[Story: ] As a Margo Adopter, I would like to have a Margo digitally signed conformance report

[nilanjan-samajdar]

Description

As a Margo Adopter, I would like to have a Margo digitally signed conformance report.
This requires the implementation of the following chain in the Conformance tool.

HTML Report
  ↓
HTML → PDF renderer
  ↓
PDF
  ↓
Add metadata about Vendor's artefact version / date e.t.c. + embedded evidence like the collected logs
  ↓
Digitally sign PDF (X.509 certificate)
  ↓
Add RFC3161 timestamp
  ↓
Signed PDF

Additional inputs

• Use Open-Source tools for this chain.
• Explore if we can use Puppeteer tool to convert the HTML report to pdf
• Explore if we can use PDFBox to add the Meta-Data to the file as well embedding a tar.gz file of the collected evidence logs.
• Extract the SHA256 hash of the updated PDF report file.
• Now create a new "Margo Conformance Certificate file" containing -
  -- Conformance statement
  -- the SHA256 hash of the PDF report file and Meta-Data as a QR Code
• Sign this pdf "Margo Conformance Certificate file" with a Margo provide certificate using OpenSSL or similar.
• Ask the User to provide both the PDF conformance-report and the conformance-certificate file to their customer for validation.

Raised by (email-id)

nilanjan.samajdar@capgemini.com

Type of Story

Implementation

Related product requirements

Definition of Done

• The required technical documentation should be updated
• In case of any prototyping activity, the evaluation, design and outcomes need to be documented

Estimated Story-points

10

Impacted artifacts

• API Documentation (Swagger)
• User Docmentation
• Reference Implementation Code
• Test Automation