chore(release): promote dev to main - #270
Merged
Merged
Conversation
* chore(main): release 3.6.0 * chore(main): release 3.6.1 * chore(main): release 3.6.2 * chore(main): release 3.7.0 --------- Co-authored-by: Brad Edwards <j.bradley.edwards@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* docs: add Ground Control requirement specs as repo-local files Import this project's 4 requirement(s) from Ground Control as repo-local files under docs/requirements/<UID>/requirement.md (specs-as-code). * docs: point ASP-0001 traceability at current package path The IMPLEMENTS traceability line referenced the retired src/aces_scenario_packs/release.py path, tripping the retired-identity guard (test_current_surfaces_do_not_reintroduce_retired_names). The file lives at src/raes_env_packs/release.py after the RAES hard cut (ADR 0021).
* chore(main): release 3.6.0 * chore(main): release 3.6.1 * chore(main): release 3.6.2 * chore(main): release 3.7.0 * fix(techvault): align soc-certificate output paths with the issued layout The soc-certificate-profile/v1 outputs declared a clean ideal layout (ca/lab-ca.crt, thehive/thehive.p12, shuffle/...) that did not match the files the backend CA generator actually issues. Declare the produced layout instead: lab-ca.pem / lab-ca.key at the root, <service>/server.pem + server.key, the thehive PKCS#12 keystore as keystore.p12 + keystore.p12.password, and the shuffle cert under the shuffle-frontend service directory. A consuming backend can now find every declared output. * feat(techvault): declare misp-db and shuffle-opensearch runtime environment Both crash-looped at boot for want of their operational environment: mariadb needs MYSQL_ROOT_PASSWORD (+ db/user/password), and opensearch needs OPENSEARCH_INITIAL_ADMIN_PASSWORD (+ single-node discovery and heap). Declare these through the runtime environment so a realizing backend brings them up configured. Fixed lab credentials, matching the range's established values. * feat(techvault): declare aptl-tempo config and startup command Tempo crash-looped with 'unknown backend' because it had no config: declare its -config.file startup command and the tempo.yaml (local trace storage over the tempo_data volume) as node content, delivered to the image node as a read-only bind mount by the backend. * feat(techvault): declare wazuh sidecar agent environment Both wazuh-agent sidecars crash-looped with 'WAZUH_MANAGER is required'. Declare the agent environment (manager target = the wazuh-manager service, agent name, tailed log path and format) alongside the existing forwarding_agents desired state so the agent entrypoint enrolls against the manager. * feat(techvault): fully declare cortex-index-init (image, entrypoint, script) The one-shot index initializer had no source at all, so a dependency reference to it failed with 'container never created'. Declare its elasticsearch image, its /bin/sh entrypoint, and its index-init script as node content so it is realized and runs to pre-create Cortex's keyword mappings before Cortex starts. * feat(techvault): declare wazuh cluster env desired-state (#259) Declare the wazuh-indexer/manager/dashboard runtime.environment so the cluster is realized from the SDL rather than a hand-authored backend definition: indexer JVM opts; manager INDEXER_URL + operator-secret INDEXER/API creds + filebeat SSL paths; dashboard INDEXER/DASHBOARD/API operator-secret creds + WAZUH_API_URL. Operator secrets are authored empty and supplied by the operator .env; DNS references use the hyphenated service names. First increment of realizing wazuh generically (aptl #875 Cluster A). * feat(techvault): declare wazuh-indexer opensearch.yml security config (#259) The wazuh-indexer image's bundled opensearch.yml points TLS material at /etc/wazuh-indexer/certs, which the OpenSearch SecurityManager policy denies reading; the range's certs are issued into /usr/share/wazuh-indexer/certs. Declare the indexer security config as content pointing at that path, with the range's nodes_dn/admin_dn, so the cluster comes up on its own PKI. Generic realization of the wazuh indexer (aptl #875 Cluster A). * feat(techvault): declare wazuh-dashboard config content (#259) Declare opensearch_dashboards.yml (dashboard->indexer over TLS at /usr/share/wazuh-dashboard/certs) and wazuh.yml (dashboard->manager API, wazuh-wui fixture cred) as content, with hyphenated service DNS names (wazuh-indexer / wazuh-manager) since the generic realization uses the Compose service name as the DNS name. Completes the wazuh dashboard's declared desired-state (aptl #875). * feat(techvault): declare suricata run config + cortex-index-init placement (#259) suricata: declare the run entrypoint (docker-entrypoint -c suricata.yaml --pcap), the NET_ADMIN/NET_RAW/SYS_NICE capabilities the sensor needs, and a boot-clean suricata.yaml (HOME_NET 172.20.0.0/16, eve.json output for the SIEM, command socket enabled) + a local.rules baseline; MISP/Suricata rules load live over the command socket per the sensor declaration. cortex-index-init: add the security-net placement + thehive-es dependency so the one-shot index bootstrap can reach elasticsearch (it was on no network, exiting curl code 6). (aptl #875) * fix(techvault): suricata direct exec, cortex-init ES wait, ad samba caps (#259) - suricata: run the engine directly instead of via docker-entrypoint.sh, whose chown of /etc/suricata/* fails on the read-only config content mount. - cortex-index-init: wait for thehive-es to accept connections before creating the Cortex index (a one-shot depends_on orders start, not