diff --git a/changelog.d/+install-scenario-packs-doc.added.md b/changelog.d/+install-scenario-packs-doc.added.md new file mode 100644 index 000000000..503919c75 --- /dev/null +++ b/changelog.d/+install-scenario-packs-doc.added.md @@ -0,0 +1 @@ +A getting-started guide, "Install a scenario pack and its adapter," documents how LilRAE consumes an external pack (content from `raes-env-packs` by identity) plus its adapter (the `aptl.*` entry points for that pack id), how to select the pack in `aptl.json`, and how to verify and troubleshoot it. diff --git a/changelog.d/+proxy-addr-cve-2026-90711.fixed.md b/changelog.d/+proxy-addr-cve-2026-90711.fixed.md new file mode 100644 index 000000000..ae67f064d --- /dev/null +++ b/changelog.d/+proxy-addr-cve-2026-90711.fixed.md @@ -0,0 +1 @@ +Bump the transitive `proxy-addr` dependency from 2.0.7 to 2.0.8 in every MCP package lockfile. Version 2.0.7 carries CVE-2026-90711 (CRITICAL): `proxy-addr` is vulnerable to IP spoofing through an IPv4-mapped IPv6 trust subnet. This cleared the critical finding reported by the dependency-audit and Trivy scans. diff --git a/changelog.d/+techvault-env-packs-621-compat.fixed.md b/changelog.d/+techvault-env-packs-621-compat.fixed.md new file mode 100644 index 000000000..debaa60a7 --- /dev/null +++ b/changelog.d/+techvault-env-packs-621-compat.fixed.md @@ -0,0 +1 @@ +TechVault now realizes against `raes-env-packs` 6.2.1, and its Suricata web-attack detection fires. The 6.2.1 pack content changed the pack set-digest, so the `aptl_techvault` capture, serving, startup, planning, and verification providers now pin the 6.2.1 digests (`techvault` `sha256:1229f94f…`, `techvault-participant-study` `sha256:03baae36…`); the `raes-env-packs` requirement and the hash-locked requirement exports move to 6.2.1. The Wazuh manager config no longer excludes the built-in Suricata ruleset (`0475-suricata_rules.xml`): the authored rule `303020` chains off the built-in rule `86601` through `` (env-packs #418), so the built-in base must load for a network web attack to surface as rule `303020` ("Web attack (network)") instead of the generic built-in alert. diff --git a/config/wazuh_cluster/wazuh_manager.conf b/config/wazuh_cluster/wazuh_manager.conf index b6a0a2d4a..80da8d4d3 100644 --- a/config/wazuh_cluster/wazuh_manager.conf +++ b/config/wazuh_cluster/wazuh_manager.conf @@ -345,10 +345,11 @@ ruleset/rules etc/rules 0215-policy_rules.xml - - 0475-suricata_rules.xml + + etc/lists/audit-keys etc/lists/amazon/aws-eventnames etc/lists/security-eventchannel diff --git a/containers/generic-systemd-node22-base/Dockerfile b/containers/generic-systemd-node22-base/Dockerfile index d76874340..3d2857dd5 100644 --- a/containers/generic-systemd-node22-base/Dockerfile +++ b/containers/generic-systemd-node22-base/Dockerfile @@ -17,6 +17,8 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \ # Node 22 ships npm 10, whose bundled dependencies carry fixed advisories. # Replace it with npm 11 (which supports Node >=22.9) from the registry # tarball, verified against its published sha512 integrity (issue #1193). +# Also drop the unused yarn and corepack tooling (this substrate uses npm only) +# so their bundled dependencies cannot fail the image vulnerability scan. ARG NPM_VERSION=11.21.0 ARG NPM_SHA512=668bfc2a16a63677a22dd10bb63e5800bb4d9895b82f87c22d3ce37e9cd71b6c3a3121dc7f453181d94ae6e9680ae92c593fbb986514ef08bbf5c3ba46a8af3e RUN set -eu; \ @@ -26,7 +28,24 @@ RUN set -eu; \ mkdir /usr/local/lib/node_modules/npm; \ tar -xzf /tmp/npm.tgz -C /usr/local/lib/node_modules/npm --strip-components=1; \ rm /tmp/npm.tgz; \ + rm -rf /opt/yarn-* /usr/local/bin/yarn /usr/local/bin/yarnpkg \ + /usr/local/lib/node_modules/corepack /usr/local/bin/corepack; \ test "$(npm --version)" = "${NPM_VERSION}" +# npm (through 