stratumoss 0.5.2__tar.gz

stratumoss-0.5.2/.dockerignore

@@ -0,0 +1,8 @@
+.git
+.venv
+venv
+__pycache__
+*.pyc
+tests/
+.env
+.pytest_cache

stratumoss-0.5.2/.env.example

@@ -0,0 +1,76 @@
+# Stratum — environment variable reference
+# Copy to .env and fill in the values you need.
+# Stratum reads this file automatically on startup (via python-dotenv).
+
+# ---------------------------------------------------------------------------
+# Core
+# ---------------------------------------------------------------------------
+
+# Passphrase for the credential encryption key.
+# If unset, a random key is auto-generated and stored in data/.stratum_key.
+# Set this to keep credentials accessible across container rebuilds.
+# STRATUM_SECRET_KEY=change-me-to-a-strong-random-passphrase
+
+# Admin token — required to log in to the UI and API (HTTP Basic Auth, any
+# username, this as the password). If unset, a random token is generated and
+# saved to data/.admin_token on first startup (check the container logs for it).
+# Set this to keep a stable login across restarts.
+# STRATUM_ADMIN_TOKEN=change-me-to-a-strong-random-token
+
+# Require manual confirmation before the AI Builder agent provisions real
+# cloud infrastructure (default: true). Set to false to let the agent build
+# autonomously without a human clicking "Build" in the UI first.
+# STRATUM_AGENT_REQUIRE_CONFIRMATION=true
+
+# Override default storage paths (optional)
+# DATA_DIR=data
+# PLUGINS_DIR=plugins/providers
+# PROFILES_DIR=profiles
+
+# ---------------------------------------------------------------------------
+# AI Builder — pick ONE backend and uncomment the relevant block
+# ---------------------------------------------------------------------------
+
+# --- Anthropic (default) ---
+# STRATUM_LLM_PROVIDER=anthropic
+# STRATUM_LLM_MODEL=claude-opus-4-6
+# ANTHROPIC_API_KEY=sk-ant-...
+
+# --- OpenAI or any OpenAI-compatible endpoint ---
+# Works with Groq, Together AI, Fireworks, vLLM, LiteLLM, etc.
+# Requires: uv add openai
+# STRATUM_LLM_PROVIDER=openai
+# STRATUM_LLM_MODEL=gpt-4o
+# STRATUM_LLM_API_KEY=sk-...
+# STRATUM_LLM_BASE_URL=https://api.groq.com/openai/v1
+
+# --- Ollama (local, no API key) ---
+# Run open-weight models locally. Requires Ollama: https://ollama.com
+# Requires: uv add openai   (Ollama exposes an OpenAI-compatible endpoint)
+# STRATUM_LLM_PROVIDER=ollama
+# STRATUM_LLM_MODEL=llama3.3:70b
+# STRATUM_LLM_BASE_URL=http://localhost:11434/v1
+
+# --- AWS Bedrock ---
+# Reuses your existing AWS credentials. No separate API key needed.
+# Requires: uv add boto3   (or uv sync --extra llm-bedrock)
+# Needs bedrock:InvokeModelWithResponseStream IAM permission.
+# STRATUM_LLM_PROVIDER=bedrock
+# STRATUM_LLM_MODEL=us.anthropic.claude-opus-4-5-20251101-v1:0
+
+# Disable Claude extended thinking (Anthropic/Bedrock only)
+# STRATUM_LLM_THINKING=1
+
+# ---------------------------------------------------------------------------
+# Blueprint Registry
+# ---------------------------------------------------------------------------
+
+# Private S3 blueprint store (optional)
+# BLUEPRINT_STORE_S3_BUCKET=my-company-blueprints
+# BLUEPRINT_STORE_S3_PREFIX=stratum/
+# BLUEPRINT_STORE_S3_REGION=us-east-1
+
+# ---------------------------------------------------------------------------
+# Debug
+# ---------------------------------------------------------------------------
+# DEBUG=false

stratumoss-0.5.2/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Default owner for everything in the repo.
+# PRs automatically request review from the maintainer.
+* @rrskris