readiness). - ad: grant CAP_SYS_ADMIN + CAP_NET_ADMIN so Samba AD DC provisioning can set sysvol NT ACLs (was failing NT_STATUS_ACCESS_DENIED with no caps). (aptl #875) * fix(techvault): declare thehive-es ES env (single-node, security off, 512m heap) (#259) thehive-es declared no environment, so Elasticsearch ran with xpack.security on, no single-node discovery, and an auto-sized JVM heap of ~1/4 host RAM (31 GB on a 125 GB host) that destabilized it under load (exit 0 -> restart loop). Declare the env the original stack used: discovery.type=single-node, xpack.security.enabled false, disk-threshold off, ES_JAVA_OPTS=-Xms512m -Xmx512m. (aptl #875) * feat(techvault): declare SOC app configs (otel, grafana, cortex, thehive) (#259) Declare the SOC services' application configuration as content instead of leaving them on image defaults: - otel-collector: OTLP receivers -> batch -> tempo exporter (aptl-tempo:4317); - grafana: Tempo datasource (http://aptl-tempo:3200); - cortex: Elasticsearch backend (http://thehive-es:9200), local+key auth (HTTP); - thehive: backend command (--cql-hostnames thehive-cassandra, --es-hostnames thehive-es, --cortex-hostnames cortex, lucene index) + JVM heap cap. All inter-service references use the hyphenated service DNS names. TheHive HTTPS termination + the Cortex API key are delivered via env_file from generated secrets (keystore password, cortex-apikey) and remain a follow-up pending an env_file affordance for generated secrets. (aptl #875) * fix(techvault): mark cortex-index-init as one-shot (autoremove) (#259) cortex-index-init creates the Cortex ES index and exits 0; declare runtime.container.autoremove so the backend emits restart:no and does not loop the finished one-shot. (aptl #875) * feat(techvault): author operator-access proxies + capture sidecar as component builds kali-ssh-proxy, webapp-proxy, and kali-capture were bare nodes with no source, so an env-pack boot had nothing to realize. Declare each as a contained component build (aptl-contained-component-build profile): - kali-ssh-proxy / webapp-proxy: the TCP-forwarder image, published on loopback (2023 / 8080). webapp-proxy reuses the ssh-proxy build context with an environment override targeting the webapp (172.20.1.20:8080); ssh-proxy relies on the image's Kali defaults. - kali-capture: the OBS-003 capture sidecar, sharing Kali's network namespace (namespaces.network.target_node_ref: kali) and holding the AUDIT_CONTROL/AUDIT_WRITE/SYS_PACCT/NET_RAW capabilities; its volume mount stays authored under persistent_volumes. * fix(techvault): update proxy component-build spec digests The kali-ssh-proxy and kali-capture Dockerfiles moved to root-relative COPY paths so they build under the contained-component-build profile; update the declared materialization-specification digests to match the new context. * feat(techvault): declare wazuh loopback published ports The pre-refactor range published the Wazuh indexer (9200), manager (1514/1515/514-udp/55000), and dashboard (443->5601) on host loopback. Restore those declarations: the authenticated readiness gate probes the indexer over 9200 and the manager API over 55000, so without them a boot comes up healthy but fails the gate; the dashboard 443 binding is the operator-facing SOC UI. * feat(techvault): author the indexer internal_users.yml The Wazuh indexer initializes its security index from internal_users.yml on first boot. Without it the indexer used its bundled demo users, whose admin hash does not match the operator's INDEXER_PASSWORD ('SecretPassword'), so every authenticated consumer (readiness gate, manager filebeat, dashboard) got 401. Restore the file the pre-refactor range mounted; its admin hash is the bcrypt of the password APTL hydrates into .env, so auth succeeds. * fix(techvault): realize the misp-sync TLS flag and the db-log forwarding source Two exact requirements the SDL declared but the range did not realize, which RAES 3.3.0's SEM-218 gate correctly rejected: - misp-suricata-sync MISP_VERIFY_SSL was declared valueless; the lab default 'false' (ADR-022: MISP self-signs, no lab CA) was leaking in from the operator .env out of band. Declare it so it is realized range content. - wazuh-sidecar-db tailed /logs/pg_log/postgresql.log, a path nothing delivered after the db moved to a generic-base apt PostgreSQL 15 install (which logs to /var/log/postgresql/postgresql-15-main.log). Add a db_logs volume shared db -> /var/log/postgresql and sidecar -> /logs, and point the forwarder at the real file, so database activity genuinely reaches the SIEM. * test(techvault): align sdl topology guards with the completed runtime * chore(main): release 3.8.0 --------- Co-authored-by: Brad Edwards <j.bradley.edwards@gmail.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…state (#269) * feat(techvault): declare Cortex job index as ADR-088 initial service state * fix(deps): bump cryptography to 50.0.0 for CVE-2026-69247
Reconciles dev's unblocked content (#264 requirement specs, #269 ADR-088 Cortex initial service state + cryptography CVE-2026-69247 fix) onto a main base so a merge commit into dev links main into dev's history and unblocks the dev->main promotion (#270).
Merged
chore: sync main -> dev
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related issues
Verification
python -m unittest discover -s testsraes-pack-validate --repo .raes-pack-release check --allraes-pack-validate --packs-root packsraes-pack-release check --packs-root packsdocs/public/warning-free (sphinx-build -W).Checklist
packs/.CHANGELOG.md— release-please owns them.