12.x) bundles postcss-selector-parser 7.1.4, which carries a +# fixed advisory (CVE-2026-104844, fixed in 7.1.6) that no npm release has +# adopted. npm's ci path requires the module, so upgrade the bundled copy in +# place to 7.1.6 (identical runtime deps cssesc/util-deprecate, already present) +# and verify its published sha512 integrity. +ARG PCSS_VERSION=7.1.6 +ARG PCSS_SHA512=eea0123f384a17697628b6e8459bb1f0209344c746895d3cbd69b22b33f3db6a99ed98d004e798eeb37336808b49489fb49ec752ad061111e6c70fedd1d09d33 +RUN set -eu; \ + curl -fsSL "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-${PCSS_VERSION}.tgz" -o /tmp/pcss.tgz; \ + echo "${PCSS_SHA512} /tmp/pcss.tgz" | sha512sum -c -; \ + pcss=/usr/local/lib/node_modules/npm/node_modules/postcss-selector-parser; \ + rm -rf "$pcss"; mkdir -p "$pcss"; \ + tar -xzf /tmp/pcss.tgz -C "$pcss" --strip-components=1; \ + rm /tmp/pcss.tgz; \ + test "$(node -p "require('$pcss/package.json').version")" = "${PCSS_VERSION}" # This image's offline cache is an APTL-owned build integration. Resolve the # exact compatible pack through the normal acquisition/artifact validators; # retain dependency cache + identity evidence, never a second runtime source. diff --git a/docs/architecture/issue-592-scenario-pack-terminology-preflight.md b/docs/architecture/issue-592-scenario-pack-terminology-preflight.md index 626025f9e..277b0d04e 100644 --- a/docs/architecture/issue-592-scenario-pack-terminology-preflight.md +++ b/docs/architecture/issue-592-scenario-pack-terminology-preflight.md @@ -54,6 +54,7 @@ prose must not accidentally rename them. | Extension documentation | `src/aptl_techvault/README.md` | A plugin may be compatible with an exact pack binding; it is neither the pack, RAES, an APTL startup-catalog entry, nor a new catalog authority. | | Historical requirements and review evidence | `docs/requirements/SCN-010/requirement.md`, `docs/reviews/962-lilrae-readiness/` | Preserve historical names and exact recorded links. The review's backlog and identity dispositions provide current interpretation without changing the underlying evidence. | | Terminology record and navigation labels | `docs/architecture/issue-592-scenario-pack-terminology-preflight.md`, `docs/architecture/index.md`, `mkdocs.yml` | Titles may preserve an issue's or file's historical locator. Descriptive labels for current contracts use the terminology above. | +| Scenario pack installation guide | `docs/getting-started/installing-packs.md` | Keep the content-pack and adapter distinction and the env-pack identity and source selection; do not rename the pack, RAES, or backend contracts. | The inventory identified three current-prose hazards for issue #592 to resolve: the tautological rename sentence at the start of the issue #589 preflight, the diff --git a/docs/getting-started/installing-packs.md b/docs/getting-started/installing-packs.md new file mode 100644 index 000000000..7c95dcf5a --- /dev/null +++ b/docs/getting-started/installing-packs.md @@ -0,0 +1,115 @@ +# Install a scenario pack and its adapter + +LilRAE does not contain the scenarios it runs. A scenario has two parts, and you +install each one: + +1. **The pack.** A RAES environment pack holds the scenario content: the SDL + document, assets, detection content, and seed data. TechVault is a pack. +2. **The adapter.