8768c27f30
- Introduced `ReachabilityState`, `RuntimeHit`, `ExploitabilitySignal`, `ReachabilitySignal`, `SignalEnvelope`, `SignalType`, `TrustSignal`, and `UnknownSymbolSignal` records to define various signal types and their properties. - Implemented JSON serialization attributes for proper data interchange. - Created project files for the new signal contracts library and corresponding test projects. - Added deterministic test fixtures for micro-interaction testing. - Included cryptographic keys for secure operations with cosign.
21 lines
1.4 KiB
Markdown
21 lines
1.4 KiB
Markdown
# Evidence Locker Golden Fixtures (EB10)
|
||
|
||
Purpose: reference bundles and replay records used by CI to prove deterministic packaging, DSSE subject stability, and portable redaction behaviour.
|
||
|
||
## Layout
|
||
- `sealed/` – sealed bundle ingredients (`manifest.json`, `checksums.txt`, DSSE `signature.json`, `bundle.json`, evidence ndjson) plus `expected.json`.
|
||
- `portable/` – redacted bundle ingredients and `expected.json` noting masked fields and tenant token.
|
||
- `replay/` – `replay.ndjson` with `expected.json` (recordDigest, sequence, ledger URI); ordering is canonical (recordedAtUtc, scanId).
|
||
|
||
## Expectations
|
||
- Gzip timestamp pinned to `2025-01-01T00:00:00Z`; tar entries use `0644` perms and fixed mtime.
|
||
- `checksums.txt` sorted lexicographically by `canonicalPath`; Merkle root equals `sha256sum checksums.txt`.
|
||
- DSSE subject ties to the Merkle root; manifest validates against `schemas/bundle.manifest.schema.json`.
|
||
- Portable bundles must exclude tenant identifiers and include redaction metadata in the manifest.
|
||
|
||
## How to (re)generate
|
||
1. Set `TZ=UTC` and ensure deterministic tool versions.
|
||
2. Run EvidenceLocker pipeline to produce sealed bundle; copy outputs here with expected hash values.
|
||
3. Produce portable bundle and replay records using the same input set; write `expected.json` capturing root hashes and replay digests.
|
||
4. Update xUnit tests in `StellaOps.EvidenceLocker.Tests` to consume these fixtures without network calls.
|