NEXUS Quor.Dev Supply Chain & Distroless

Technical summary

NEXUS Quor.Dev brings container security and software supply chain traceability into the NEXUS dashboard. It combines Cosign cryptographic verification, CycloneDX SBOM auditing, and OpenVEX justifications with admission policy generators for Kubernetes and CI/CD pipelines. This architecture enforces zero-root execution and eliminates false positives across staging and production environments.

Executed scope

• Full plugin registration (registerTab('quor-dev', 'Quor.Dev', 'shield-check', tab.php, 'DevSecOps & Containers'), registerDoc, registerApiAction, and Intel Hub enrichers).
• Cryptographic verification engine for Cosign and Sigstore (includes/cosign.php) supporting Keyless OIDC identities, SLSA v1.0 attestations, and Rekor transparency log validation.
• SBOM explorer and parser (includes/sbom.php) supporting CycloneDX v1.5 JSON and SPDX 2.3 standards for package and open-source license inventories.
• OpenVEX non-exploitability engine (includes/openvex.php) with AI-assisted technical justification generation for runtime CVE false-positive filtering.
• Static hardening linter (includes/linter.php) for Dockerfiles and docker-compose.yml calculating security scores and generating AI-refactored hardened manifests.
• Distroless recipe advisor (includes/advisor.php) offering optimized multi-stage build templates for Go, Node.js, Python, Rust, and custom AI prompt stacks.
• Admission and CI/CD pipeline template generator (includes/policies.php) covering Kyverno, OPA Gatekeeper, GitHub Actions, GitLab CI, and Azure Pipelines.
• Compliance Dossier generator (includes/compliance.php) exporting JSON and Markdown audit dossiers mapped to NIST SSDF (SP 800-218), SLSA L3, ISO 27001, and PCI-DSS 4.0.
• Autonomous webhook endpoint (includes/webhook.php) with Ngrok HTTPS tunnel discovery and automated patch task generation via the Linus AI agent.
• Fastr terminal command dispatcher (includes/fastr_format.php and fastr.json) providing /quor advisor, /quor verify, /quor sbom, /quor vex, /quor lint, and /quor policies.
• SSR Alpine.js and Tailwind CSS v4.3 reactive interface (tab.php, views/script.php, views/subtabs/, and views/modals/) with multilingual support in pt_BR, en_US, and es_ES.

Stack and tools

• Plain PHP 8.3 (modular decoupled backend) + MySQL 8 (DB PDO singleton)
• Sigstore Cosign v2.2+ (OIDC Keyless & Rekor verification)
• CycloneDX v1.5 JSON & SPDX 2.3 (SBOM specifications)
• OpenVEX v0.2.0 (Vulnerability Exploitability eXchange)
• Kyverno v1.12 & OPA Gatekeeper v3.15 (Admission Controllers)
• Alpine.js v3 + Tailwind CSS v4.3 + XTerm.js (UI and Fastr terminal)
• Intel Hub Enricher API (Signals engine for URLs, domains, and SHA256 hashes)

Operational tags

• Quor.dev
• Distroless
• Cosign
• Sigstore
• SLSA v1
• CycloneDX
• OpenVEX
• Hardening
• Kubernetes
• NEXUS Plugin

Operational result

• Enforced Non-Root Execution: Restricts container processes to UID 65532:65532, preventing privilege escalation and host escape vectors.
• Cryptographic Image Provenance: Ensures only containers signed with verified Sigstore/Cosign provenance deploy into Kubernetes clusters.
• Audited False-Positive Suppression: Issues formal OpenVEX attestations documenting non-exploitability in Distroless runtime environments.
• Production-Ready Policy Infrastructure: Generates admission manifests and security pipelines for Kubernetes, GitHub Actions, GitLab, and Azure DevOps.
• Automated Lifecycle Remediation: Receives verified registry webhook events, automatically opening remediation tasks and notifying teams in Pixel Office.