18d87c64c5
- Implemented PolicyPackSelectorComponent for selecting policy packs. - Added unit tests for component behavior, including API success and error handling. - Introduced monaco-workers type declarations for editor workers. - Created acceptance tests for guardrails with stubs for AT1–AT10. - Established SCA Failure Catalogue Fixtures for regression testing. - Developed plugin determinism harness with stubs for PL1–PL10. - Added scripts for evidence upload and verification processes.
34 lines
1014 B
Bash
34 lines
1014 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Offline verifier stub for SBOM -> VEX proof bundles.
|
|
# Expected inputs: path to DSSE envelope, Rekor log snapshot, and bundled trust roots.
|
|
|
|
if [ "$#" -lt 4 ]; then
|
|
echo "usage: $0 <sbom.json> <vex.json> <dsse.envelope> <rekor-bundle.json>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SBOM="$1"
|
|
VEX="$2"
|
|
DSSE="$3"
|
|
REKOR="$4"
|
|
|
|
if ! command -v jq >/dev/null; then
|
|
echo "jq is required (offline-capable)." >&2
|
|
exit 2
|
|
fi
|
|
|
|
echo "[stub] canonicalising inputs..." >&2
|
|
tmpdir=$(mktemp -d)
|
|
trap 'rm -rf "$tmpdir"' EXIT
|
|
|
|
jq -S . "$SBOM" > "$tmpdir/sbom.canon"
|
|
jq -S . "$VEX" > "$tmpdir/vex.canon"
|
|
jq -S . "$DSSE" > "$tmpdir/dsse.canon"
|
|
jq -S . "$REKOR" > "$tmpdir/rekor.canon"
|
|
|
|
cat "$tmpdir/sbom.canon" "$tmpdir/dsse.canon" "$tmpdir/rekor.canon" "$tmpdir/vex.canon" | sha256sum | awk '{print $1}' > "$tmpdir/proof.hash"
|
|
echo "chain-hash (sbom+dsse+rekor+vex): $(cat "$tmpdir/proof.hash")"
|
|
echo "[stub] verify DSSE signatures and Rekor inclusion separately; add manifests to DSSE envelope for full proof"
|