Sharang ParnerkarandClaude Fable 5
3ac4b34c29
CI / Check (push) Skipped
CI / Check (pull_request) Failing after 3m1s
CI / Detect Changes (pull_request) Skipped
CI / Deploy Agent (pull_request) Skipped
CI / Deploy Dashboard (pull_request) Skipped
CI / Deploy Docs (pull_request) Skipped
CI / Deploy MCP (pull_request) Skipped
Versioned, reproducible set of representative targets so every scan path can be exercised repeatably and the nightly regression (#188) has a baseline. - fixtures/demo-targets/targets.json: 5 targets — PlcSps composite (pump_station.st + pump_fbd.xml + optional Modbus live URL + optional firmware image), PlcSps pure (conveyor.xml + traffic_light.st), plain git SAST (sharang/cra-vuln-demo, pinned), WebApp (juice-shop v19.2.1 + live URL), FirmwareRtos (zephyr example-application, pinned). Each carries an `expect` golden baseline (min_findings, sast_rule_ids, cwes, control_refs, min_sbom_components, scans_offered, pentest_supported, detected_facts). - compliance-agent::fixtures: typed loader (DemoTargets/DemoTarget/ DemoArtifact/Expect) + lib tests that keep the manifest well-formed and assert the PLC baselines offline by running analyze_tree over the checked-in fixtures (runs in the normal --lib CI job). - scripts/seed-demo-targets.sh: curl+jq seeder over the public onboarding API (create → upload → detect → optional --scan), --only, --reset (deletes only the "Demo · " prefix), env overrides for infra-dependent artifacts. - docs/guide/demo-targets.md + sidebar entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv
162 lines
5.0 KiB
JSON
162 lines
5.0 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"name_prefix": "Demo · ",
|
|
"targets": [
|
|
{
|
|
"key": "plc-pump-station",
|
|
"name": "PLC pump station (ST + FBD, composite)",
|
|
"target_type": "plc_sps",
|
|
"description": "Composite PlcSps demo: Structured Text + FBD-as-PLCopen-XML control logic, plus an optional live Modbus endpoint (in-cluster plc-sim) and an optional device firmware image. Exercises PLC SAST, ICS probe, semantic control mapping.",
|
|
"artifacts": [
|
|
{
|
|
"kind": "plc_project",
|
|
"upload": "examples/plc-demo/pump_station.st",
|
|
"plc_format": "structured_text"
|
|
},
|
|
{
|
|
"kind": "plc_project",
|
|
"upload": "examples/plc-demo/pump_fbd.xml",
|
|
"plc_format": "plcopen_xml"
|
|
},
|
|
{
|
|
"kind": "live_url",
|
|
"source_ref_env": "DEMO_PLC_MODBUS_URL",
|
|
"source_ref": "modbus://plc-sim:502",
|
|
"optional": true
|
|
},
|
|
{
|
|
"kind": "firmware_image",
|
|
"upload_env": "DEMO_PLC_FIRMWARE_IMAGE",
|
|
"optional": true
|
|
}
|
|
],
|
|
"expect": {
|
|
"min_findings": 16,
|
|
"sast_rule_ids": [
|
|
"plc-hardcoded-credential",
|
|
"plc-default-password",
|
|
"plc-safety-bypass",
|
|
"plc-array-unchecked-index",
|
|
"plc-insecure-comm",
|
|
"plc-insecure-protocol-port",
|
|
"plc-unstructured-jump",
|
|
"plc-division-by-zero"
|
|
],
|
|
"cwes": [
|
|
"CWE-798",
|
|
"CWE-319",
|
|
"CWE-1384"
|
|
],
|
|
"control_refs_any": true
|
|
}
|
|
},
|
|
{
|
|
"key": "plc-conveyor-line",
|
|
"name": "PLC conveyor + traffic light (PLCopen XML + ST)",
