feat: add cybersecurity engineering package

.github/requirements/cybersecurity.txt

@@ -0,0 +1,14 @@
+attrs==26.1.0 \
+    --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309
+jsonschema==4.25.1 \
+    --hash=sha256:3fba0169e345c7175110351d456342c364814cfcf3b964ba4587f22915230a63
+jsonschema-specifications==2025.9.1 \
+    --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe
+referencing==0.37.0 \
+    --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231
+regex==2026.9.10 \
+    --hash=sha256:bafa41b0dd63669e5c0f8adf3d24819efeb73c847f492eb011212eb352e69041
+rpds-py==2026.6.3 \
+    --hash=sha256:acac386b453c2516111b50985d60ce46e7fadb5ea71ae7b25f4c946935bf27cf
+typing-extensions==4.16.0 \
+    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8

.github/workflows/ci.yml

@@ -37,13 +37,25 @@ jobs:
           python -m pip install --require-hashes --only-binary=:all:
           --disable-pip-version-check
           --requirement .github/requirements/pre-commit.txt
+          --requirement .github/requirements/cybersecurity.txt
 
       - name: Run repository checks
         run: pre-commit run --all-files --show-diff-on-failure
 
       - name: Run artifact lock negative tests
         run: python -m unittest discover -s tests -p 'test_*.py' -v
 
+      - name: Validate OSCAL component definition against the official schema
+        run: |
+          schema_file="$(mktemp)"
+          trap 'rm -f "${schema_file}"' EXIT
+          curl --fail --location --proto '=https' --tlsv1.2 \
+            --output "${schema_file}" \
+            https://github.com/usnistgov/OSCAL/releases/download/v1.2.3/oscal_component_schema.json
+          echo '95e76881151ececd5cb1a93ff0f70ad74b8cc1aa58771626ac8b262bf2c8e001  '"${schema_file}" \
+            | sha256sum --check --strict
+          python scripts/cybersecurity.py --check --oscal-schema "${schema_file}"
+
       - name: Validate committed artifact locks
         run: |
           python scripts/artifacts.py validate-inputs artifacts/lock-inputs.json
@@ -193,6 +205,18 @@ jobs:
           IMAGE: ${{ env.TEST_IMAGE }}
         run: bash tests/tls.sh
 
+      - name: Record cryptographic linkage inventory
+        run: |
+          docker run --rm --entrypoint /bin/sh "${TEST_IMAGE}" -ec '
+            uname -m
+            /usr/pgsql-18/bin/postgres --version
+            /usr/pgsql-18/bin/pg_config --configure
+            ldd /usr/pgsql-18/bin/postgres
+            ldd /usr/pgsql-18/bin/psql
+            if command -v openssl >/dev/null; then openssl version -a; else echo "openssl executable absent"; fi
+          ' > "crypto-inventory-${{ matrix.architecture }}.txt"
+          test -s "crypto-inventory-${{ matrix.architecture }}.txt"
+
       - name: Scan image with Trivy
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
@@ -253,6 +277,7 @@ jobs:
             ${{ env.PROVENANCE_FILE }}
             ${{ env.GRYPE_SARIF }}
             ${{ env.GRYPE_ALL }}
+            crypto-inventory-${{ matrix.architecture }}.txt
           if-no-files-found: warn
           retention-days: 14
 

