Binary Micro-Witness Golden Demo

This bundle demonstrates binary-level patch verification using StellaOps micro-witnesses.

Overview

Binary micro-witnesses provide cryptographic proof that a specific binary contains (or doesn’t contain) a security fix. This enables auditors and procurement teams to verify patch status without source code access.

Contents

binary-micro-witness/
├── README.md                    # This file
├── witnesses/
│   ├── openssl-cve-2024-0567.json    # Sample witness for OpenSSL CVE
│   └── libcurl-cve-2023-38545.json   # Sample witness for curl CVE
├── verify.ps1                   # PowerShell verification script
├── verify.sh                    # Bash verification script
└── CHECKSUMS.sha256             # Deterministic checksums for all files

Quick Start

Windows (PowerShell)

.\verify.ps1 -WitnessPath witnesses\openssl-cve-2024-0567.json

Linux/macOS (Bash)

chmod +x verify.sh
./verify.sh witnesses/openssl-cve-2024-0567.json

Threat Model & Scope

What Micro-Witnesses Prove

What Micro-Witnesses Do NOT Prove

Limitations

Offline Verification

This bundle is designed for air-gapped environments:

  1. No network access required
  2. All verification logic is self-contained
  3. Checksums allow integrity verification

Predicate Schema

Witnesses follow the https://stellaops.dev/predicates/binary-micro-witness@v1 schema:

{
  "schemaVersion": "1.0.0",
  "binary": {
    "digest": "sha256:...",
    "filename": "libssl.so.3",
    "arch": "linux-amd64"
  },
  "cve": {
    "id": "CVE-2024-0567",
    "advisory": "https://..."
  },
  "verdict": "patched|vulnerable|inconclusive",
  "confidence": 0.95,
  "evidence": [
    {
      "function": "SSL_CTX_new",
      "state": "patched",
      "score": 0.97,
      "method": "semantic_ksg"
    }
  ],
  "tooling": {
    "binaryIndexVersion": "2.1.0",
    "lifter": "b2r2",
    "matchAlgorithm": "semantic_ksg"
  },
  "computedAt": "2026-01-28T12:00:00Z"
}

Reproduction

To regenerate witnesses using the StellaOps CLI:

# Generate a witness
stella witness generate /path/to/libssl.so.3 --cve CVE-2024-0567 --output witness.json

# Verify a witness
stella witness verify witness.json --offline

# Create an air-gapped bundle
stella witness bundle witness.json --output ./bundle

Version Information