stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
b851aa8300b7febfb2e661443c8e39df13fa4e22
git.stella-ops.org/docs/features/checked/scanner/scanner-analyzers.md
master e9aeadc040 save checkpoint
2026-02-14 09:11:48 +02:00

4.2 KiB
Raw Blame History

Scanner Analyzers (Language-Specific and Binary)

Module

Scanner

Status

VERIFIED

Description

Extensive analyzer ecosystem covering language-specific (Ruby, Java), OS-specific (Windows WinSxS, MSI, Chocolatey, macOS Homebrew, pkgutil), and secrets analyzers.

Implementation Details

  • Ruby Language Analyzer:
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Ruby/RubyLanguageAnalyzer.cs - RubyLanguageAnalyzer parsing Gemfile.lock, .gemspec, and gem metadata for Ruby dependency analysis
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Ruby/RubyAnalyzerPlugin.cs - RubyAnalyzerPlugin registering the Ruby analyzer in the scanner pipeline
  • Windows WinSxS Analyzer:
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS.Windows.WinSxS/WinSxSPackageAnalyzer.cs - WinSxSPackageAnalyzer discovering side-by-side assemblies in Windows images
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS.Windows.WinSxS/WinSxSManifestParser.cs - WinSxSManifestParser parsing WinSxS assembly manifests
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS.Windows.WinSxS/WinSxSAssemblyMetadata.cs - Metadata model for WinSxS assemblies
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS.Windows.WinSxS/WinSxSAnalyzerPlugin.cs - Plugin registration
  • Windows MSI Analyzer:
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS.Windows.Msi/MsiAnalyzerPlugin.cs - MsiAnalyzerPlugin analyzing MSI installer packages
  • Windows Chocolatey Analyzer:
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.OS.Windows.Chocolatey/ChocolateyAnalyzerPlugin.cs - ChocolateyAnalyzerPlugin discovering packages installed via Chocolatey
  • Secrets Analyzer:
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Secrets/SecretsAnalyzer.cs - SecretsAnalyzer detecting exposed secrets (API keys, tokens, passwords) in image layers
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Secrets/SecretsAnalyzerHost.cs - SecretsAnalyzerHost managing analyzer lifecycle
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Secrets/SecretsAnalyzerOptions.cs - Configuration options for secret detection rules
    • src/Scanner/StellaOps.Scanner.Worker/Processing/Secrets/SecretsAnalyzerStageExecutor.cs - SecretsAnalyzerStageExecutor scanner pipeline stage for secrets analysis
  • Secret Alert Emitter:
    • src/Scanner/__Libraries/StellaOps.Scanner.Core/Secrets/Alerts/SecretAlertEmitter.cs - SecretAlertEmitter emitting alerts for discovered secrets
    • src/Scanner/__Libraries/StellaOps.Scanner.Core/Secrets/Alerts/ISecretAlertEmitter.cs - Interface for secret alerts
    • src/Scanner/__Libraries/StellaOps.Scanner.Core/Secrets/Configuration/SecretExceptionMatcher.cs - SecretExceptionMatcher for allowlisting known-safe patterns
  • Tests:
    • src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Ruby.Tests/RubyLanguageAnalyzerTests.cs - Ruby analyzer tests
    • src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Secrets.Tests/SecretsAnalyzerTests.cs - Secrets analyzer tests
    • src/Scanner/__Tests/StellaOps.Scanner.Analyzers.OS.Windows.Chocolatey.Tests/ChocolateyAnalyzerPluginTests.cs - Chocolatey analyzer tests

E2E Test Plan

  • Scan a container image with a Ruby application and verify RubyLanguageAnalyzer discovers all gems from Gemfile.lock with correct versions
  • Scan a Windows container image and verify WinSxSPackageAnalyzer discovers side-by-side assemblies with correct version and architecture metadata
  • Scan a Windows image with Chocolatey packages and verify ChocolateyAnalyzerPlugin lists all installed packages
  • Scan an image containing embedded secrets (test fixtures) and verify SecretsAnalyzer detects API keys, tokens, and passwords with correct file locations
  • Verify the SecretExceptionMatcher correctly suppresses findings that match allowlisted patterns
  • Verify all analyzer plugins register correctly and execute as pipeline stages in the scanner worker

Verification

Check Result
Tier 0 - Source files exist PASS
Tier 1 - Build + code review PASS
Tier 2 - Integration tests PASS
Verified 2026-02-13T18:10:00Z