Sharang ParnerkarandClaude Fable 5
1ae6025286
CI / Check (pull_request) Failing after 1m31s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy Docs (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
Dynamic PLC testing without reaching the customer's device: when a PLC/SPS target ships control logic but no reachable live URL, instantiate that logic ourselves on a throwaway OpenPLC container in-cluster, load + start it, probe the provisioned Modbus endpoint, and tear it down. No customer network access, sandboxed, and reproducible. This is the phase-1 foundation of epic #183 (OpenPLC substrate). It covers: - provision: ephemeral container lifecycle (docker CLI). Resource-capped (memory/cpus/pids), hardened (no-new-privileges), labelled, joined to the agent's own network with no host port exposure, and swept by a stale reaper for anything a crashed run leaks. The `docker` argv is built by pure functions so it is unit-tested without a daemon. - openplc: drives the OpenPLC web UI to load a program — login → upload → save → compile (MatIEC) → start_plc (which opens Modbus/TCP 502). - runtime::provision_and_test: composes them under a hard deadline with guaranteed teardown on every path (success / error / timeout), then runs the existing ICS probe against the provisioned endpoint. extract_program picks the best loadable program (complete ST > largest ST > PLCopen XML). - orchestrator: for a PlcSps target with control logic and no live URL, run provision-and-test after the static PLC scan. Gated by PlcRuntimeConfig (PLC_RUNTIME_ENABLED, default off — needs Docker access in the agent). DAST-against-WebVisu and CODESYS-runtime fidelity are follow-ups. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
39 lines
1.1 KiB
TOML
39 lines
1.1 KiB
TOML
[workspace]
|
|
members = [
|
|
"compliance-core",
|
|
"compliance-agent",
|
|
"compliance-dashboard",
|
|
"compliance-graph",
|
|
"compliance-dast",
|
|
"compliance-mcp",
|
|
"compliance-smoke",
|
|
]
|
|
resolver = "2"
|
|
|
|
[workspace.lints.clippy]
|
|
unwrap_used = "deny"
|
|
expect_used = "deny"
|
|
|
|
[workspace.dependencies]
|
|
compliance-core = { path = "compliance-core", default-features = false }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
tokio = { version = "1", features = ["full"] }
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
mongodb = { version = "3", features = ["rustls-tls", "compat-3-0-0"] }
|
|
reqwest = { version = "0.12", features = ["json", "rustls-tls", "multipart", "cookies"], default-features = false }
|
|
thiserror = "2"
|
|
sha2 = "0.10"
|
|
hex = "0.4"
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
secrecy = { version = "0.10", features = ["serde"] }
|
|
regex = "1"
|
|
zip = { version = "2", features = ["aes-crypto", "deflate"] }
|
|
dashmap = "6"
|
|
tokio-stream = { version = "0.1", features = ["sync"] }
|
|
aes-gcm = "0.10"
|
|
rand = "0.9"
|
|
base64 = "0.22"
|