Product CSAF Notify Channel

Scope: Stella’s outbound CSAF 2.0 feed for product advisories about Stella Ops itself.
Runtime: src/Notify/__Libraries/StellaOps.Notify.Connectors.Csaf/
Contract: docs/contracts/stella-product-csaf-advisory-v1.md
Fixture: docs/samples/product-advisories/STELLA-2026-0001.product-advisory.json

Runtime Shape

ProductCsafFeedChannel performs the local/offline publication path:

  1. Normalize and validate a stella.ops/productCsafAdvisory@v1 advisory.
  2. Project it to canonical CSAF 2.0 JSON.
  3. Validate the projected document against the local official oasis-csaf-2.0 schema package under docs/contracts/schemas/eu/csaf/2.0/.
  4. DSSE-wrap the canonical CSAF bytes using payload id product-csaf-advisory-v1. Production signing uses ProductCsafSignerPipelineAdvisorySigner, which sends the direct CSAF JSON payload through Signer’s SigningRequest.DirectPayload path rather than wrapping it in an in-toto statement.
  5. Verify the DSSE envelope through Signer Core EuArtifactOfflineVerifier.
  6. Write an operator filesystem feed drop:
    • feed.json
    • advisories/<advisoryId>.csaf.json
    • advisories/<advisoryId>.csaf.json.dsse.json

Router remains the owner of public /.well-known/* and feed URL routing. This connector does not publish live public endpoints.

Delivery Ledger

The delivery ledger entry is queued after the signed feed artifact is prepared. Metadata includes the CSAF payload hash, DSSE envelope hash, signer fingerprint, signer audit id when supplied, payload type id, schema pin, signer profile, signature algorithm, active crypto profile when supplied by Signer metadata, and local/official schema-validation status.

Official CSAF JSON Schema validation must be passed before signing. The connector verifies the pinned OASIS CSAF and FIRST CVSS schema files locally, disables runtime schema fetches, and fails closed if the schema package is missing, incomplete, hash-mismatched, or if the projected CSAF document is invalid. The connector still performs deterministic local validation first so malformed Stella source advisories fail before official schema evaluation.

Offline Verification

Trust roots are local only. A valid verification request requires a manufacturer trust root whose signer profile contains stella-manufacturer-release. Signer pins the primary DSSE signing algorithm from its active crypto profile (fips, eidas, gost, sm, or pq) before resolving provider-backed key material. Tests generate keys in memory and do not commit private key material.

Tampered payloads must fail closed; the adjacent tests assert that post-signature payload changes produce deterministic verifier failures.