Feedser evidence libraries

Relocation note: StellaOps.Feedser.Core remains in the retired Concelier source tree pending its owner program. VULN-B1 moved the closed, BCL-only StellaOps.Feedser.BinaryAnalysis project unchanged to src/__Libraries/ on 2026-08-24. Assembly, namespace, and public behavior are unchanged. The original standalone docs remain archived at docs-archive/modules/feedser/.

Feedser is the evidence-collection layer for backport detection and binary fingerprinting inside Stella Ops’ advisory pipeline. It is intended for engineers working on the Concelier backport-proof path and anyone integrating with the patch/binary evidence contracts.

Purpose

Feedser provides deterministic, cryptographic evidence collection for backport detection. It extracts patch signatures from unified diffs and binary fingerprints from compiled code to enable high-confidence vulnerability status determination for packages where upstream fixes have been backported by distro maintainers. It also hosts the determinization-pipeline signal attachers (EPSS, KEV) consumed by the advisory ingest path.

The module ships as two .NET 10 libraries in separate ownership roots:

StellaOps.Feedser.Core(src/Concelier/StellaOps.Feedser.Core/) - patch-signature extraction (HunkSigExtractor), function-signature extraction (FunctionSignatureExtractor), and the signal-attacher subsystem under the StellaOps.Feedser.Core.Signals namespace. References StellaOps.Eventing only.
StellaOps.Feedser.BinaryAnalysis(src/__Libraries/StellaOps.Feedser.BinaryAnalysis/) - neutral binary fingerprinting (BinaryFingerprintFactory, IBinaryFingerprinter). It has no project or package dependencies and owns no service behavior, persistence, or transport.

Quick Links

Architecture - Technical design and implementation details

Status

Attribute	Value
Maturity	Production
Last Reviewed	2026-08-24
Maintainer	Shared Libraries (`BinaryAnalysis`) + Concelier (`Core`)

Key Features

Patch Signature Extraction: HunkSigExtractor.ExtractFromDiff(...) parses unified diffs and emits a normalized PatchSignature (record fields: PatchSigId, CveId, UpstreamRepo, CommitSha, Hunks, HunkHash, AffectedFiles, AffectedFunctions, ExtractedAt, ExtractorVersion). Normalization strips whitespace/comments; the PatchSigId is sha256:{hunkHash}. Extractor version is currently 1.0.0.
Function Signature Extraction: FunctionSignatureExtractor.ExtractFunctionsFromContext(...) derives affected function names from hunk context for Tier 3/4 matching.
Binary Fingerprinting: BinaryFingerprintFactory produces BinaryFingerprint records. The FingerprintMethod enum declares TLSH, CFGHash, InstructionHash, SymbolHash, SectionHash, but the factory currently registers only two fingerprinters: SimplifiedTlshFingerprinter (TLSH fuzzy hashing) and InstructionHashFingerprinter (instruction sequence hashing). MatchBestAsync(...) returns the highest-confidence FingerprintMatchResult (IsMatch, Similarity, Confidence, MatchedFingerprintId, Method, MatchDetails).
Signal Attachers (determinization pipeline): ISignalAttacher<TInput, TSignal> in StellaOps.Feedser.Core.Signals, with concrete EpssSignalAttacher (SignalType = "epss", 24h TTL) and KevSignalAttacher. Results are wrapped in SignalState<T> carrying a SignalStatus (Available, NotFound, Failed, Pending, Expired, NotConfigured) and SignalUpdatedEvents are emitted via ISignalEventEmitter. Register via SignalAttacherServiceExtensions.AddSignalAttachers().
Tier 3/4 Evidence Contribution: Feedser supplies source-patch (Tier 3) and compiled-binary (Tier 4) evidence. The multi-tier proof model itself is defined and assembled by the consuming StellaOps.Concelier.ProofService / StellaOps.Concelier.BackportProof, not by Feedser.
Deterministic Outputs: Stable SHA-256 hashing (ComputeSha256, ordinal sorting of hunks/files) for reproducible signatures.

Dependencies

Upstream (this module depends on)

StellaOps.Eventing (internal library, used by Feedser.Core for signal event emission). No external service dependencies.

Downstream (modules that depend on this)

Verified ProjectReferences into the Feedser libraries:

StellaOps.Concelier.ProofService- references Feedser.Core + Feedser.BinaryAnalysis; assembles backport proofs (BackportProofService).
StellaOps.Concelier.ProofService.Postgres- references Feedser.BinaryAnalysis (persists BinaryFingerprintEntity, ChangelogEvidenceEntity).
StellaOps.Scanner.PatchVerification- references Feedser.BinaryAnalysis for binary verification during scans.

Notes

Feedser is a pair of libraries (Feedser.Core, Feedser.BinaryAnalysis), not a standalone service. They expose no REST APIs, no CLI commands, and own no persistence schema (fingerprint/evidence entities are persisted by the consuming StellaOps.Concelier.ProofService.Postgres). They do not make vulnerability decisions. The patch/binary evidence feeds the Concelier backport-proof path; the EPSS/KEV signal attachers feed the advisory determinization pipeline.

Concelier Architecture