stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 16 Releases Wiki Activity
Files
394b57f6bf8f5e663a5213e465ac0bb42c15bca6
git.stella-ops.org/ops/devops/sealed-mode-ci/README.md
master 536f6249a6
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Details
Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case 
- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.
2025-11-08 20:53:45 +02:00

1.6 KiB
Raw Blame History

Sealed-Mode CI Harness

This harness supports DEVOPS-AIRGAP-57-002 by exercising services with the sealed flag, verifying that no outbound network traffic succeeds, and producing artefacts Authority can use for AUTH-AIRGAP-57-001 gating.

Workflow

  1. Run ./run-sealed-ci.sh from this directory (the script now boots the stack, applies the iptables guard, and captures artefacts automatically).
  2. The harness:
    • Launches sealed-mode-compose.yml with Authority/Signer/Attestor + Mongo.
    • Snapshots iptables, injects a STELLAOPS_SEALED chain into DOCKER-USER/OUTPUT, and whitelists only loopback + RFC1918 ranges so container egress is denied.
    • Repeatedly polls /healthz on 5088/6088/7088 to verify sealed-mode bindings stay healthy while egress is blocked.
    • Executes egress_probe.py, which runs curl probes from inside the compose network to confirm off-cluster addresses are unreachable.
    • Writes logs, iptables counters, and the summary contract to artifacts/sealed-mode-ci/<timestamp>.
  3. .gitea/workflows/build-test-deploy.yml now includes a sealed-mode-ci job that runs this script on every push/PR and uploads the artefacts for AUTH-AIRGAP-57-001.

Outputs

  • authority.health.log, signer.health.log, attestor.health.log
  • iptables-docker-user.txt, iptables-output.txt
  • egress-probe.json
  • compose.log, compose.ps
  • authority-sealed-ci.json (single file Authority uses to validate the run)

TODO

  • Wire into offline kit smoke tests (DEVOPS-AIRGAP-58-001).

Refer to docs/security/dpop-mtls-rollout.md for cross-guild milestones.