Tsim pipeline ceeb toom package phem thiab rollback

Lub hom phiaj yuav tsum ua tiav: ib qho pipeline uas txais tau ceeb toom txog package phem, khaws pov thawj qub, txheeb xyuas qhov chaw, nrhiav package thiab version uas raug cuam tshuam, tshaj tawm qhov kev txiav txim uas muaj version, thiab thim rov qab yam tsis rho keeb kwm tawm. Qhov qauv no haum rau pab pawg uas twb muaj manifest, lockfile, SBOM lossis artifact inventory lawm, tab sis tseem tab tom daws cov ceeb toom sib cais.

Nov yog ib tsab lus qhia txog architecture thiab workflow, tsis yog ib qho khoom siv uas nruab tau tam sim. Koj tseem yuav tsum xaiv event store, database, queue thiab policy-execution system uas haum rau koj ib puag ncig. Tsis tsim nyog txuas qhov kev nqis tes ntawd block mus rau production txij thaum pib; pib nrog quarantine thiab monitor, ces kuaj txoj kev kuaj pom, txoj kev tsis lees txais kom nyab xeeb thiab txoj kev rov kho.

1. Txiav txim qhov txiaj ntsig ua ntej xaiv technology

Qhov txiaj ntsig ntawm pipeline yuav tsum tsis yog tsuas yog “tau txais ceeb toom lawm”. Nws yuav tsum yog ib qho kev txiav txim txog kev ruaj ntseg uas muaj version, uas taug rov qab mus rau pov thawj tau thiab siv tau rau ib thaj tsam meej.

allow: tseem tsis muaj pov thawj txaus los txwv package lossis version;
monitor: muaj teeb liab yuav tsum tau soj ntsuam ntxiv, tab sis tseem tsis txaus los thaiv;
quarantine: cov ntaub ntawv tseem tsis dhau qhov kev kuaj thiab tseem tsis tau tso cai hloov policy;
investigate: cov ntaub ntawv tsis sib haum, tsis muaj provenance txaus lossis tseem tsis tau txheeb xyuas thaj tsam;
block: package lossis version raug thaiv thaum nruab, build, tso tawm lossis nkag mus rau registry;
withdrawn: qhov ceeb toom raug thim lossis hloov kho, tab sis tseem khaws pov thawj thiab keeb kwm cia.

Txhua qhov kev txiav txim yuav tsum teb tau cov lus nug hauv qab no:

Lus nug	Cov ntaub ntawv uas tsim nyog muaj
Package twg raug ceeb toom?	`ecosystem`, `package_name`, `purl`
Version twg raug cuam tshuam?	`versions` lossis range `introduced`/`fixed`
Leej twg yog qhov chaw muab qhov kev xaus?	`source`, `source_url`, `source_record_id`
Cov ntaub ntawv puas ntseeg tau txaus rau kev ua?	`provenance`, payload hash, xwm txheej ntawm signature, lub sijhawm tau txais
Qhov kev txiav txim twg tseem siv tau?	`decision`, `decision_version`, `effective_at`
Yuav rov qab mus rau lub xeev twg tau?	`previous_snapshot_id`, `rollback_state`

Tsis txhob hloov severity kom dhau los ua ib qho kev txiav txim tsis siv neeg nkaus xwb. Package phem hauv production dependency, hauv CI runner installation script lossis tsuas nyob hauv cov ntaub ntawv sim yuav tsum muaj thaj tsam daws teeb meem sib txawv.

2. Cais pipeline ua ntau thaj tsam kev ntseeg siab

Ua daim qauv no ntawm qib architecture lossis workflow engine. Lub npe cuab yeej yuav yog Kafka, SQS, Pub/Sub, PostgreSQL, object storage lossis lwm qhov system; yam tseem ceeb yog ciam teb ntawm permission thiab state.

