checkId: check.attestation.offline.bundle plugin: stellaops.doctor.attestation severity: warn tags: [attestation, offline, bundle, airgap]

Attestation Offline Bundle

What It Checks

Verifies that the configured offline attestation bundle exists, can be read, and contains usable evidence inputs for disconnected validation. The check warns when the configured bundle path is missing, unreadable, stale, or malformed, and collects the configured path plus the detected failure reason.

Why It Matters

Air-gapped attestation flows rely on locally staged bundles. If the bundle is absent or stale, release evidence cannot be verified during disconnected commissioning, and operators may not be able to prove provenance or transparency status without restoring external connectivity.

Common Causes

How to Fix

Docker Compose

# Mount the exported bundle read-only into the Doctor service.
mkdir -p devops/offline/attestation
cp /secure-transfer/attestation-bundle.json devops/offline/attestation/attestation-bundle.json

# Set the matching config key in the compose env file.
Doctor__Plugins__Attestation__OfflineBundlePath=/app/offline/attestation/attestation-bundle.json

Bare Metal / systemd

sudo install -d -o stellaops -g stellaops /var/lib/stellaops/offline/attestation
sudo install -o stellaops -g stellaops -m 0440 attestation-bundle.json /var/lib/stellaops/offline/attestation/attestation-bundle.json

# In /etc/stellaops/doctor/appsettings.Production.json:
# "Doctor": { "Plugins": { "Attestation": { "OfflineBundlePath": "/var/lib/stellaops/offline/attestation/attestation-bundle.json" } } }
sudo systemctl restart stellaops-doctor

Kubernetes / Helm

kubectl -n stellaops create configmap doctor-attestation-bundle \
  --from-file=attestation-bundle.json=./attestation-bundle.json \
  --dry-run=client -o yaml | kubectl apply -f -

helm upgrade stellaops ./charts/stellaops \
  --set doctor.extraVolumes[0].name=doctor-attestation-bundle \
  --set doctor.extraVolumes[0].configMap.name=doctor-attestation-bundle \
  --set doctor.extraVolumeMounts[0].name=doctor-attestation-bundle \
  --set doctor.extraVolumeMounts[0].mountPath=/app/offline/attestation \
  --set doctor.config.Doctor__Plugins__Attestation__OfflineBundlePath=/app/offline/attestation/attestation-bundle.json

Verification

stella doctor run --check check.attestation.offline.bundle