stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 1 Releases Wiki Activity
Files
40e7f827da764e39ca67fc27a74813a98e9a38d2
git.stella-ops.org/docs/modules/evidence-locker/compliance-checklist.md
master 2eb6852d34
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Details
Add unit tests for SBOM ingestion and transformation 
- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.
2025-11-04 07:49:39 +02:00

1.5 KiB
Raw Blame History

Evidence Locker Compliance Checklist (Sprint 160)

  • Postgres schema created via deterministic SQL migrations (evidence_locker.* tables, schema version tracking).
  • Row-level security enforced per tenant via app.current_tenant guard function.
  • Evidence bundle storage keys are content-addressed (sha256) and unique per tenant/bundle.
  • Object-store abstraction provides local filesystem and Amazon S3 drivers with optional WORM enforcement.
  • Startup migrations wired via hosted service with opt-out flag (ApplyMigrationsAtStartup).
  • Integration tests cover schema bootstrap, RLS behaviour, and storage drivers (filesystem, S3 fake client).
  • Temporary artifacts cleaned deterministically; filesystem targets validated in tests.
  • Timeline publisher emits bundle sealed and hold events with DSSE metadata when enabled; offline deployments fall back to null publisher.
  • Bundle packaging outputs deterministic bundle.tgz (fixed gzip mtime, sorted checksums, timestamp-aware instructions) and /evidence/{id}/download streams the cached object with audit logging.
  • Incident mode extends bundle retention, captures incident request snapshots, and emits activation/deactivation events to Timeline Indexer and Notifier stubs with unit + web integration coverage.
  • Portable bundle flow (/evidence/{id}/portable) emits portable-bundle-v1.tgz with redacted metadata, deterministic offline script, and write-once storage tracking.