Ingest zone: txais webhook, file lossis API response. Cov ntaub ntawv hauv no tseem tsis tau ntseeg tau.
Evidence store: khaws payload qub, cov header uas tsim nyog, lub sijhawm txais, hash thiab cov xwm txheej txheeb xyuas.
Normalization zone: hloov cov ntaub ntawv mus rau ib qho qauv sib koom, tiam sis tseem khaws cov field tshwj xeeb ntawm txhua qhov chaw.
Decision zone: muab package, version, manifest, SBOM lossis artifact inventory los sib piv.
Action zone: tso tawm lus txwv, tsim ticket, xa ntawv ceeb toom lossis thov kom hloov credential.
Audit and rollback zone: khaws snapshot, keeb kwm kev hloov, laj thawj hloov kho thiab lub xeev uas rov qab tau.

Tsis txhob cia webhook lossis file uas rub los sau ncaj qha rau hauv table blocked_packages. Yog qhov chaw raug dag ntxias, xa record rov ua dua lossis kho lub sijhawm yav dhau los, nws yuav hloov tus cwj pwm ntawm lub system ua ntej raug kuaj.

3. Npaj input thiab kev tso cai nkag

Ua ntej sau adapter, txiav txim kom meej tias txhua txoj haujlwm yuav ua nyob qhov twg:

Hauv lub system ntawm qhov chaw muab ntaub ntawv: tsim token lossis webhook uas muaj scope tsawg tshaj plaws, qhib signature yog tus muab kev pab txhawb, thiab sau tseg API version.
Hauv ingest service: tsuas txais cov ntaub ntawv, kuaj qhov loj thiab txheeb xyuas signature; tsis pub muaj cai hloov production policy.
Hauv evidence store: qhib cai ntxiv nkaus xwb lossis object lock mechanism; tsuas yog pab pawg tshawb xyuas thiaj nyeem tau payload qub.
Hauv worker: ua parse, normalization thiab matching siv ib tus account cais; retry yuav tsum muaj limit.
Hauv lub system uas txais cov txiaj ntsig: tsuas txais decision uas twb tso tawm lawm, muaj version thiab correlation ID.

Cov input yam tsawg kawg yuav tsum muaj ib qhov chaw ceeb toom uas ruaj khov, ib qhov chaw khaws append-only lossis object lock, dependency inventory thiab ib qho chaw txais decision xws li CI/CD, registry proxy, ticket system lossis notification channel. Yog tseem tsis muaj inventory, pipeline tsuas hais tau tias “qhov chaw ntawd tau ceeb toom txog lub package no”; nws tseem txiav txim tsis tau tias package ntawd puas muaj nyob hauv koj lub system.

4. Tsim qauv ntaub ntawv uas khaws tau provenance

Provenance yog ib txoj saw ntaub ntawv uas pab taug qab rov qab tau tias payload twg raug txais, los ntawm qhov chaw twg, thaum twg, dhau parser thiab rule twg, thiab thaum kawg tsim decision twg. Hauv supply-chain security, provenance pab taug qab lub hauv paus thiab txoj kev tsim ib qho artifact; nws tsis yog pov thawj ncaj qha tias package muaj kev nyab xeeb (raws li SLSA Provenance: https://slsa.dev/spec/v1.2/provenance).

Nov yog ib qho event ua qauv qhia. Cov nqi evt_demo_001 thiab MAL-DEMO-001 tsuas yog cov ntaub ntawv xav ua piv txwv xwb, tsis yog tus ID ntawm ib qho xwm txheej tiag:

{
  "event_id": "evt_demo_001",
  "idempotency_key": "openssf:mal-demo-001:sha256:abc123",
  "correlation_id": "corr_demo_001",
  "source": {
    "name": "openssf-malicious-packages",
    "record_id": "MAL-DEMO-001",
    "retrieved_at": "2024-06-01T10:15:00Z",
    "url": "https://source.example/advisory/MAL-DEMO-001",
    "payload_sha256": "abc123",
    "signature_status": "verified"
  },
  "package": {
    "ecosystem": "npm",
    "name": "example-package",
    "purl": "pkg:npm/example-package",
    "affected_versions": ["1.4.2", "1.4.3"]
  },
  "classification": {
    "kind": "malicious_package",
    "confidence": "confirmed",
    "reason_codes": ["install_script", "credential_exfiltration"]
  },
  "processing": {
    "parser_version": "parser-1.0.0",
    "rule_set_version": "rules-1.0.0"
  },
  "decision": {
    "state": "block",
    "version": 7,
    "previous_snapshot_id": "snapshot_6"
  }
}

