71e9a56cfd
- Implemented `run-scanner-ci.sh` to build and run tests for the Scanner solution with a warmed NuGet cache. - Created `excititor-vex-traces.json` dashboard for monitoring Excititor VEX observations. - Added Docker Compose configuration for the OTLP span sink in `docker-compose.spansink.yml`. - Configured OpenTelemetry collector in `otel-spansink.yaml` to receive and process traces. - Developed `run-spansink.sh` script to run the OTLP span sink for Excititor traces. - Introduced `FileSystemRiskBundleObjectStore` for storing risk bundle artifacts in the filesystem. - Built `RiskBundleBuilder` for creating risk bundles with associated metadata and providers. - Established `RiskBundleJob` to execute the risk bundle creation and storage process. - Defined models for risk bundle inputs, entries, and manifests in `RiskBundleModels.cs`. - Implemented signing functionality for risk bundle manifests with `HmacRiskBundleManifestSigner`. - Created unit tests for `RiskBundleBuilder`, `RiskBundleJob`, and signing functionality to ensure correctness. - Added filesystem artifact reader tests to validate manifest parsing and artifact listing. - Included test manifests for egress scenarios in the task runner tests. - Developed timeline query service tests to verify tenant and event ID handling.
49 lines
2.6 KiB
Markdown
49 lines
2.6 KiB
Markdown
# StellaOps Export Center
|
||
|
||
Export Center packages reproducible evidence bundles (JSON, Trivy DB, mirror) with provenance metadata and optional signing for offline or mirrored deployments.
|
||
|
||
## Latest updates (2025-11-30)
|
||
- Sprint tracker `docs/implplan/SPRINT_0320_0001_0001_docs_modules_export_center.md` and module `TASKS.md` added to mirror status.
|
||
- Observability runbook stub + dashboard placeholder added under `operations/` (offline import).
|
||
- Bundle/profile/offline manifest guidance reaffirmed (`devportal-offline*.md`, `mirror-bundles.md`, `provenance-and-signing.md`).
|
||
|
||
## Responsibilities
|
||
- Coordinate export jobs based on profiles and scope selectors.
|
||
- Assemble manifests, provenance documents, and cosign signatures.
|
||
- Stream bundles via HTTP/OCI and stage them for Offline Kit uses.
|
||
- Expose CLI/API surfaces for automation.
|
||
|
||
## Key components
|
||
- `StellaOps.ExportCenter.WebService` planner.
|
||
- `StellaOps.ExportCenter.Worker` bundle builder.
|
||
- Adapters in `StellaOps.ExportCenter.*` for JSON/Trivy/mirror variants.
|
||
|
||
## Profiles at a glance
|
||
- **json:raw / json:policy** — Evidence bundles with raw ingestion facts or policy overlays.
|
||
- **trivy:db / trivy:java-db** — Trivy-compatible vulnerability feeds with deterministic manifests.
|
||
- **mirror:full / mirror:delta** — OCI-style mirrors with provenance, TUF metadata, and optional encryption.
|
||
- **devportal:offline** — Developer portal static assets, specs, SDKs, and changelogs packaged with `manifest.json`, `checksums.txt`, helper scripts, and a DSSE-signed manifest (`manifest.dsse.json`) for offline verification.
|
||
|
||
## Integrations & dependencies
|
||
- Concelier/Excititor/Policy data stores for evidence.
|
||
- Signer/Attestor for provenance signing.
|
||
- CLI for operator-managed exports.
|
||
|
||
## Operational notes
|
||
- Runbooks in ./operations/ for deployment and monitoring.
|
||
- Observability assets: `operations/observability.md` and `operations/dashboards/export-center-observability.json` (offline import).
|
||
- Mirror bundle instructions and validation notes.
|
||
- Telemetry dashboards for export latency and retry rates.
|
||
|
||
## Related resources
|
||
- ./operations/runbook.md
|
||
- ./devportal-offline.md (bundle structure, verification workflow, DSSE signature details)
|
||
- ./provenance-and-signing.md (manifest/provenance schema, signing pipeline, verification)
|
||
|
||
## Backlog references
|
||
- DOCS-EXPORT-35-001 … DOCS-EXPORT-37-002 in ../../TASKS.md.
|
||
- EXPORT-ATTEST-75-002 cross-team deliverable.
|
||
|
||
## Epic alignment
|
||
- **Epic 10 – Export Center:** deliver canonical JSON, Trivy DB, and mirror bundle workflows with provenance, signatures, and offline parity.
|