stratumoss-0.5.2/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,35 @@
+---
+name: Bug report
+about: Something in Stratum isn't working as expected
+title: ""
+labels: bug
+assignees: ""
+---
+
+**Describe the bug**
+A clear description of what's broken.
+
+**Blueprint / request**
+The blueprint YAML (redact real credentials/AMI IDs if needed) or `curl`
+request that triggers the issue.
+
+```yaml
+# paste blueprint YAML here
+```
+
+**Expected behavior**
+What you expected to happen.
+
+**Actual behavior**
+What actually happened — include the full error message / stack trace / API
+response if there is one.
+
+**Environment**
+- Stratum version (`pyproject.toml` version or commit hash):
+- Deployment: Docker Compose / local `uv run` / other:
+- Cloud provider(s) involved, if any:
+- OS/target image:
+
+**Additional context**
+Anything else that might help (relevant log lines from `docker compose logs`,
+screenshots of the UI, etc.).

stratumoss-0.5.2/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,21 @@
+---
+name: Feature request
+about: Suggest an idea for Stratum
+title: ""
+labels: enhancement
+assignees: ""
+---
+
+**What problem does this solve?**
+Describe the gap or pain point — e.g. a cloud provider, OS, or workflow
+Stratum doesn't support yet.
+
+**Proposed solution**
+What would you like to happen? If it touches the blueprint schema, sketch the
+YAML shape you'd expect.
+
+**Alternatives considered**
+Any workarounds you're using today, or other tools that solve this.
+
+**Additional context**
+Links, references, or examples (e.g. a CIS/STIG control, a provider API doc).

stratumoss-0.5.2/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,27 @@
+## What does this PR do?
+
+<!-- One or two sentences. -->
+
+## Why
+
+<!-- The problem or gap this addresses. -->
+
+## Testing
+
+<!-- How did you verify this? -->
+- [ ] `uv run pytest` passes locally
+- [ ] `uv run ruff check .` and `uv run ruff format --check .` pass
+- [ ] Added/updated tests for the change (see `docs/test_plan.md` for the
+      project's TDD conventions)
+- [ ] If this touches a cloud provider: ran against a real provider, or
+      explained why that isn't practical for this change
+- [ ] If this adds or changes a blueprint: the "Validate community blueprints"
+      check passes (schema + `blueprints/index.json` consistency)
+
+## Checklist
+
+- [ ] I've read `CONTRIBUTING.md`
+- [ ] This PR is scoped to one logical change
+- [ ] I've updated `CHANGELOG.md` if this is user-visible
+- [ ] All commits are signed off (`git commit -s`) per the
+      [DCO](https://developercertificate.org/)

stratumoss-0.5.2/.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      minor-and-patch:
+        update-types: ["minor", "patch"]
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"