Khaws peb lub hauv paus ntsiab lus:

Tsis txhob sau dua payload qub: kev kho yuav tsum tsim event lossis revision tshiab thiab txuas nrog bản dhau los.
Tsis txhob siv package lub npe ua tus ID nkaus xwb: muab ecosystem txuas nrog tus identifier uas tsim nyog xws li purl; tib lub npe yuav tshwm sim hauv ntau ecosystem.
Cais kom meej cov version sib txawv: 1.4.3 version yog package lub version, revision yog advisory qhov kev hloov ib zaug, hos decision_version: 7 decision_version yog lub sijhawm uas lub system hloov nws qhov kev xaus.

5. Tsim workflow txais cov lus ceeb toom

5.1. Txais cov ntaub ntawv thiab tiv thaiv kev ua dua

Hauv adapter lossis handler, tsim idempotency_key. Xub xaiv tus ID ruaj khov uas qhov chaw muab. Yog qhov chaw ntawd tsis muaj ID, tsim tau tus key los ntawm source + record_id + payload_sha256. Ob payload uas zoo tib yam yuav tsum tau txais tib qho txiaj ntsig ua haujlwm; payload uas muaj hash txawv yuav tsum tsim revision tshiab es tsis txhob kho event qub.

Webhook yuav tsum txheeb xyuas signature raws li tus neeg muab kev pab cov ntaub ntawv qhia, txwv payload qhov loj, teeb timeout thiab tiv thaiv replay siv timestamp lossis nonce thaum qhov chaw ntawd txhawb mechanism ntawd. Handler yuav tsum tsuas sau tseg event thiab teb kom ceev; worker nyob tom qab mam ua parse thiab matching.

5.2. Khaws evidence ua ntej txheeb xyuas

Hauv evidence store, khaws payload qub nrog:

lub sijhawm txais thiab lub sijhawm qhov chaw tshaj tawm yog muaj;
HTTP status, content type thiab API version;
payload hash;
signature lossis txiaj ntsig ntawm kev txheeb xyuas;
account, workload identity lossis credential uas txais cov ntaub ntawv;
parser version thiab rule set uas siv;
xws li received, validated, quarantine lossis fetch_failed.

Yog kev rub tau cov ntaub ntawv tsis tiav, khaws cia rau hauv qhov xwm txheej fetch_failed; tsis txhob txhais qhov xwm txheej no tias “tsis muaj kev ceeb toom”. Ob qho no yog ob qho kev xaus txog kev ruaj ntseg uas sib txawv.

5.3. Npaj cov ntaub ntawv raws li OSV, tiam sis tsis txhob plam cov teb los ntawm qhov chaw

Feem npaj cov ntaub ntawv yuav tsum muaj ob txheej:

Canonical fields: ecosystem, package, version lossis version range, hom kev ceeb toom, lub sijhawm siv tau thiab xwm txheej.
Source-specific fields: cov teb tshwj xeeb ntawm OpenSSF, GitHub lossis lwm qhov chaw, khaws cia hauv JSON uas muaj version.

Cov ntawv ceeb toom uas siv qauv OSV feem ntau qhia txog package, version lossis version range uas raug cuam tshuam, cov lus piav qhia ntxaws thiab cov ntaub ntawv siv txuas mus ntxiv. Txawm li ntawd los, tsis yog txhua advisory yuav muaj CVSS, version kho lossis thaj tsam tiav. Yog li, yuav tsum khaws tus nqi uas ploj lawm ua “tsis tau paub”; tsis txhob cia li hloov ua “tsis muaj”.

