From 940aac7d25e4a765cd9de25063fc06228e9f3d48 Mon Sep 17 00:00:00 2001 From: Niek Otten Date: Fri, 2 Oct 2026 09:30:05 +0200 Subject: [PATCH] docs: demo note and backlog mirror for S-28/S-29 (refs #192) Co-Authored-By: Claude Opus 5.5 (1M context) --- BACKLOG.md | 8 ++++++++ docs/demo-script.md | 25 +++++++++++++++++++++++++ 2 files changed, 33 insertions(+) diff --git a/BACKLOG.md b/BACKLOG.md index f707d0f..a0a19f7 100644 --- a/BACKLOG.md +++ b/BACKLOG.md @@ -334,6 +334,14 @@ Split into independently deployable sub-slices (CLAUDE.md §13): **Outcome:** All runbooks complete: startup, seed, common failures, upgrade upstream modules, restore from backup, rotate secrets, Gitea Actions gotchas. + +### S-28 · ClamAV (clamd) runs in compose and on the cluster — #191 + +**Outcome:** a clamd service with current signatures runs alongside the stack (compose + Helm), health-gated, with a `verify-clamav` check (EICAR → FOUND). ADR-0036 (#190). + +### S-29 · Uploaded diplomas are virus-scanned and PDF-checked before storage — #192 + +**Outcome:** the domain stores a diploma only when it starts with `%PDF-` and clamd scans it clean; infected → 422 "infected", non-PDF → 422 "not-a-pdf", scanner down → 503. The portal explains each one. --- ## How to add a new slice diff --git a/docs/demo-script.md b/docs/demo-script.md index ee0adf8..6673056 100644 --- a/docs/demo-script.md +++ b/docs/demo-script.md @@ -878,3 +878,28 @@ Keycloak's stock conditional-OTP subflow — no custom browser flow. The fixture committed on purpose so the checks can compute codes; a real deployment enrols per-user authenticators (ADR-0031). +--- + +## S-29 — Uploaded diplomas are virus-scanned (#192, ADR-0036) + +**Outcome:** a diploma upload is stored only when it is a PDF that **ClamAV** scans clean. If the file +is infected, or not a PDF, the citizen is told why and the registration keeps waiting for a valid +diploma. If the scanner is down the upload is refused (fail closed) and the citizen is asked to retry. + +```bash +# 1. Manual: submit a registration in the self-service portal, then upload as the diploma: +# - any real PDF → "Uw documenten zijn aangeleverd." +# - the EICAR test file (below) → "Er is een virus gevonden in dit bestand…" +# - a renamed .png → "Dit bestand is geen PDF…" +printf '%s%s' 'X5O!P%@AP[4\PZX54(P^)7CC)7}$' 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar.pdf +# +# 2. Automated: clamd itself (EICAR → FOUND, clean → OK) and the use case at every refusal: +make verify-clamav +dotnet test tests/acceptance --filter "FullyQualifiedName~EenDiplomaAanleveren" +``` + +**The path:** portal → BFF → Domain `ProvideDocuments`. The domain asks `IDocumentScanner` +(clamd over INSTREAM) first and checks `%PDF-` second, because clamd only spots EICAR at the start of +a file. Only a clean PDF goes on to the ACL and into ZGW. Refusals come back as 422 with a reason, a +scanner outage as 503 (ADR-0036). +