Feedser (consolidated into the Concelier domain, Sprint 203)

Relocation note: Feedser source code moved to src/Concelier/StellaOps.Feedser.* as part of the advisory-domain consolidation (Sprint 203, 2026-03-04). This page is kept as a live reference for the libraries; the original standalone docs are archived at docs-archive/modules/feedser/.

Feedser is the evidence-collection layer for backport detection and binary fingerprinting inside Stella Ops’ advisory pipeline. It is intended for engineers working on the Concelier backport-proof path and anyone integrating with the patch/binary evidence contracts.

Purpose

Feedser provides deterministic, cryptographic evidence collection for backport detection. It extracts patch signatures from unified diffs and binary fingerprints from compiled code to enable high-confidence vulnerability status determination for packages where upstream fixes have been backported by distro maintainers. It also hosts the determinization-pipeline signal attachers (EPSS, KEV) consumed by the advisory ingest path.

The module ships as two .NET 10 libraries under src/Concelier/:

• StellaOps.Feedser.Core(StellaOps.Feedser.Core.csproj) - patch-signature extraction (HunkSigExtractor), function-signature extraction (FunctionSignatureExtractor), and the signal-attacher subsystem under the StellaOps.Feedser.Core.Signals namespace. References StellaOps.Eventing only (no external service dependency).
• StellaOps.Feedser.BinaryAnalysis(StellaOps.Feedser.BinaryAnalysis.csproj) - binary fingerprinting (BinaryFingerprintFactory, IBinaryFingerprinter). No project or external dependencies.

Quick Links

• Architecture - Technical design and implementation details

Status

Key Features

• Patch Signature Extraction: HunkSigExtractor.ExtractFromDiff(...) parses unified diffs and emits a normalized PatchSignature (record fields: PatchSigId, CveId, UpstreamRepo, CommitSha, Hunks, HunkHash, AffectedFiles, AffectedFunctions, ExtractedAt, ExtractorVersion). Normalization strips whitespace/comments; the PatchSigId is sha256:{hunkHash}. Extractor version is currently 1.0.0.
• Function Signature Extraction: FunctionSignatureExtractor.ExtractFunctionsFromContext(...) derives affected function names from hunk context for Tier 3/4 matching.
• Binary Fingerprinting: BinaryFingerprintFactory produces BinaryFingerprint records. The FingerprintMethod enum declares TLSH, CFGHash, InstructionHash, SymbolHash, SectionHash, but the factory currently registers only two fingerprinters: SimplifiedTlshFingerprinter (TLSH fuzzy hashing) and InstructionHashFingerprinter (instruction sequence hashing). MatchBestAsync(...) returns the highest-confidence FingerprintMatchResult (IsMatch, Similarity, Confidence, MatchedFingerprintId, Method, MatchDetails).
• Signal Attachers (determinization pipeline): ISignalAttacher<TInput, TSignal> in StellaOps.Feedser.Core.Signals, with concrete EpssSignalAttacher (SignalType = "epss", 24h TTL) and KevSignalAttacher. Results are wrapped in SignalState<T> carrying a SignalStatus (Available, NotFound, Failed, Pending, Expired, NotConfigured) and SignalUpdatedEvents are emitted via ISignalEventEmitter. Register via SignalAttacherServiceExtensions.AddSignalAttachers().
• Tier 3/4 Evidence Contribution: Feedser supplies source-patch (Tier 3) and compiled-binary (Tier 4) evidence. The multi-tier proof model itself is defined and assembled by the consuming StellaOps.Concelier.ProofService / StellaOps.Concelier.BackportProof, not by Feedser.
• Deterministic Outputs: Stable SHA-256 hashing (ComputeSha256, ordinal sorting of hunks/files) for reproducible signatures.

Dependencies

Upstream (this module depends on)

• StellaOps.Eventing (internal library, used by Feedser.Core for signal event emission). No external service dependencies.

Downstream (modules that depend on this)

Verified ProjectReferences into the Feedser libraries:

• StellaOps.Concelier.ProofService- references Feedser.Core + Feedser.BinaryAnalysis; assembles backport proofs (BackportProofService).
• StellaOps.Concelier.ProofService.Postgres- references Feedser.BinaryAnalysis (persists BinaryFingerprintEntity, ChangelogEvidenceEntity).
• StellaOps.Attestor.ProofChain- references Feedser.Core + Feedser.BinaryAnalysis for proof-chain evidence.
• StellaOps.Scanner.PatchVerification- references Feedser.Core + Feedser.BinaryAnalysis for patch verification during scans.

Notes

Feedser is a pair of libraries (Feedser.Core, Feedser.BinaryAnalysis), not a standalone service. It exposes no REST APIs, no CLI commands, and owns no persistence schema of its own (fingerprint/evidence entities are persisted by the consuming StellaOps.Concelier.ProofService.Postgres). It does not make vulnerability decisions. The patch/binary evidence feeds the Concelier backport-proof path; the EPSS/KEV signal attachers feed the advisory determinization pipeline.

Related Documentation

• Concelier Architecture