Piv txwv ntawm kev qhia ib qho version range hauv tus qauv sab hauv:

{
  "range_type": "ECOSYSTEM",
  "introduced": "1.4.2",
  "fixed": null,
  "source_expression": "versions: 1.4.2, 1.4.3"
}

Khaws cia source_expression kom siv tshawb xyuas thaum parser txhais txawv ntawm qhov chaw. Tsis txhob cia li xam tias fixed tsuas yog vim tsis tau muaj ib qho version tshiab dua hauv daim ntawv ceeb toom.

5.4. Tshawb xyuas ua ntej tshaj tawm

Tus worker npaj cov ntaub ntawv yuav tsum khiav yam tsawg plaub txheej kev kuaj:

Schema validation: JSON siv tau, cov teb uas yuav tsum muaj yog hom raug, thiab enum nyob hauv daim npe uas tso cai.
Semantic validation: ecosystem phim tus cim qhia package, versions tsis sib haum xeeb, thiab version range siv tau raws li cov cai ntawm ecosystem ntawd.
Provenance validation: qhov chaw, hash, kos npe lossis cai nkag tau yuav tsum kuaj tau.
Change validation: qhov kev hloov kho yuav tsum txuas nrog revision dhau los, muaj actor lossis workload uas tsim qhov kev hloov thiab muaj laj thawj hloov.

Yog ib txheej twg ua tsis tiav, muab event tso rau quarantine. Tsis txhob tso tseg tag nrho qhov chaw tsuas yog vim ib record muaj teeb meem; thiab tsis txhob tshaj tawm record uas tseem tsis tau kuaj ib yam li twb siv tau lawm.

6. Muab kev ceeb toom piv nrog inventory tiag tiag

Ua cov kauj ruam no hauv matcher, tom qab event dhau validation lawm. Kev ceeb toom tsuas hloov ua qhov pheej hmoo tshwj xeeb thaum muab piv nrog koj lub inventory. Cov chaw muab inventory yuav yog:

SBOM ntawm artifact lossis image;
manifest thiab lockfile ntawm repository;
dependency graph;
chaw khaws package sab hauv;
daim npe artifact uas twb deploy lawm;
cache ntawm runner lossis tshuab build.

Muab piv hauv peb theem:

Kev txheeb xyuas tus kheej: ecosystem, package name thiab purl puas phimกัน?
Version: version uas tab tom siv puas nyob hauv cov version lossis version range uas raug cuam tshuam?
บริบท: dependency puas yog runtime, development, test, build tool lossis tsuas tshwm hauv cache xwb?

GitHub Dependabot muab cov ntaub ntawv kev ceeb toom los ntawm interface thiab REST API, uas muaj cov teb xws li package, ecosystem, manifest path, scope thiab kev sib raug direct/transitive (raws li REST API endpoints for Dependabot alerts: https://docs.github.com/en/rest/dependabot/alerts). Txawm li ntawd los, Dependabot alerts tsis suav nrog txhua yam teeb meem, thiab advisory txog package muaj malware tsis tas yuav tsim alert raws tib lub tshuab uas vulnerability advisory ib txwm siv (raws li Global security advisories: https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/global-security-advisories).

Koj tuaj yeem pib ntawm repository alerts, ces nthuav mus rau cov chaw tshwj xeeb dua. Saib ntxiv txog txoj kev qhib Dependabot malware alerts hauv GitHub kom ua tiav txheej txheeb xyuas ntawm repository; zaj no tsom rau ingestion, provenance thiab rollback.

7. Xaiv kev nqis tes raws li qib kev ntseeg tau thiab thaj tsam cuam tshuam

Policy engine yuav tsum txais ob qho tib si: qhov chaw cov ntaub ntawv muaj kev ntseeg siab npaum li cas, thaj tsam ntawm package thiab lub ntsiab lus siv. Tsis txhob siv ib txoj cai xwb xws li “malware = rho package tawm”.

