bc4318ef97
- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism. - Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions. - Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests. - Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.
38 lines
1.3 KiB
Markdown
38 lines
1.3 KiB
Markdown
# Crypto profiles and trust
|
|
|
|
StellaOps supports regional crypto profiles and offline trust roots. Profiles
|
|
control signing algorithms, verification rules, and provider selection.
|
|
|
|
Crypto profiles
|
|
- Compliance profile id: world, fips, gost, sm, kcmvp, eidas.
|
|
- Provider registry selects preferred crypto implementations.
|
|
- Simulation mode provides a remote signer for pre-certification testing.
|
|
|
|
Trust and signing
|
|
- DSSE is the default for bundle manifests and attestations.
|
|
- Trust roots are distributed in RootPack snapshots for offline validation.
|
|
- Optional TUF metadata can be bundled in sealed environments.
|
|
|
|
Signed time anchors
|
|
- Offline time anchors include issuedAt, notAfter, and signature.
|
|
- Time anchors are verified locally against trust roots.
|
|
|
|
Rotation
|
|
- Rotate roots with overlapping validity windows.
|
|
- Ship new roots in the next offline bundle and re-sign manifests.
|
|
- Maintain audit logs for rotation events.
|
|
|
|
Evidence expectations
|
|
- JWKS exports for active providers.
|
|
- Fixed-message sign and verify logs for audit trails.
|
|
|
|
Related references
|
|
- docs/security/crypto-profile-configuration.md
|
|
- docs/security/trust-and-signing.md
|
|
- docs/security/crypto-simulation-services.md
|
|
- docs/security/crypto-compliance.md
|
|
- docs/airgap/staleness-and-time.md
|
|
- operations/key-rotation.md
|
|
- provenance/rekor-policy.md
|
|
- release/promotion-attestations.md
|