|
|
"target_type": "plc_sps",
|
|
"description": "Pure PLC SAST demo: a PLCopen-XML conveyor program and a realistic OpenPLC-style traffic-light program with three planted defects. Exercises the control-logic rules without any dynamic infra.",
|
|
"artifacts": [
|
|
{
|
|
"kind": "plc_project",
|
|
"upload": "examples/plc-demo/conveyor.xml",
|
|
"plc_format": "plcopen_xml"
|
|
},
|
|
{
|
|
"kind": "plc_project",
|
|
"upload": "examples/plc-demo/traffic_light.st",
|
|
"plc_format": "structured_text"
|
|
}
|
|
],
|
|
"expect": {
|
|
"min_findings": 8,
|
|
"sast_rule_ids": [
|
|
"plc-hardcoded-credential",
|
|
"plc-default-password",
|
|
"plc-safety-bypass",
|
|
"plc-insecure-comm",
|
|
"plc-insecure-protocol-port"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"key": "git-cra-vuln-demo",
|
|
"name": "Git SAST · cra-vuln-demo",
|
|
"target_type": "backend_service",
|
|
"description": "Plain git SAST target. Small deliberately-vulnerable Python service (hardcoded credential, weak cipher, SQL injection, cleartext transport) used to prove the CWE → CRA control mapping.",
|
|
"artifacts": [
|
|
{
|
|
"kind": "git_repo",
|
|
"source_ref": "https://git.breakpilot.com/sharang/cra-vuln-demo.git",
|
|
"branch": "main",
|
|
"pin": "21951249b9977d0c7feb555a9d5ce42c70ab5ae4"
|
|
}
|
|
],
|
|
"expect": {
|
|
"min_findings": 3,
|
|
"cwes": [
|
|
"CWE-798",
|
|
"CWE-327",
|
|
"CWE-89"
|
|
],
|
|
"control_refs": [
|
|
"cra-ai-8",
|
|
"cra-ai-13",
|
|
"cra-ai-20"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"key": "web-juice-shop",
|
|
"name": "Web app · OWASP Juice Shop",
|
|
"target_type": "web_app",
|
|
"description": "WebApp target: git repo for SAST/SBOM/CVE plus a live URL for DAST + pentest. Run the instance locally with `docker run -d -p 3000:3000 bkimminich/juice-shop:v19.2.1` or point DEMO_WEB_URL at a deployed copy.",
|
|
"artifacts": [
|
|
{
|
|
"kind": "git_repo",
|
|
"source_ref": "https://github.com/juice-shop/juice-shop.git",
|
|
"branch": "master",
|
|
"pin": "f87c6f58c49b61c9de20e4d69a9bdb1fbd4f3bd3",
|
|
"pin_tag": "v19.2.1"
|
|
},
|
|
{
|
|
"kind": "live_url",
|
|
"source_ref_env": "DEMO_WEB_URL",
|
|
"source_ref": "http://localhost:3000"
|
|
}
|
|
],
|
|
"expect": {
|
|
"min_findings": 10,
|
|
"min_sbom_components": 500,
|
|
"scans_offered": [
|
|
"sast",
|
|
"dast"
|
|
],
|
|
"pentest_supported": true
|
|
}
|
|
},
|
|
{
|
|
"key": "firmware-zephyr-example",
|
|
"name": "Firmware RTOS · Zephyr example-application",
|
|
"target_type": "firmware_rtos",
|
|
"description": "Upstream Zephyr example application (Apache-2.0). Exercises the tramiton detect handoff (build system = zephyr) and the firmware source SBOM path.",
|
|
"artifacts": [
|
|
{
|
|
"kind": "git_repo",
|
|
"source_ref": "https://github.com/zephyrproject-rtos/example-application.git",
|
|
"branch": "main",
|
|
"pin": "38a6d9b276ed434454900130cacc87d058d3ac62"
|
|
}
|
|
],
|
|
"expect": {
|
|
"detected_facts": {
|
|
"build_system": "zephyr"
|
|
},
|
|
"scans_offered": [
|
|
"sast"
|
|
],
|
|
"pentest_supported": false
|
|
}
|
|
}
|
|
]
|
|
}
|