Qhov xwm txheej	Kev nqis tes nyab xeeb thaum pib	Thaum twg yuav nce qib
Tau txheeb xyuas tias package thiab version muaj malware hauv production	Thaiv cov version tshiab, cais cov artifact cuam tshuam thiab qhib incident	Tshawb xyuas keeb kwm kev khiav, credential thiab artifact uas twb tshaj tawm lawm
Package tsuas yog nyob hauv development dependency	Thaiv CI, tsim ticket kom hloov kho lossis rho tawm	Nce qib yog tias installation script khiav ntawm runner uas muaj secret
Qhov chaw muaj ntaub ntawv tsis sib haum lossis tsis muaj provenance txaus	Muab tso rau hauv quarantine thiab ceeb toom pab pawg security	Xav txog kev thaiv ib ntus yog package tab tom yuav tso tawm thiab qhov pheej hmoo siab
Tshem qhov ceeb toom rov qab	Tsim ib qho correction event thiab hloov decision mus rau `withdrawn`	Rov qab siv `allow` lossis `monitor` tom qab kuaj xyuas lwm cov rule

Yog package tau khiav saum ib qho runner uas muaj token, tshem package tawm tsis tau txhais tias lub tshuab twb huv lawm. Tej zaum yuav tsum revoke thiab tsim credential tshiab, kuaj access log, tshuaj xyuas cov artifact uas tsim tawm thiab ntsuas persistence. Qhov no yog incident response; tsis tsim nyog cia li automate tag nrho raws ib qho severity field xwb.

8. Tsim rollback kom tsis txhob rho cov pov thawj

Rollback yuav tsum rov qab kho lub xeev uas tab tom muab kev pab, tsis yog rho keeb kwm tawm. Ua raws li cov theem no:

Ua ntej tshaj tawm decision tshiab, tsim ib qho snapshot uas hloov tsis tau, piv txwv li snapshot_42.
Txuas decision tshiab rau previous_snapshot_id.
Tshaj tawm index tshiab uas tus lej version nce raws ib theem.
Thaum pom tias muaj qhov yuam kev, tsim ib qho correction event uas taw mus rau advisory thiab snapshot uas cuam tshuam.
Khiav matcher dua rau inventory tam sim no thiab kuaj xyuas lwm cov rule.
Pom zoo snapshot uas yuav siv, thiab sau tus actor, qhov laj thawj thiab lub sijhawm.
Tshaj tawm snapshot ntawd mus rau cov system uas siv nws thiab xa correction notification.

Piv txwv xav txog:

snapshot_41: allow example-package@1.4.3
snapshot_42: block example-package@1.4.3
snapshot_43: withdrawn MAL-DEMO-001
active_snapshot: snapshot_43

Hauv qhov piv txwv no, lub system tsis rho snapshot_42. Nws tsuas hloov lub xeev uas siv rau tam sim no mus rau snapshot_43. Yog li pab pawg tseem paub tias vim li cas thiaj tau thaiv version ntawd, leej twg tau tshaj tawm decision thiab thaum twg thiaj tau hloov kho advisory.

Kuaj xyuas ua ntej rollback

Puas yog advisory raug tshem tawm tiag tiag, los yog tsuas hloov thaj tsam ntawm cov version xwb?
Rule tam sim no puas tseem tab tom thaiv package vim muaj lwm qhov source?
Puas muaj artifact twg tau raug tso tawm thaum lub sijhawm ceeb toom tseem siv tau?
Rollback puas tsuas hloov daim ntawv lo ntawm inventory, los yog tseem qhib cai rau nruab hauv CI/CD thiab?
Puas yuav tsum khaws deny rule ib ntus rau ib qho package lossis registry twg?

Rollback tsuas hloov cov ntaub ntawv thiab decision ntawm pipeline xwb. Nws tsis rov qab kho credential uas tau xau, tsis rho payload uas twb khiav lawm thiab tsis lav tias lub tshuab twb huv lawm.