stratumoss-0.5.2/.github/workflows/ci.yml

@@ -0,0 +1,157 @@
+name: CI
+
+on:
+  push:
+    branches: ["main", "develop"]
+  pull_request:
+
+jobs:
+  lint:
+    name: Lint (ruff)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.11"
+      - run: uv sync --extra all-providers --group dev
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+
+  test:
+    name: Tests (pytest)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.11"
+      - run: uv sync --extra all-providers --group dev
+      - run: uv run pytest tests/ -v --tb=short
+
+  schema:
+    name: Validate blueprint YAML schemas
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.11"
+      - run: uv sync
+      - name: Validate all profiles
+        run: |
+          uv run python - <<'EOF'
+          import sys
+          from pathlib import Path
+          from stratum.core.blueprint import ComplianceProfile
+          import yaml
+
+          errors = []
+          profiles_dir = Path("profiles")
+          yaml_files = list(profiles_dir.rglob("*.yaml")) + list(profiles_dir.rglob("*.yml"))
+          # Skip the generic template — it intentionally has null controls
+          skip = {"generic-hardening-blueprint.yaml"}
+
+          for p in sorted(yaml_files):
+              if p.name in skip:
+                  print(f"  SKIP  {p}")
+                  continue
+              try:
+                  raw = yaml.safe_load(p.read_text())
+                  if not isinstance(raw, dict):
+                      errors.append(f"  ERROR {p}: top-level is not a mapping")
+                      continue
+                  ComplianceProfile.model_validate(raw)
+                  print(f"  OK    {p}")
+              except Exception as exc:
+                  errors.append(f"  ERROR {p}: {exc}")
+
+          if errors:
+              print("\nSchema validation failed:")
+              for e in errors:
+                  print(e)
+              sys.exit(1)
+          else:
+              print(f"\nAll {len(yaml_files) - len(skip)} profiles validated successfully.")
+          EOF
+
+  validate-blueprints:
+    name: Validate community blueprints
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.11"
+      - run: uv sync
+      - name: Validate blueprint schemas
+        run: |
+          uv run python - <<'EOF'
+          import sys
+          from pathlib import Path
+          from stratum.core.blueprint import ComplianceProfile
+          import yaml
+
+          errors = []
+          yaml_files = sorted(Path("blueprints").rglob("*.yaml"))
+
+          for p in yaml_files:
+              try:
+                  raw = yaml.safe_load(p.read_text())
+                  if not isinstance(raw, dict):
+                      errors.append(f"  ERROR {p}: top-level is not a mapping")
+                      continue
+                  ComplianceProfile.model_validate(raw)
+                  print(f"  OK    {p}")
+              except Exception as exc:
+                  errors.append(f"  ERROR {p}: {exc}")
+
+          if errors:
+              print("\nBlueprint schema validation failed:")
+              for e in errors:
+                  print(e)
+              sys.exit(1)
+          else:
+              print(f"\nAll {len(yaml_files)} blueprints validated successfully.")
+          EOF
+      - name: Check index.json consistency
+        run: |
+          uv run python - <<'EOF'
+          import json
+          import sys
+          from pathlib import Path
+
+          on_disk = {str(p.relative_to("blueprints")) for p in Path("blueprints").rglob("*.yaml")}
+          indexed = set(json.loads(Path("blueprints/index.json").read_text()))
+
+          missing_from_index = sorted(on_disk - indexed)
+          missing_on_disk = sorted(indexed - on_disk)
+
+          if missing_from_index:
+              print("Files on disk but missing from index.json:")
+              for f in missing_from_index:
+                  print(f"  {f}")
+          if missing_on_disk:
+              print("Entries in index.json with no file on disk:")
+              for f in missing_on_disk:
+                  print(f"  {f}")
+
+          if missing_from_index or missing_on_disk:
+              sys.exit(1)
+          print(f"index.json consistent with {len(on_disk)} blueprint files.")
+          EOF
+
+  ansible-syntax:
+    name: Ansible syntax check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Ansible
+        run: pip install ansible-core
+      - name: Check playbook syntax (if site.yml exists)
+        run: |
+          if [ -f ansible/site.yml ]; then
+            ansible-playbook --syntax-check ansible/site.yml
+          else
+            echo "No ansible/site.yml — skipping"
+          fi

stratumoss-0.5.2/.github/workflows/dco.yml

@@ -0,0 +1,32 @@
+name: DCO
+
+on:
+  pull_request:
+
+jobs:
+  dco:
+    name: DCO
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Check Signed-off-by on all PR commits
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          missing=0
+          for sha in $(git rev-list --no-merges "$BASE_SHA".."$HEAD_SHA"); do
+            if ! git log -1 --format=%B "$sha" | grep -Eqi '^Signed-off-by: .+ <.+@.+>'; then
+              echo "::error::Commit $sha is missing a Signed-off-by line (use 'git commit -s')."
+              git log -1 --format='%h %s' "$sha"
+              missing=1
+            fi
+          done
+          if [ "$missing" -eq 1 ]; then
+            echo "All commits must be signed off per the Developer Certificate of Origin:"
+            echo "https://developercertificate.org/"
+            exit 1
+          fi
+          echo "All commits signed off."