.github/workflows/scap.yml

@@ -0,0 +1,119 @@
+name: SCAP discovery
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "41 8 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: scap-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  image-filesystem:
+    name: image filesystem (${{ matrix.architecture }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - architecture: amd64
+            runner: ubuntu-24.04
+            machine: x86_64
+          - architecture: arm64
+            runner: ubuntu-24.04-arm
+            machine: aarch64
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    env:
+      TEST_IMAGE: localhost/postgresql-ubi9:scap-${{ matrix.architecture }}
+      SCAP_ARCHIVE: scap-security-guide-0.1.81.zip
+      SCAP_ARCHIVE_SHA256: 865e28b793e1e65f7f0102434bc7d962324a4b9324591e60742f1e9ce375172c
+      OPENSCAP_VERSION: 1.3.9+dfsg-1.1ubuntu2
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Confirm native runner architecture
+        env:
+          EXPECTED_MACHINE: ${{ matrix.machine }}
+        run: test "$(uname -m)" = "${EXPECTED_MACHINE}"
+
+      - name: Install pinned OpenSCAP utilities
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends \
+            "openscap-scanner=${OPENSCAP_VERSION}" \
+            "openscap-utils=${OPENSCAP_VERSION}" \
+            "python3-openscap=${OPENSCAP_VERSION}"
+          oscap --version | grep -F 'OpenSCAP command line tool (oscap) 1.3.9'
+          command -v oscap-chroot
+
+      - name: Acquire pinned ComplianceAsCode content
+        run: |
+          curl --fail --location --proto '=https' --tlsv1.2 \
+            --output "${SCAP_ARCHIVE}" \
+            "https://github.com/ComplianceAsCode/content/releases/download/v0.1.81/${SCAP_ARCHIVE}"
+          echo "${SCAP_ARCHIVE_SHA256}  ${SCAP_ARCHIVE}" | sha256sum --check --strict
+          mkdir scap-content
+          unzip -j "${SCAP_ARCHIVE}" '*ssg-rhel9-ds.xml' -d scap-content
+          test -s scap-content/ssg-rhel9-ds.xml
+
+      - name: Acquire and build the locked image
+        env:
+          BUILD_METADATA_FILE: provenance-${{ matrix.architecture }}.json
+          BUILDX_METADATA_PROVENANCE: min
+          CONTAINER_RUNTIME: docker
+          IMAGE: ${{ env.TEST_IMAGE }}
+        run: bash scripts/build-offline.sh
+
+      - name: Export a never-executed root filesystem
+        run: |
+          container_id="$(docker create --entrypoint /bin/true "${TEST_IMAGE}")"
+          test "$(docker inspect --format '{{.State.Status}}' "${container_id}")" = created
+          docker export --output image-rootfs.tar "${container_id}"
+          docker rm "${container_id}"
+          mkdir image-rootfs
+          sudo tar --numeric-owner --same-owner -xf image-rootfs.tar -C image-rootfs
+          test "$(sudo stat -c '%u:%g' image-rootfs/usr/pgsql-18)" = '0:0'
+
+      - name: Run report-only image-owned discovery
+        run: |
+          set +e
+          sudo oscap-chroot "${PWD}/image-rootfs" xccdf eval \
+            --profile xccdf_datopsis_profile_image_filesystem_discovery \
+            --tailoring-file "${PWD}/compliance/scap/postgresql-ubi-rhel9-tailoring.xml" \
+            --results-arf "${PWD}/scap-results-${{ matrix.architecture }}.xml" \
+            --report "${PWD}/scap-report-${{ matrix.architecture }}.html" \
+            "${PWD}/scap-content/ssg-rhel9-ds.xml"
+          scan_status=$?
+          set -e
+          if test "${scan_status}" -ne 0 && test "${scan_status}" -ne 2; then
+            echo "OpenSCAP execution failed with status ${scan_status}" >&2
+            exit "${scan_status}"
+          fi
+          test -s "scap-results-${{ matrix.architecture }}.xml"
+          test -s "scap-report-${{ matrix.architecture }}.html"
+          printf 'OpenSCAP finding status: %s (report-only; 2 means at least one rule failed)\n' "${scan_status}" \
+            > "scap-status-${{ matrix.architecture }}.txt"
+
+      - name: Retain SCAP discovery evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: scap-discovery-${{ github.sha }}-${{ matrix.architecture }}
+          path: |
+            scap-results-${{ matrix.architecture }}.xml
+            scap-report-${{ matrix.architecture }}.html
+            scap-status-${{ matrix.architecture }}.txt
+            provenance-${{ matrix.architecture }}.json
+          if-no-files-found: error
+          retention-days: 14

CHANGELOG.md

@@ -47,3 +47,8 @@ but container releases use the upstream-derived format documented in
   policy; digest-bound SBOM, provenance, scanning, signing, verification, and
   evidence controls; upstream monitoring; emergency rebuild; and quarantine
   procedures.
+- Added the Package 5 cybersecurity engineering set: authoritative source
+  register, schema-validated OSCAL component definition, generated control
+  views, architecture and threat model, report-only native SCAP discovery,
+  cryptographic claim gate, vulnerability exceptions, incident response, and
+  inherited deployment responsibility matrix.

README.md

@@ -134,6 +134,16 @@ No supported image has been released. The current implementation is for
 development and evaluation; consult the [support matrix](docs/SUPPORT.md)
 before relying on any platform or operational claim.
 
+## Cybersecurity engineering
+
+The [security engineering record](docs/SECURITY-ENGINEERING.md) links the
+authoritative source register, schema-validated OSCAL component definition,
+generated control view, architecture, threat model, SCAP evidence boundary,
+cryptographic claim gate, vulnerability/exception process, incident response,
+and deployment responsibility matrix. These are component support artifacts,
+not a system authorization, STIG certification, FIPS validation, or compliance
+determination.
+
 ## References
 
 - [PostgreSQL versioning policy](https://www.postgresql.org/support/versioning/)

artifacts/assurance-tool-versions.json

@@ -1,4 +1,6 @@
 {
   "compliance_as_code": "0.1.81",
-  "status": "planned-input-not-yet-qualified"
+  "openscap": "1.3.9+dfsg-1.1ubuntu2",
+  "oscal": "1.2.3",
+  "status": "report-only-discovery"
 }