9. Siv event-driven workflow tab sis tseem tuav kev tswj

Hauv workflow engine lossis queue system, kev ua haujlwm yuav khiav raws li no:

source webhook/file/API
        |
        v
raw evidence store
        |
        v
schema + provenance validation
        |
        v
normalizer
        |
        v
package/version matcher
        |
        v
policy decision
        |
        v
quarantine | monitor | block | investigate
        |
        v
notification, ticket, CI/CD gate, audit log

Txhua theem yuav tsum teev kom meej:

input contract: yuav txais cov ntaub ntawv hom twg;
output contract: yuav tsim event twg;
retry policy: yog muaj qhov yuam kev ib ntus, yuav rov sim dua pes tsawg zaug;
dead-letter path: cov ntaub ntawv uas ua tsis tau yuav mus rau qhov twg;
correlation ID: siv los taug qab txij ntawm advisory mus txog qhov kev nqis tes kawg;
owner: pab pawg uas yuav lav ris thaum parser lossis policy muaj teeb meem.

Tsis txhob cia worker retry tsis kawg nrog tib payload. Thaum txog tus naj npawb uas tau teeb tseg, khaws qhov yuam kev ua qauv thiab hloov event mus rau dead-letter queue kom tib neeg ua manually. Yog tsis ua li ntawd, ib qho advisory uas format tsis raug yuav ua rau tag nrho pipeline txhaws.

10. Tiv thaiv pipeline nws tus kheej kom tsis raug siv tawm tsam

Pipeline muaj peev xwm hloov policy, hu rau repository API thiab xa notification, yog li yuav tsum tiv thaiv nws ib yam li ib qho system tseem ceeb. Cov kev tswj hwm yam tsawg kawg muaj xws li:

account ingest tsuas muaj cai sau rau hauv raw evidence thiab nyeem metadata uas tsim nyog xwb;
worker uas normalize tsis tau muab cai rau nws tus kheej los hloov production policy;
cai tshaj tawm block lossis rollback yuav tsum cais tawm ntawm cai kho parser;
tsis pub secret tshwm hauv payload, log lossis notification;
cov URL siv xa mus rau hauv advisory yuav tsum xam tias yog cov ntaub ntawv tsis ntseeg tau; zam SSRF thaum cia li nkag mus saib;
parser yuav tsum txwv qhov loj, JSON qhov tob, cov version lub naj npawb thiab lub sijhawm ua haujlwm;
txhua qhov hloov policy yuav tsum muaj review, version thiab txoj kev rov qab mus rau policy yav dhau los;
yuav tsum rov ntsuam xyuas decision thaum source hloov kho advisory.

Provenance pab taug qab tau tias artifact raug tsim los ntawm qhov twg thiab tsim li cas, tab sis nws tsis yog pov thawj tias package tsis muaj malware. Tseem yuav tsum muab provenance txuas nrog inventory, kev tshuaj xyuas tus cwj pwm, runtime permissions thiab cov ntaub ntawv daws teeb meem thaum muaj xwm txheej.

11. Kuaj txais yuav ua ntej qhib kev thaiv tsis siv neeg

Ua cov kev kuaj no hauv ib puag ncig sim siv cov fixture uas tsim los sim, tsis txhob pib nrog advisory tiag:

Xa ob tsab xov xwm uas zoo tib yam thiab txheeb xyuas tias qhov tshwm sim yog idempotent, tsis tsim ob qho kev ua.
Hloov cov ntsiab lus ntawm advisory kom txheeb xyuas tias revision tshiab tsis sau dhau raw evidence qub.
Xa ib record uas tsis muaj package lossis ecosystem thiab txheeb xyuas tias record raug xa mus rau quarantine.
Muab ib package nyob rau hauv version uas raug cuam tshuam piv nrog ib version uas tsis raug cuam tshuam.
Thim advisory thiab txheeb xyuas tias muaj correction event, active snapshot tshiab thiab audit trail.
Khiav rollback thiab txheeb xyuas tias snapshot qub tseem nyeem tau thiab lwm cov rule tseem raug siv.
Xa tib qho kev ceeb toom txog ib package los ntawm ob qhov chaw thiab txheeb xyuas tias lawv raug muab sau ua ke raws tus yuam sij canonical, tab sis tseem khaws cov npe ntawm txhua qhov chaw.
Ua rau parser lossis source timeout thiab txheeb xyuas retry/dead-letter path.
Kuaj kom paub tseeb tias daim ntawv ceeb toom muaj correlation ID, package, version, laj thawj thiab qhov kev ua uas tau pom zoo.
Ntxiv ib package los ntawm lwm ecosystem rau hauv fixture thiab txheeb xyuas tias rule tsis thaiv tag nrho ecosystem yuam kev.
Kuaj permissions kom ntseeg tau tias ingest tsis tuaj yeem hloov production policy ntawm nws tus kheej yog tseem tsis tau dhau qhov kev pom zoo.

