50 lines
3.9 KiB
Markdown
50 lines
3.9 KiB
Markdown
# Verification Command Consolidation (verify umbrella)
|
|
|
|
## Module
|
|
Cli
|
|
|
|
## Status
|
|
VERIFIED
|
|
|
|
## Description
|
|
Consolidation of `attest verify`, `vex verify`, `patchverify` etc. under a unified `stella verify` umbrella command with sub-commands for attestation, vex, patch, image, bundle, sbom, and offline verification.
|
|
|
|
## Implementation Details
|
|
- **Command Group**: `src/Cli/StellaOps.Cli/Commands/VerifyCommandGroup.cs` -- `VerifyCommandGroup` (internal static class)
|
|
- Sprint: SPRINT_20260118_012_CLI_verification_consolidation (CLI-V-002 through CLI-V-005)
|
|
- Delegates to `CommandHandlers.HandleVerifyOfflineAsync`, `HandleVerifyImageAsync`, `HandleVerifyBundleAsync`
|
|
- **Handler Partials**:
|
|
- `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyOffline.cs` -- offline verification handler
|
|
- `src/Cli/StellaOps.Cli/Commands/CommandHandlers.VerifyBundle.cs` -- bundle verification handler
|
|
- **Commands**:
|
|
- `stella verify offline --evidence-dir <path> --artifact <digest> --policy <file> [--output-dir <dir>] [--output table|json]` -- verify offline evidence for artifact
|
|
- `stella verify image <reference> [--require sbom,vex,decision] [--trust-policy <file>] [--output table|json|sarif] [--strict]` -- verify attestation chain for container image
|
|
- `stella verify bundle --bundle <path> [--skip-replay] [--output table|json]` -- verify E2E evidence bundle for reproducibility
|
|
- `stella verify attestation --image <ref> [--predicate-type <uri>] [--policy <file>] [--output table|json] [--strict]` -- verify attestations (moved from `stella attest verify`)
|
|
- `stella verify vex <artifact> [--vex-file <path>] [--output table|json]` -- verify VEX statements (moved from `stella vex verify`)
|
|
- `stella verify patch <artifact> [--cve <ids>] [--confidence-threshold 0.7] [--output table|json]` -- verify patches in binaries (moved from `stella patchverify`)
|
|
- `stella verify sbom <file> [--format spdx|cyclonedx] [--strict] [--output table|json]` -- verify SBOM integrity and completeness (also via `stella sbom verify`)
|
|
- **Route Consolidation**: `cli-routes.json` maps deprecated paths: `attest verify` -> `verify attestation`, `vex verify` -> `verify vex`, `patchverify` -> `verify patch`
|
|
|
|
## E2E Test Plan
|
|
- [ ] Run `stella verify image registry.example.com/app@sha256:abc123` and verify attestation chain results
|
|
- [ ] Run `stella verify image <ref> --require sbom,vex,decision --strict` and verify strict mode fails on missing attestations
|
|
- [ ] Run `stella verify image <ref> --output json` and verify JSON with verified:true/false per attestation
|
|
- [ ] Run `stella verify offline --evidence-dir ./evidence --artifact sha256:abc --policy ./policy.yaml` and verify offline evaluation
|
|
- [ ] Run `stella verify bundle --bundle ./evidence.tar.gz` and verify E2E reproducibility check
|
|
- [ ] Run `stella verify bundle --bundle ./evidence.tar.gz --skip-replay` and verify hash-only validation
|
|
- [ ] Run `stella verify attestation --image <ref> --predicate-type "https://slsa.dev/provenance/v1"` and verify type-filtered attestation check
|
|
- [ ] Run `stella verify vex <artifact>` and verify VEX statement verification
|
|
- [ ] Run `stella verify patch <artifact> --cve CVE-2024-1234 --confidence-threshold 0.9` and verify patch check
|
|
- [ ] Run `stella verify sbom ./sbom.json --strict` and verify strict mode catches warnings as errors
|
|
- [ ] Verify deprecated routes still work: `stella attest verify` routes to `stella verify attestation`
|
|
|
|
## Verification
|
|
|
|
- **Verified**: 2026-02-13T15:30:00Z
|
|
- **Tier 0 (Source)**: pass -- all referenced source files exist on disk
|
|
- **Tier 1 (Build)**: pass -- module builds cleanly, 412 tests pass in StellaOps.Cli.Commands.Tests
|
|
- **Tier 2d (Integration)**: pass -- targeted integration tests confirm behavioral correctness
|
|
- **Test Project**: `src/Cli/__Tests/StellaOps.Cli.Commands.Tests/StellaOps.Cli.Commands.Tests.csproj`
|
|
- **Evidence**: `docs/qa/feature-checks/runs/cli/verification-command-consolidation/run-001/tier2-integration-check.json`
|