38 lines
2.6 KiB
Markdown
38 lines
2.6 KiB
Markdown
# FuncProof Pipeline (Function-Level Proof Generation, DSSE Signing, OCI Publishing)
|
|
|
|
## Module
|
|
Scanner
|
|
|
|
## Status
|
|
IMPLEMENTED
|
|
|
|
## Description
|
|
Complete pipeline for generating function-level proof objects from binary analysis. Includes DWARF/symbol/heuristic function boundary detection, BLAKE3/SHA-256 function-range hashing, DSSE envelope signing, Rekor transparency log integration, OCI referrer publishing, CycloneDX 1.6 callflow evidence linking, PostgreSQL storage, and configurable generation options.
|
|
|
|
## Implementation Details
|
|
- **Binary Function Analysis**:
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Binary/BinaryIntelligenceAnalyzer.cs` - Function boundary detection (DWARF/symbol/heuristic)
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Binary/CodeFingerprint.cs` - Code fingerprint model
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Binary/IFingerprintGenerator.cs` - Fingerprint generation interface
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Binary/FingerprintCorpusBuilder.cs` - Builds fingerprint corpus
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.EntryTrace/Binary/SymbolInfo.cs` - Symbol info model
|
|
- **Proof of Exposure**:
|
|
- `src/Scanner/StellaOps.Scanner.Worker/Orchestration/PoEOrchestrator.cs` - Proof-of-Exposure orchestrator
|
|
- `src/Scanner/StellaOps.Scanner.Worker/Processing/PoE/PoEGenerationStageExecutor.cs` - PoE generation stage executor
|
|
- **DSSE Signing**:
|
|
- `src/Scanner/StellaOps.Scanner.Worker/Processing/Surface/HmacDsseEnvelopeSigner.cs` - HMAC-based DSSE signing
|
|
- `src/Scanner/StellaOps.Scanner.Worker/Processing/Surface/IDsseEnvelopeSigner.cs` - DSSE signing interface
|
|
- **OCI Publishing**:
|
|
- `src/Scanner/StellaOps.Scanner.WebService/Services/IOciAttestationPublisher.cs` - OCI attestation publisher interface
|
|
- `src/Scanner/StellaOps.Scanner.WebService/Services/OciAttestationPublisher.cs` - Publishes attestations to OCI registries
|
|
- **Evidence Integration**:
|
|
- `src/Scanner/__Libraries/StellaOps.Scanner.Emit/Evidence/CallstackEvidenceBuilder.cs` - CycloneDX callflow evidence linking
|
|
|
|
## E2E Test Plan
|
|
- [ ] Scan a container image with native binaries and verify function-level proof objects are generated
|
|
- [ ] Verify function boundary detection works for DWARF debug info, symbol tables, and heuristic detection
|
|
- [ ] Verify function-range hashing produces BLAKE3/SHA-256 fingerprints
|
|
- [ ] Verify DSSE envelope signing wraps proof objects
|
|
- [ ] Verify OCI referrer publishing attaches proofs to the image manifest
|
|
- [ ] Verify CycloneDX callflow evidence links proofs to vulnerability findings
|