bc4318ef97
- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism. - Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions. - Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests. - Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.
1.2 KiB
1.2 KiB
Proof verification
Purpose
- Verify DSSE bundles and transparency proofs for scan and score evidence.
Components
- DSSE envelope and signature bundle.
- Certificate chain and trust roots.
- Rekor inclusion proof and checkpoint when online.
Basic verification
- Verify DSSE signature against trusted roots.
- Confirm subject digest matches expected artifact.
- Validate Merkle inclusion proof when available.
Offline verification
- Use embedded proofs and local trust bundles.
- Skip online Rekor queries in sealed mode.
- Record verification results in timeline events.
Transparency log integration
- Check Rekor entry status and inclusion proof.
- When Rekor is unavailable, rely on cached checkpoint and proofs.
Troubleshooting cues
- DSSE signature invalid: check key rotation or trust anchors.
- Merkle root mismatch: verify checkpoint and bundle integrity.
- Certificate chain failure: refresh trust roots.
Monitoring
- Track verification latency and failure counts.
- Alert on certificate expiry or rising verification failures.
Related references
- provenance/attestation-workflow.md
- release/promotion-attestations.md
- docs/operations/proof-verification-runbook.md