Supply evidence later slices: vulnerability/SBOM/posture/attestation adapters and selected rebuild-lab

[PhysShell]

Classification

• Change type: enhancement / deferred evidence adapters + research lab
• Priority: P2
• Expected value: medium-high after slice 1 proves the evidence/profile architecture
• Implementation risk: high if started too early — can easily turn into a broad supply-chain scanner or unreliable rebuild farm
• Repository owner: OwnAudit implementation/research layer
• Depends on: OwnAudit Supply evidence slice 1: SourceLink/PDB and NuGet resolution-policy adapters #44 and PhysShell/Own.NET#271
• Production status: deferred; do not start before the SourceLink/PDB + NuGet policy slice is stable

Problem

There are many useful supply-chain tools, but OwnAudit should not duplicate them:

NuGet Audit / OSV-Scanner / Grype -> known vulnerability evidence
Syft -> SBOM evidence
OpenSSF Scorecard -> repository posture evidence
SLSA / GitHub artifact attestations / Sigstore -> build/provenance evidence
rebuild experiments -> selected source-to-artifact correspondence evidence

The gap worth owning is not "another scanner". The gap is a .NET/NuGet/legacy-enterprise evidence aggregator that can combine those signals with SourceLink/PDB metadata, package policy and existing audit findings.

Goal

After the first supply evidence slice is stable, add optional adapters for mature tools and a separate selected rebuild lab.

The adapters must remain independent modules feeding the same evidence contract. They must not add a second report pipeline or replace existing tools.

Proposed later adapters

known-vuln

Inputs:

packages.lock.json
project.assets.json
NuGet package graph
OSV-Scanner output
NuGet Audit output
Grype output where SBOM exists

Rules:

SC007 VulnerablePackage

Non-goal: OwnAudit does not maintain a vulnerability database.

sbom

Use Syft or another external SBOM generator. OwnAudit consumes the result as evidence.

Questions to answer:

what packages are inside this artifact?
which transitive dependencies exist?
which binaries/native blobs are present?
which packages lack source/provenance metadata?

Non-goal: OwnAudit does not invent an SBOM format.

repo-posture

Use OpenSSF Scorecard or equivalent repo-health tooling for dependency source repositories.

Signals:

branch protection
pinned dependencies
binary artifacts
signed releases
security policy
maintained/stale status

This is repository posture evidence, not package proof. A good Scorecard result does not prove that a .nupkg matches a source commit.

attestations

Consume available build provenance evidence:

SLSA provenance
GitHub artifact attestations
Sigstore/cosign where applicable
in-toto/DSSE-style attestations

Non-goal: no local trust policy engine yet unless the evidence contract proves it is needed.

rebuild-lab

Selected source-to-artifact correspondence experiments only.

Candidate targets:

Internal.*
Sector.*
high-risk dependencies
packages with native binaries
packages touched by an incident
packages with missing/contradictory provenance evidence

Rules:

SC013 ArtifactNotReproducible
SC014 NupkgContainsUnexpectedBinary
SC015 PackageBuiltFromDirtyOrUnknownSource
SC020 RebuildAttempted
SC021 DeterministicRebuildMismatch
SC022 NormalizedDllMismatch
SC023 NupkgContentMismatch

This must not attempt to rebuild the NuGet ecosystem.

Profiles

Add only as opt-in profiles:

incident-response:
 enabled:
 - nuget-integrity
 - known-vuln
 - sbom
 - repo-posture
 - attestations
 - rebuild-lab

rebuild-lab:
 enabled:
 - rebuild-lab
 packages:
 - "Internal.*"
 - "Sector.*"

No CI default profile should run rebuilds.

Nix/dev environment

Prefer multiple dev shells/packages instead of a monster shell:

devShells.supply-light # Python + dotnet + jq + git
devShells.supply-full # supply-light + OSV/Syft/Grype/Scorecard if packaged
devShells.rebuild-lab # heavier source checkout/build experiments

Nix pins Linux-native tooling. It must not pretend to solve Windows/DevExpress 12.2 build constraints.

Non-goals

• No replacement for NuGet Audit, OSV-Scanner, Syft, Grype, Scorecard, SLSA, Sigstore or GitHub attestations.
• No universal package trust verdict.
• No broad ecosystem rebuild.
• No required 007 gate.
• No learned risk model.
• No GUAC-like graph database in this issue.

Required controls

1. Each adapter can be disabled without affecting others.
2. Missing adapter/tool is reported as coverage limitation, not a clean result.
3. Scorecard/posture evidence cannot prove package source correspondence.
4. Attestation evidence cannot prove byte-for-byte reproducibility unless linked to rebuild evidence.
5. Rebuild failures are classified: environment failure, restore failure, build mismatch, normalized binary mismatch, nupkg content mismatch.
6. Rebuild scope is explicit and selected; no accidental broad sweep.
7. No adapter performs policy decisions directly; policy evaluation remains separate.

Acceptance

• Adapter design note exists for known-vuln, sbom, repo-posture, attestations, and rebuild-lab.
• Profiles keep later slices disabled by default.
• At least one external-tool adapter is fixture-tested without network access.
• rebuild-lab has a dry-run/plan mode before any real build execution.
• Reports clearly separate integrity, provenance, repository posture, source correspondence and reproducibility.
• No issue in this track blocks the first SourceLink/PDB + NuGet policy slice.