Mirror Bundles

Audience: operators and integrators who produce, transfer, or validate mirror bundles for sealed Stella Ops deployments.

A mirror bundle is the deterministic, signed package used to move container images, charts, and feed data across an air gap. This guide defines the bundle format, the validation workflow, and the determinism rules that let any consumer reproduce and verify the same bytes. For risk-intelligence payloads specifically, see Risk Bundles and EPSS Air-Gapped Bundles; for staging bundles into a sealed install, see the Air-Gap Importer Guide.

Contents

• Images and charts: OCI artifacts exported with their digests plus SBOMs.
• Manifest: manifest.json, with entries for:
  • bundleId, mirrorGeneration, createdAt, producer (the Export Center), and hashes (a SHA-256 list).
  • dsseEnvelopeHash for the signed manifest (where available).
  • files[]: path, sha256, size, and mediaType.
• Transparency: optional TUF metadata (timestamp.json, snapshot.json) for replay protection.

Validation steps

1. Verify the manifest.json SHA-256 matches the provided hash.
2. If a DSSE signature is present, verify it against the offline trust roots.
3. Validate the Merkle root (if included) over the files[] hashes.
4. For each OCI artifact, confirm the digest matches and an SBOM is present.
5. Record mirrorGeneration and the manifest hash; store both in the audit log and as a timeline event.

Workflow

• The Export Center produces the bundle and manifest; the Attestor and Excititor importers validate it before ingest.
• Bundle consumers must refuse the import if any hash or signature check fails.
• Keep the format stable: any schema change bumps manifestVersion in manifest.json.

Determinism

• Sort files[] by path, and compute hashes over UTF-8 canonical paths.
• Use ISO-8601 UTC timestamps in manifests.
• Do not include host-specific paths or timestamps in tar layers.

See also

• Risk Bundles — vulnerability-intelligence payloads (KEV, EPSS, OSV).
• Offline Bundle Format — the .stella.bundle.tgz evidence package.
• Air-Gap Importer Guide — staging bundles into a sealed install.