stratumoss-0.5.2/.github/workflows/refresh-amis.yml

@@ -0,0 +1,54 @@
+name: Refresh AWS AMI Catalog Defaults
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'   # Monday 06:00 UTC
+  workflow_dispatch:        # allow manual trigger
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install boto3
+        run: pip install boto3
+
+      - name: Resolve latest AMIs and update catalog
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AMI_REFRESH_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AMI_REFRESH_AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
+        run: python scripts/refresh_ami_catalog.py
+
+      - name: Check for changes
+        id: diff
+        run: |
+          git diff --quiet stratum/core/os_catalog.py || echo "changed=true" >> "$GITHUB_OUTPUT"
+
+      - name: Commit and open PR
+        if: steps.diff.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          BRANCH="chore/refresh-amis-$(date +%Y%m%d)"
+          git checkout -b "$BRANCH"
+          git add stratum/core/os_catalog.py
+          git commit -m "chore: refresh AWS AMI catalog defaults $(date +%Y-%m-%d)"
+          git push origin "$BRANCH"
+          gh pr create \
+            --title "chore: refresh AWS AMI catalog defaults $(date +%Y-%m-%d)" \
+            --body "Automated weekly AMI refresh. Fallback AMI IDs in \`os_catalog.py\` updated to current us-east-1 values." \
+            --base main \
+            --head "$BRANCH"

stratumoss-0.5.2/.github/workflows/release.yml

@@ -0,0 +1,102 @@
+name: Release
+
+# Publishes to PyPI via trusted publishing (OIDC — no stored API token).
+# Requires a "pending publisher" (first release) or publisher configured on
+# pypi.org for project `stratumoss`: owner StratumOSS, repo Stratum,
+# workflow release.yml, environment pypi.
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    name: Build distributions
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.11"
+      - name: Check tag matches package version
+        run: |
+          pkg_version=$(uv run --no-project python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          tag_version="${GITHUB_REF_NAME#v}"
+          if [ "$pkg_version" != "$tag_version" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match pyproject version $pkg_version" >&2
+            exit 1
+          fi
+      - run: uv build
+      - name: Smoke-test the wheel
+        run: |
+          uv venv /tmp/smoke && VIRTUAL_ENV=/tmp/smoke uv pip install dist/*.whl
+          cd /tmp && /tmp/smoke/bin/python -c "from stratum.main import app; import stratum; print('import OK', stratum.__version__)"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/stratumoss/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  publish-image:
+    name: Publish container image to GHCR
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: ghcr.io/stratumoss/stratum
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  github-release:
+    name: Create GitHub release
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Create release with dist artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" dist/* \
+            --title "$GITHUB_REF_NAME" \
+            --notes "See [CHANGELOG.md](https://github.com/StratumOSS/Stratum/blob/main/CHANGELOG.md) for details."

stratumoss-0.5.2/.github/workflows/weekly-image-refresh.yml

@@ -0,0 +1,48 @@
+name: Weekly Image Refresh
+
+on:
+  schedule:
+    - cron: "0 3 * * 1"   # Monday 03:00 UTC
+  workflow_dispatch:
+
+jobs:
+  refresh:
+    name: Trigger official blueprint builds
+    runs-on: ubuntu-latest
+    env:
+      STRATUM_API_URL: ${{ vars.STRATUM_API_URL }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.11"
+      - run: uv sync
+      - name: Run official build trigger
+        id: trigger
+        run: uv run python scripts/trigger_official_builds.py
+        env:
+          STRATUM_API_URL: ${{ env.STRATUM_API_URL }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: ${{ vars.AWS_DEFAULT_REGION || 'us-east-1' }}
+
+      - name: Notify Slack on failure
+        if: failure()
+        uses: slackapi/slack-github-action@v2
+        with:
+          payload: |
+            {
+              "text": ":warning: *Stratum Weekly Image Refresh failed*",
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": ":warning: *Weekly Image Refresh failed*\nWorkflow: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

stratumoss-0.5.2/.gitignore

@@ -0,0 +1,57 @@
+# Python
+__pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+.Python
+*.so
+.venv/
+venv/
+env/
+.env
+*.egg-info/
+dist/
+build/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+
+# uv
+.uv/
+uv.lock
+
+# Stratum runtime data (never commit credentials or build artifacts)
+data/credentials.enc
+data/.stratum_key
+data/.stratum_salt
+data/.admin_token
+data/audits/
+data/builds/
+data/local-images/
+data/scap-content/
+data/audit_jobs.json
+data/api_keys.json
+data/webhooks.json
+profiles/community/
+profiles/user/
+
+# Test / coverage artifacts
+.coverage
+coverage.xml
+htmlcov/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# Claude Code / AI assistant local files — never commit
+.claude/
+CLAUDE.md
+CLAUDE.local.md
+.mcp.json

stratumoss-0.5.2/.python-version

@@ -0,0 +1 @@
+3.11