79b8e53441
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
- Introduced `SbomService` tasks documentation. - Updated `StellaOps.sln` to include new projects: `StellaOps.AirGap.Time` and `StellaOps.AirGap.Importer`. - Added unit tests for `BundleImportPlanner`, `DsseVerifier`, `ImportValidator`, and other components in the `StellaOps.AirGap.Importer.Tests` namespace. - Implemented `InMemoryBundleRepositories` for testing bundle catalog and item repositories. - Created `MerkleRootCalculator`, `RootRotationPolicy`, and `TufMetadataValidator` tests. - Developed `StalenessCalculator` and `TimeAnchorLoader` tests in the `StellaOps.AirGap.Time.Tests` namespace. - Added `fetch-sbomservice-deps.sh` script for offline dependency fetching.
29 lines
1.6 KiB
Markdown
29 lines
1.6 KiB
Markdown
# .NET Lang Analyzer Prep — SCANNER-ANALYZERS-LANG-11-001
|
|
|
|
Status: Draft (2025-11-20)
|
|
Owners: Scanner EPDR Guild · Language Analyzer Guild
|
|
Scope: Entrypoint resolver mapping project/publish artifacts to deterministic entrypoint identities; PREP covers test isolation and hang debugging.
|
|
|
|
## Blocking issues
|
|
- `dotnet test` hangs/returns empty output on shared runner; high restore/build fan-out.
|
|
- Concelier/CoreLinksets build errors encountered during prior attempts.
|
|
|
|
## Proposed mitigation
|
|
- Add CI job to run `dotnet test src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.DotNet.Tests/StellaOps.Scanner.Analyzers.Lang.DotNet.Tests.csproj --filter Category=Entrypoints --blame-hang-timeout 45s` on clean agent.
|
|
- Provide scoped solution `StellaOps.Scanner.Analyzers.Lang.DotNet.slnf` to limit restore.
|
|
|
|
## Expected outputs
|
|
- Entrypoints array: `{id, assembly_name, mvid, tfm, rid, kind}` with deterministic ID hashing (`sha256` over path+tfm+rid).
|
|
- Environment profiles: loader/probing settings minus host absolute paths.
|
|
|
|
## Test/fixtures
|
|
- Fixtures under `src/Scanner/__Tests/Fixtures/dotnet/entrypoints/*` for framework-dependent, self-contained, NativeAOT, multi-RID, single-file, trimmed builds.
|
|
- Golden outputs sorted by entrypoint id; verify hash stability across OS.
|
|
|
|
## Open decisions
|
|
- Hash input shape for `id` (include project GUID?): to confirm with Signals guild.
|
|
- Whether to allow RID inference from runtimeconfig vs RID graph; requires Signals sign-off.
|
|
|
|
## Handoff
|
|
Treat this as the PREP artefact for PREP-SCANNER-ANALYZERS-LANG-11-001; update once CI isolation and hash rules are confirmed.
|