Tsuas qhib kev thaiv tsis siv neeg tom qab peb txoj kev khiav no twb muaj cov txiaj ntsig uas pom tau lawm: nrhiav tau raug, tsis lees txais yam nyab xeeb thaum cov ntaub ntawv muaj teeb meem thiab rov qab tau thaum qhov kev txiav txim tsis raug.

12. Txoj kev siv uas haum rau cov neeg pib tshiab

Theem 1 — evidence: txais ib qhov chaw, khaws raw payload uas hloov tsis tau, tsim hash thiab correlation ID.
Theem 2 — normalization: txhawb ecosystem, package, version, status thiab provenance; tseem tsis txhob thaiv tsis siv neeg.
Theem 3 — matching: txuas SBOM, lockfile lossis dependency graph kom paub tias package puas muaj tiag hauv lub system.
Theem 4 — kev txiav txim: tshaj tawm monitor, investigate thiab block ua raws li policy uas muaj version.
Theem 5 — rollback: ntxiv snapshot, correction event, kev pom zoo thiab kev kuaj rov qab.
Theem 6 — nthuav ntxiv: ntxiv GitHub, OpenSSF, registry lossis qhov chaw sab hauv; txhua qhov chaw yuav tsum muaj nws tus adapter thiab fixture set.

Txoj kev siv no qeeb dua li kev sau ib webhook uas sau ncaj qha rau hauv daim ntawv teev block, tab sis nws txo qhov pheej hmoo ploj ntawm txoj kab taug qab thiab tso cai kho parser, policy lossis qhov chaw ntaub ntawv yam tsis tas rov tsim tag nrho lub system.

13. Checklist ua tiav

Raw payload raug khaws rau hauv thaj chaw uas tsuas ntxiv tau, nrog hash, lub sijhawm txais thiab verification status.
Txhua event muaj idempotency key, correlation ID thiab parser/rule version.
Data model cais package version, advisory revision thiab decision version.
Schema, semantic, provenance thiab change validation txhua yam muaj error status uas qhia meej.
Advisory raug muab piv nrog SBOM, lockfile, dependency graph lossis artifact inventory.
Policy muaj cov status quarantine, monitor, investigate, block thiab withdrawn uas tsim nyog.
Rollback siv snapshot lossis correction event, tsis txhob rho evidence.
Retry muaj qhov txwv, muaj dead-letter path thiab muaj tus owner saib xyuas.
Twb tau kuaj duplicate event, advisory correction, parser failure, version range thiab rollback lawm.
Twb tau cais kev daws rollback ntawm cov ntaub ntawv tawm ntawm kev teb rau credential raug nyiag lossis lub tshuab uas twb tau khiav package lawm.

Xaus lus

Ib pipeline ceeb toom txog package muaj malware uas muaj peev xwm nrhiav tau thiab rov qab hloov tau yog ib lub system tswj evidence thiab kev txiav txim, tsis yog ib qho cuab yeej xa xov ceeb toom xwb. Qhov kev tsim qauv yam tsawg kawg yuav tsum muaj raw evidence uas hloov tsis tau, schema uas tau normalize, provenance, package identification uas meej, kev muab piv nrog inventory, policy uas muaj version, snapshot thiab audit trail.

Lub hauv paus ntsiab lus tseem ceeb tshaj yog: tsis txhob rho qhov xaus qub kom hloov rau qhov xaus tshiab. Tawm ib qho status tshiab uas txuas rau status dhau los, txheeb xyuas qhov dav ntawm qhov cuam tshuam, mam li hloov qhov kev ua uas lwm lub system tab tom siv.

Tsim pipeline ceeb toom package phem kom nrhiav tau thiab thim rov qab