Concelier Astra Linux Connector — Operations Runbook

Last updated: 2026-05-10

Audience: Stella Ops operators running the Concelier Astra Linux connector.

1. Overview

The Astra Linux connector ingests official Astra OVAL XML definitions into Concelier canonical advisories. The connector is production-wired, but the source catalog remains disabled by default for export-control/operator approval reasons. Operators must explicitly enable the astra source before any public or local mirror payloads are ingested.

Host reachability evidence in docs/qa/feature-checks/runs/2026-05-09-host-connectivity-aggregation/REPORT.md shows both current x86-64 feeds respond to ranged reads with HTTP 206 and application/xml:

https://download.astralinux.ru/astra/oval/1.7_x86-64/oval-definitions-alse-1.7.xml
https://download.astralinux.ru/astra/oval/1.8_x86-64/oval-definitions-alse-1.8.xml

Do not commit downloaded OVAL payloads into the repository. Feed payloads are large and upstream redistribution terms have not been reviewed for vendoring. Air-gapped deployments should stage operator-managed XML or ZIP payloads outside the repo and retain transfer/provenance metadata with the deployment evidence.

1.1 Data Source

Format: OVAL XML (Open Vulnerability and Assessment Language)
Source: Astra Linux official OVAL repository
Coverage: Astra Linux SE packages
Versioning: Debian EVR format
Connector source name: distro-astra
Catalog/configuration key: astra (aliasing normalizes distro-astra to astra in source catalog flows)

1.2 Default Gate

The migration seed keeps the source row disabled:

UPDATE vuln.sources SET enabled = true WHERE key = 'astra';

Only run that change after the jurisdiction/export-control decision is approved. Local seed fallback does not bypass this source-level gate.

2. Configuration

concelier:
  sources:
    astra:
      bulletinBaseUri: "https://astra.ru/en/support/security-bulletins/"
      ovalRepositoryUri: "https://download.astralinux.ru/astra/oval/"
      ovalFeedUris:
        - "https://download.astralinux.ru/astra/oval/1.7_x86-64/oval-definitions-alse-1.7.xml"
        - "https://download.astralinux.ru/astra/oval/1.8_x86-64/oval-definitions-alse-1.8.xml"
      maxDefinitionsPerFetch: 100
      requestTimeout: "00:02:00"
      failureBackoff: "00:15:00"
      offlineSeedEnabled: false
      offlineSeedPath: null
      offlineSeedOperatorChecked: false

Option	Default	Description
`ovalRepositoryUri`	`https://download.astralinux.ru/astra/oval/`	Base URL for current Astra OVAL downloads.
`ovalFeedUris`	1.7 and 1.8 x86-64 XML feeds	Concrete feeds fetched by the connector.
`maxDefinitionsPerFetch`	100	Per-payload cap; definitions beyond the cap are logged as dropped by cap.
`offlineSeedEnabled`	`false`	Explicit operator approval to use local mirror/offline payload fallback.
`offlineSeedPath`	`null`	Raw `.xml`, `.zip`, or directory containing XML/ZIP payloads.
`offlineSeedOperatorChecked`	`false`	Marks local payloads as `operator_checked_mirror`; otherwise they are `mirror_unverified`.
`offlineCachePath`	`null`	Legacy alias for `offlineSeedPath`; still requires `offlineSeedEnabled=true`.

3. Ingestion Behavior

Fetch configured official ovalFeedUris.
Parse OVAL definitions and preserve inline Astra package comments such as libfoo DPKG is earlier than 1.2.3-1+astra4.
Map definitions to canonical advisories with Debian EVR version ranges.
Persist the OVAL XML source document and advisory provenance.
If any official feed fails and offlineSeedEnabled=true, read the operator-managed seed path as fallback.

Seed fallback accepts:

A raw OVAL .xml file.
A .zip archive containing one or more .xml entries.
A directory scanned recursively for .xml and .zip files in deterministic path order.

4. Provenance and Trust Metadata

Every retained source document includes Astra-specific metadata:

astra.authority=Astra Linux OVAL
astra.retrievedFrom=official-astra-linux-oval or operator-managed-astra-oval-seed
astra.officialVerified=true|false
astra.vendorVerificationState=verified|not_verified_against_vendor
astra.trustLevel=official_vendor|operator_checked_mirror|mirror_unverified
astra.operatorChecked=true|false
astra.rawSha256=<payload digest>

Canonical advisory provenance carries the same decision reason so downstream evidence can distinguish direct official fetches from operator-managed mirror/offline payloads.

5. Diagnostics

Fetch logs include per-feed and summary counters:

fetchedDefinitions
parsedAdvisories
droppedDefinitions
droppedSeedItems
retrievedFrom
officialVerified
trustLevel

These counters make cap drops, invalid ZIP entries, duplicate seed entries, and parse failures visible without requiring direct database inspection.

6. Common Failure Modes

Symptom	Cause	Resolution
Source produces no rows	`vuln.sources.enabled=false`	Confirm operator approval, then enable the `astra` source.
Official fetch timeout	Large OVAL file or restricted network	Increase `requestTimeout` or stage an approved local seed.
Local seed ignored	`offlineSeedEnabled=false`	Set `offlineSeedEnabled=true` after approval.
Local seed trust is `mirror_unverified`	Operator did not mark the seed checked	Set `offlineSeedOperatorChecked=true` only after verifying the mirror/transfer record.
`OvalParseException`	Malformed or non-OVAL XML	Replace the seed payload and keep the failed digest for incident review.

Connector architecture
Conflict resolution runbook
Host connectivity aggregation report
Astra implementation sprint (archived)
Astra mirror seed sprint (archived)