Risk Bundle Provider Matrix & Signing Baseline

Audience: Export Center engineers and operators who build, sign, or verify risk bundles. Purpose: Define the canonical set of risk-data providers that feed a StellaOps risk bundle, their offline-ready sources and refresh cadences, and the deterministic signing and verification baseline that makes bundles reproducible and tamper-evident.

Risk bundles aggregate exploit and vulnerability-scoring feeds (KEV, EPSS, OSV, vendor CSAF) into a signed, offline-portable archive. Determinism is the contract: identical inputs must yield identical manifests and signatures across reruns. The tables and rules below define how providers are ordered, hashed, signed, and validated.

Status (verified against commit 942a18727c, 2026-09-26). Provider ids known to RiskBundleJobHandler (src/OfflineKit/__Libraries/StellaOps.ExportCenter.Application/RiskBundle/): mandatory cisa-kev; optional nvd, osv, ghsa, epss. The earlier first-epss id and the vendor-csaf provider have no implementation. Job options are includeOsv, allowMissingOptional and allowStaleOptional (RiskBundleJobSubmitRequest). Cadences and the signing/validation rules below were not re-verified.

Provider catalog (deterministic ordering)

Provider ID	Source feed (offline-ready)	Coverage	Refresh cadence	Signing / integrity	Notes
cisa-kev	CISA Known Exploited Vulnerabilities JSON	Exploited CVEs with required/known exploited flag	Daily	DSSE signature using ExportCenter signing key; feed hash recorded in `provider-manifest.json`	Mandatory; fails bundle if feed missing or hash mismatch.
epss	FIRST EPSS CSV snapshot	Probability scores per CVE	Daily	DSSE signature; SHA-256 of snapshot stored in manifest	Optional; omit if snapshot stale >48h unless `allowStaleOptional=true`.
osv	OpenSSF OSV bulk JSON (per-ecosystem shards)	OSS advisories with affected package ranges	Weekly	DSSE signature; per-shard SHA-256 list	Included only when `includeOsv=true` in job options to keep bundle size constrained.
nvd	NIST National Vulnerability Database	CVE records	not specified	SHA-256 recorded in manifest	Optional.
ghsa	GitHub Security Advisory database	OSS advisories	not specified	SHA-256 recorded in manifest	Optional.

Manifest baseline

Generate provider-manifest.json with sorted provider entries. Fields per provider: {id, source, snapshotDate, sha256, signaturePath, optional}.
Store DSSE envelope for provider-manifest.json at signatures/provider-manifest.dsse (cosign/KMS).
Include provider digests in manifests/provenance.json materials array with URI risk-provider://<id>/<snapshotDate>.

Signing baseline

Use Export Center signing path (cosign + Authority KMS) for:
- provider-manifest.json (DSSE)
- Aggregated risk-bundle.tar.* (detached signature risk-bundle.sig)
Vendor-provided signatures (when present) are preserved inside providers/<id>/ and referenced from provider-manifest.json.
Rekor publishing remains optional; default off for offline kits (rekor_publish=false).

Validation rules (bundle build)

Fail build if any mandatory provider (currently cisa-kev) is missing or hash mismatch.
Warn (non-fatal) when optional providers are stale beyond cadence unless allowStaleOptional=true.
Deterministic ordering: providers sorted by id; files sorted lexicographically inside bundle.
Record bundle-level inputs hash combining provider SHA-256 values (stable ordering) and include in provenance materials[].

Verification workflow alignment

CLI stella risk bundle verify must validate:
- DSSE on provider-manifest.json
- Hash match for each provider snapshot
- Presence (or allowed absence) per optional flag
- Detached signature on bundle archive (cosign/KMS)
Offline verification uses bundled public key (signatures/pubkeys/<tenant>.pem).

Planned work

Add test fixtures: minimal provider snapshots (KEV + EPSS) with fixed hashes for deterministic regression tests.
Update the Export Center worker to emit provider-manifest.json and its DSSE envelope through the existing signing pipeline.
Extend the CLI verify command to surface per-provider status (missing/stale/hash mismatch) and exit non-zero on mandatory-provider failures.

Export Center KMS Envelope Pattern: envelope encryption primitives.
Risk bundles in air-gapped estates: build routes and the stella risk bundle verify verb.