sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

ONB · Composite PLC-on-Yocto target: PlcSps offers SBOM/CVE + DAST + pentest (matrix) #164

New Issue
Open
opened 2026-07-16 10:40:46 +00:00 by sharang · 0 comments
sharang commented 2026-07-16 10:40:46 +00:00
Owner
Copy Link
Copy Source

Problem

scan_matrix::rules_for(PlcSps) offers only PlcControlLogic. A real PLC
device (e.g. CODESYS on Yocto) also has a firmware image and a reachable runtime,
but a PlcSps target can't run firmware SBOM/CVE or DAST, and
supports_pentest(PlcSps) is false. So the device's OS/runtime attack surface
is invisible.

Change

Make PlcSps a composite target that lights up device-level scans when the
artifacts/endpoints are present (the matrix already blocks scans whose artifact is
absent, so this is additive and safe):

  • rules_for(PlcSps) += FirmwareStatic + Sbom + Cve (require Firmware),
    and Dast (require RunningUrl, default-off).
  • supports_pentest(PlcSps) → true (reachable device; pentest still needs a URL).
  • Keep PlcControlLogic (require Plc) as the default-on control-logic scan.

Design decision (resolve in PR)

One composite PlcSps target vs. two linked targets (PlcSps + EmbeddedLinuxYocto).
Default: composite — single pane for the device. Document the trade-off.

Files

  • compliance-core/src/scan_matrix.rs (rules + supports_pentest + tests)
  • Orchestrator already dispatches per plan.has(scan), so no pipeline change beyond
    confirming firmware/DAST scanners accept a PlcSps target's artifacts.

Tests

  • PlcSps with plc+firmware+url → offers PlcControlLogic (on), Sbom/Cve/FirmwareStatic (on), Dast (offered); supports_pentest true.
  • PlcSps with only plc → device scans present but blocked with reasons.
  • Update plc_offers_only_control_logic / pentest_support_matches_reachable_families.

Part of the CODESYS-on-Yocto customer tracker. Smallest gap — implement first.

### Problem `scan_matrix::rules_for(PlcSps)` offers **only** `PlcControlLogic`. A real PLC device (e.g. CODESYS on Yocto) also has a firmware image and a reachable runtime, but a `PlcSps` target can't run firmware SBOM/CVE or DAST, and `supports_pentest(PlcSps)` is `false`. So the device's OS/runtime attack surface is invisible. ### Change Make `PlcSps` a **composite** target that lights up device-level scans when the artifacts/endpoints are present (the matrix already blocks scans whose artifact is absent, so this is additive and safe): - `rules_for(PlcSps)` += `FirmwareStatic` + `Sbom` + `Cve` (require `Firmware`), and `Dast` (require `RunningUrl`, default-off). - `supports_pentest(PlcSps)` → `true` (reachable device; pentest still needs a URL). - Keep `PlcControlLogic` (require `Plc`) as the default-on control-logic scan. ### Design decision (resolve in PR) One composite `PlcSps` target vs. two linked targets (`PlcSps` + `EmbeddedLinuxYocto`). Default: **composite** — single pane for the device. Document the trade-off. ### Files - `compliance-core/src/scan_matrix.rs` (rules + `supports_pentest` + tests) - Orchestrator already dispatches per `plan.has(scan)`, so no pipeline change beyond confirming firmware/DAST scanners accept a `PlcSps` target's artifacts. ### Tests - `PlcSps` with plc+firmware+url → offers PlcControlLogic (on), Sbom/Cve/FirmwareStatic (on), Dast (offered); `supports_pentest` true. - `PlcSps` with only plc → device scans present but blocked with reasons. - Update `plc_offers_only_control_logic` / `pentest_support_matches_reachable_families`. Part of the CODESYS-on-Yocto customer tracker. **Smallest gap — implement first.**
sharang added this to the Onboarding v1 milestone 2026-07-16 10:40:46 +00:00
sharang added the enhancementonboarding labels 2026-07-16 10:40:46 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels enhancement onboarding
Milestone
No items
No Milestone Onboarding v1
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#164