c2c6b58b41
- Introduced a new document for promotion-time attestations, detailing the purpose, predicate schema, producer workflow, verification flow, APIs, and security considerations. - Implemented the `stella.ops/promotion@v1` predicate schema to capture promotion evidence including image digest, SBOM/VEX artifacts, and Rekor proof. - Defined producer responsibilities and workflows for CLI orchestration, signer responsibilities, and Export Center integration. - Added verification steps for auditors to validate promotion attestations offline. feat: Create Symbol Manifest v1 Specification - Developed a specification for Symbol Manifest v1 to provide a deterministic format for publishing debug symbols and source maps. - Defined the manifest structure, including schema, entries, source maps, toolchain, and provenance. - Outlined upload and verification processes, resolve APIs, runtime proxy, caching, and offline bundle generation. - Included security considerations and related tasks for implementation. chore: Add Ruby Analyzer with Git Sources - Created a Gemfile and Gemfile.lock for Ruby analyzer with dependencies on git-gem, httparty, and path-gem. - Implemented main application logic to utilize the defined gems and output their versions. - Added expected JSON output for the Ruby analyzer to validate the integration of the new gems and their functionalities. - Developed internal observation classes for Ruby packages, runtime edges, and capabilities, including serialization logic for observations. test: Add tests for Ruby Analyzer - Created test fixtures for Ruby analyzer, including Gemfile, Gemfile.lock, main application, and expected JSON output. - Ensured that the tests validate the correct integration and functionality of the Ruby analyzer with the specified gems.
Scanner Design Dossiers
This directory contains deep technical designs for current and upcoming analyzers and surface components.
Language analyzers
ruby-analyzer.md— lockfile, runtime graph, capability signals for Ruby.
Surface & platform contracts
surface-fs.mdsurface-env.mdsurface-validation.mdsurface-secrets.md
OS ecosystem designs
macos-analyzer.md— Homebrew, pkgutil,.appbundle plan.windows-analyzer.md— MSI, WinSxS, Chocolatey, registry collectors.
Demand & dashboards
../../benchmarks/scanner/windows-macos-demand.md— demand tracker.../../benchmarks/scanner/windows-macos-interview-template.md— interview template.../../api/scanner/windows-coverage.md— coverage summary dashboard.../../api/scanner/windows-macos-summary.md— metric snapshot.
Utility & reference
../operations/field-engagement.md— SE workflow guidance.../operations/analyzers.md— operational runbook.../operations/rustfs-migration.md— storage migration notes.
Maintenance tips
- Keep demand tracker (
../../benchmarks/scanner/windows-macos-demand.md) and API dashboards in sync when updating macOS/Windows designs. - Cross-reference policy readiness briefs for associated predicates and waiver models.
Policy readiness
../policy/secret-leak-detection-readiness.md— secret leak pipeline decisions.../policy/windows-package-readiness.md— Windows analyzer policy decisions.