreement* – 24 h / 1‑ticket for Pro. | SRE runbook |
|
||
| **Span<T>** | .NET ref‑like struct for zero‑alloc slicing. | Allowed with benchmarks |
|
||
| **Styker.NET** | Mutation testing runner used on critical libs. | Coverage ≥ 60 % |
|
||
|
||
---
|
||
|
||
## T – Z
|
||
|
||
| Term | Definition | Notes |
|
||
|------|------------|-------|
|
||
| **Trivy** | OSS CVE scanner powering the default `IScannerRunner`. | CLI pinned 0.64 |
|
||
| **Trivy‑srv** | Long‑running Trivy server exposing gRPC API; speeds up remote scans. | Variant A |
|
||
| **UI tile** | Dashboard element showing live metric (scans today, feed age, etc.). | Angular Signals |
|
||
| **WebSocket** | Full‑duplex channel (`/ws/scan`, `/ws/stats`) for UI real‑time. | Used by tiles |
|
||
| **Zastava** | Lightweight agent that inventories running containers and can enforce kills. | |
|
||
|
||
---
|
||
|
||
### 11 Change log
|
||
|
||
| Version | Date | Notes |
|
||
|---------|------|-------|
|
||
| **v1.0** | 2025‑07‑12 | First populated glossary – 52 terms covering Core docs. |
|
||
|
||
*(End of Glossary v1.0)*
|