Marketplace & Extensions
Relevant source files
The following files were used as context for generating this wiki page:
The FixOps Marketplace is a centralized hub for sharing, discovering, and deploying security-related content, including policy templates, compliance test sets, and mitigation playbooks. It serves as a community-driven repository that allows organizations to leverage pre-built security configurations, thereby accelerating the adoption of DevSecOps practices. The system supports a contribution model where users can submit new content, which undergoes automated validation before becoming available to the community.
Within the FixOps ecosystem, the Marketplace provides the modular components necessary for the Decision Engine to function across various SSDLC stages. It facilitates the distribution of Open Policy Agent (OPA) Rego policies, attack scenarios mapped to MITRE ATT&CK, and automated pipeline gates.
Sources: fixops-enterprise/src/services/marketplace_service.py:1-15, web/apps/marketplace/app/page.tsx:160-170
System Architecture
The marketplace architecture is built around a service-oriented model featuring file-based persistence for metadata and an HMAC-tokenized system for secure content distribution.
Core Components
- MarketplaceService: The central logic layer managing item indexing, searching, and reputation tracking.
- Persistence Layer: Uses JSON snapshots stored in a dedicated data directory (
/data/marketplaceor/app/data/marketplace) to maintain state for items, purchases, and contributors. - Validation Engine: An automated QA system that performs metadata completeness checks, artifact linting, and harness validation.
- Reputation System: Tracks contributor metrics, including submission counts, adoption events, and average ratings to calculate a "Reputation Score."
Sources: fixops-enterprise/src/services/marketplace_service.py:18-30, archive/enterprise_legacy/src/services/marketplace.py:18-25
Data Flow for Content Distribution
The following diagram illustrates the flow from content discovery to secure download.
Content Management
Marketplace content is categorized into five primary types, each serving a specific function within the security pipeline.
Content Types
| Content Type | Description | Application Stage |
|---|---|---|
policy_template | Prebuilt OPA/Rego policies for gating workloads. | Build, Deploy |
compliance_testset | Curated tests to validate configurations (e.g., SAST baseline). | Code, Build, Test |
mitigation_playbook | Remediation steps and evidence collection templates. | Operate, Deploy |
attack_scenario | Checks mapping to common TTPs for red team exercises. | Test, Operate |
pipeline_gate | Automated verification blocks for CI/CD pipelines. | Build, Deploy |
Sources: fixops-enterprise/src/services/marketplace_service.py:61-68, schemas/marketplace/contribution.schema.json:28-39
Contribution and Validation
New content must adhere to a strict JSON schema and pass automated QA checks before being listed as passed.
The automated validation specifically checks for the absence of markers like TODO, FIXME, or TEMP in the artifact payload.
Sources: fixops-enterprise/src/services/marketplace_service.py:180-235, archive/enterprise_legacy/src/services/marketplace.py:125-175
Contributor Reputation and Metrics
The marketplace tracks contributor performance to ensure content quality and trust. The Reputation Score is a weighted calculation based on several factors:
- Submissions: 10 points per contribution.
- Adoption Events: 5 points per download/purchase.
- Rating Score: Calculated as
Average Rating * Rating Count. - QA Rate: Up to 20 points based on the ratio of
validated_submissionsto total submissions.
Sources: fixops-enterprise/src/services/marketplace_service.py:250-265, archive/enterprise_legacy/src/services/marketplace.py:190-205
Data Structure: ContributorProfile
| Field | Type | Description |
|---|---|---|
author | string | Individual contributor name. |
organization | string | Affiliated organization. |
reputation_score | float | Calculated trust score. |
adoption_events | int | Total number of times content was downloaded. |
validated_submissions | int | Count of submissions passing QA with 'passed' status. |
Sources: fixops-enterprise/src/services/marketplace_service.py:34-48, web/apps/marketplace/app/page.tsx:50-57
API and Integration
The Marketplace is accessible via REST API endpoints and is integrated into the frontend dashboard for ease of use.
Key API Operations
GET /api/v1/marketplace/items: Browse and filter content.POST /api/v1/marketplace/contribute: Submit new content (requires compliance withcontribution.schema.json).POST /api/v1/marketplace/purchase/{id}: Initiate a purchase or free download request.GET /api/v1/marketplace/download: Retrieve content using a valid download token.
Sources: CLI_API_INVENTORY.md:120-130, fixops-enterprise/src/services/marketplace_service.py:320-350
Security and Tokenization
To prevent unauthorized downloads without requiring full application-level authentication for every link, the service uses HMAC-SHA256 signatures. Download tokens consist of purchase_id.expiration.signature.
def _sign_token(self, purchase_id: str, expires_in_minutes: int = 60) -> str:
exp = int((datetime.now(timezone.utc) + timedelta(minutes=expires_in_minutes)).timestamp())
payload = f"{purchase_id}.{exp}".encode("utf-8")
sig = hmac.new(self._secret, payload, hashlib.sha256).hexdigest()
return f"{purchase_id}.{exp}.{sig}"
Sources: fixops-enterprise/src/services/marketplace_service.py:273-279, archive/enterprise_legacy/src/services/marketplace.py:214-220
Conclusion
The Marketplace & Extensions system provides the infrastructure for a collaborative security ecosystem within FixOps. By combining automated QA, reputation tracking, and secure artifact distribution, it ensures that users can dependably source and contribute security policies and compliance tools. This modular approach allows the platform to stay current with evolving threats and regulatory requirements through community participation.