** A Python package that provides the scenario-specific + behavior for the pack's identity: serving, capture, startup, runtime + parameters, verification, and participant smoke plans. The generic + materializer in `src/aptl` does not branch on scenario names. The adapter + supplies all scenario-specific behavior through entry points. + +You must install both. The pack without its adapter realizes generically, but +its scenario-specific startup, verification, and capture do not run. + +## Install the pack + +The default scenario source is `env-pack`. LilRAE resolves the pack from the +installed `raes-env-packs` distribution by identity. It reads +`resources/packs//sdl/.sdl.yaml`, stages the pack into +private project state, and validates it with the env-packs gates before use. + +Install the distribution that carries the pack: + +```shell +pip install "raes-env-packs==6.2.0" +``` + +TechVault ships in `raes-env-packs` as two packs: `techvault` (the environment) +and `techvault-participant-study` (the environment plus authored red and blue +participants). + +A third-party pack that is not in `raes-env-packs` ships in its own +distribution. Install that distribution the same way. The pack directory name +must equal the pack's declared identity. + +## Install the adapter + +The adapter registers entry points in these groups, keyed by the pack identity: + +| Entry-point group | Purpose | +| --- | --- | +| `aptl.pack_backend_interactions` | Serving provider | +| `aptl.scenario_capture` | Capture provider | +| `aptl.scenario_startup` | Startup provider | +| `aptl.scenario_runtime_parameters` | Runtime parameters | +| `aptl.scenario_planning_compatibility` | Planning compatibility | +| `aptl.scenario_verifiers` | Verifier | +| `aptl.evidence_payload` | Evidence collectors | +| `aptl.participant_mcp_smoke_plans` | Participant MCP smoke plans | + +The TechVault adapter is `aptl_techvault`. It ships inside the `aptl-labs` +(LilRAE) distribution, so a LilRAE install already has it. You do not install it +separately. + +A third-party pack supplies its own adapter distribution. Install it with pip. +Its entry points must name the pack's identity (for example `mypack.aptl`). +After install, confirm the entry points resolve: + +```shell +python -c "from importlib.metadata import entry_points as e; print([ep.name for ep in e(group='aptl.scenario_startup')])" +``` + +## Select the pack + +The active scenario is an operator decision. It lives in `aptl.json`: + +```json +{ + "scenario": { + "source": "env-pack", + "identity": "techvault" + } +} +``` + +- `source: env-pack` resolves the pack from the installed distribution by + identity. This is the default. +- `identity` names the pack. The default identity is `techvault`. + +The backend never switches the scenario at runtime. You select it before +`aptl lab start`. + +## Verify and run + +List the configured pack. The catalog projects the pack named in `aptl.json`: + +```shell +aptl lab scenarios +``` + +The command prints the identity, version, status, digest, and description. Start +the lab: + +```shell +aptl lab start +``` + +`aptl lab start` uses the configured identity. The `--scenario` option selects +another identity, but only one that the catalog already lists. The catalog lists +the configured pack, so `--scenario` cannot select a pack that `aptl.json` does +not configure. To run a different pack, set `scenario.identity` in `aptl.json`. + +## Troubleshooting + +- **`Unknown scenario id ''. Available scenarios: `**. The identity is + not the configured pack. Set `scenario.identity` to `` in `aptl.json`, then + run `aptl lab scenarios` to confirm the catalog lists it. +- **`env-pack source not found for ''`**. The pack distribution is not + installed, or the pack directory name does not match the identity. Install the + distribution that carries `resources/packs//`. +- **The lab realizes, but scenario-specific startup or verification does not + run**. The adapter is missing. Install the adapter distribution and confirm + its entry points name the pack identity. diff --git a/docs/reviews/962-lilrae-readiness/tracked-file-inventory.tsv b/docs/reviews/962-lilrae-readiness/tracked-file-inventory.tsv index 093ff5c71..cdfc790de 100644 --- a/docs/reviews/962-lilrae-readiness/tracked-file-inventory.tsv +++ b/docs/reviews/962-lilrae-readiness/tracked-file-inventory.tsv @@ -1889,3 +1889,7 @@ containers/_host-identity/aptl-host-identity.service split-pack-delivery Invento containers/_host-identity/install.sh split-pack-delivery Inventory exact content owner; retain reusable delivery/evidence tools, retire static duplication after parity docs/adrs/adr-062-lilrae-name-and-naming-convention.md architecture-history Preserve LilRAE name change and new-code naming decision docs/architecture/issue-1232-lilrae-naming-preflight.md architecture-history Preserve LilRAE public naming boundary and compatibility guardrails +changelog.d/+install-scenario-packs-doc.added.md repository-metadata Inspect identity/content owner during #934; no runtime capability implied +changelog.d/+proxy-addr-cve-2026-90711.fixed.md repository-metadata Inspect identity/content owner during #934; no runtime capability implied +changelog.d/+techvault-env-packs-621-compat.fixed.md repository-metadata Inspect identity/content owner during #934; no runtime capability implied +docs/getting-started/installing-packs.md docs-follow-owner Separate current user guidance from historical evidence and scenario-pack-specific docs diff --git a/mcp/aptl-mcp-common/package-lock.json b/mcp/aptl-mcp-common/package-lock.json index 296843e27..720d61ec1 100644 --- a/mcp/aptl-mcp-common/package-lock.json +++ b/mcp/aptl-mcp-common/package-lock.json @@ -2236,9 +2236,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", - "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", - "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -2246,6 +2246,10 @@ }, "engines": { "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/qs": { diff --git a/mcp/mcp-casemgmt/package-lock.json b/mcp/mcp-casemgmt/package-lock.json index 1b0b83483..e51118c58 100644 --- a/mcp/mcp-casemgmt/package-lock.json +++ b/mcp/mcp-casemgmt/package-lock.json @@ -1733,7 +1733,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -1741,6 +1743,10 @@ }, "engines": { "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/qs": { diff --git a/mcp/mcp-indexer/package-lock.json b/mcp/mcp-indexer/package-lock.json index 2441c0205..710b7c793 100644 --- a/mcp/mcp-indexer/package-lock.json +++ b/mcp/mcp-indexer/package-lock.json @@ -2800,9 +2800,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", - "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", - "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -2810,6 +2810,10 @@ }, "engines": { "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/punycode": { diff --git a/mcp/mcp-network/package-lock.json b/mcp/mcp-network/package-lock.json index 2422eb969..a145add7c 100644 --- a/mcp/mcp-network/package-lock.json +++ b/mcp/mcp-network/package-lock.json @@ -1733,7 +1733,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -1741,6 +1743,10 @@ }, "engines": { "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/qs": { diff --git a/mcp/mcp-red/package-lock.json b/mcp/mcp-red/package-lock.json index f63d46a77..4ab92d8bb 100644 --- a/mcp/mcp-red/package-lock.json +++ b/mcp/mcp-red/package-lock.json @@ -2982,9 +2982,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", - "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", - "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -2992,6 +2992,10 @@ }, "engines": { "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/punycode": { diff --git a/mcp/mcp-reverse/package-lock.json b/mcp/mcp-reverse/package-lock.json index 8b7bf686e..b85c70bb5 100644 --- a/mcp/mcp-reverse/package-lock.json +++ b/mcp/mcp-reverse/package-lock.json @@ -2808,9 +2808,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", - "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", - "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -2818,6 +2818,10 @@ }, "engines": { "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/punycode": { diff --git a/mcp/mcp-soar/package-lock.json b/mcp/mcp-soar/package-lock.json index f017b59df..daffc40f0 100644 --- a/mcp/mcp-soar/package-lock.json +++ b/mcp/mcp-soar/package-lock.json @@ -1733,7 +1733,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -1741,6 +1743,10 @@ }, "engines": { "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/qs": { diff --git a/mcp/mcp-threatintel/package-lock.json b/mcp/mcp-threatintel/package-lock.json index fca6526e1..02cf9e598 100644 --- a/mcp/mcp-threatintel/package-lock.json +++ b/mcp/mcp-threatintel/package-lock.json @@ -1733,7 +1733,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -1741,6 +1743,10 @@ }, "engines": { "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/qs": { diff --git a/mcp/mcp-wazuh/package-lock.json b/mcp/mcp-wazuh/package-lock.json index e171eacaa..6b608a3b3 100644 --- a/mcp/mcp-wazuh/package-lock.json +++ b/mcp/mcp-wazuh/package-lock.json @@ -1813,9 +1813,9 @@ } }, "node_modules/proxy-addr": { - "version": "2.0.7", - "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz", - "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==", + "version": "2.0.8", + "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz", + "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==", "license": "MIT", "dependencies": { "forwarded": "0.2.0", @@ -1823,6 +1823,10 @@ }, "engines": { "node": ">= 0.10" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/express" } }, "node_modules/qs": { diff --git a/mkdocs.yml b/mkdocs.yml index fd4ccbae4..b2e193741 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -74,6 +74,7 @@ nav: - Overview: getting-started/index.md - Prerequisites: getting-started/prerequisites.md - Install LilRAE: getting-started/installation.md + - Install a Scenario Pack: getting-started/installing-packs.md - Run Your First Lab: getting-started/quick-start.md - Interfaces: - CLI: reference/cli.md diff --git a/participant-profiles/guided-purple-v1/asset-lock.json b/participant-profiles/guided-purple-v1/asset-lock.json index 4785519de..8cd93b1bc 100644 --- a/participant-profiles/guided-purple-v1/asset-lock.json +++ b/participant-profiles/guided-purple-v1/asset-lock.json @@ -55,7 +55,7 @@ "asset_id": "mcp-red-dependencies", "kind": "project-file", "source": "mcp/mcp-red/package-lock.json", - "sha256": "a9a79bbc7f286269cb4aadaee8071f13e9be4359165c18422e4cafcb55980b05" + "sha256": "066731a46c7ac8719b92ccb4df3eff55eaa1069222295f7f5d7c08ac0bd7c6ce" }, { "asset_id": "mcp-red-config", @@ -73,7 +73,7 @@ "asset_id": "mcp-indexer-dependencies", "kind": "project-file", "source": "mcp/mcp-indexer/package-lock.json", - "sha256": "6da114be21cd01b7b124f621e611bc888ecc3a5a11d18d1db4e2f163486bce41" + "sha256": "c13275f16462ee69107fe05fd4b0e86d643f64d64bacee5b46a9721a810f332c" }, { "asset_id": "mcp-indexer-config", @@ -91,7 +91,7 @@ "asset_id": "mcp-wazuh-dependencies", "kind": "project-file", "source": "mcp/mcp-wazuh/package-lock.json", - "sha256": "8ac8b464c80524457e24830aabd63efbfb0a07f40d96cd965c2283a6b994ca67" + "sha256": "9f9d8c187b83ea7dd9de8152138284a52dbc09e2b6708a8341fb9fe2fb9fe668" }, { "asset_id": "mcp-wazuh-config", diff --git a/participant-profiles/guided-purple-v1/profile.json b/participant-profiles/guided-purple-v1/profile.json index 65a59dfa5..913c35655 100644 --- a/participant-profiles/guided-purple-v1/profile.json +++ b/participant-profiles/guided-purple-v1/profile.json @@ -29,7 +29,7 @@ "asset_lock_schema": "aptl.participant-asset-lock/v1", "qualification_report_schema": "aptl.participant-qualification/v1", "asset_lock_ref": "participant-profiles/guided-purple-v1/asset-lock.json", - "asset_lock_sha256": "71256282fa931c00c0053b7a06f87d9e5bfac4db6d245642f18885cfeea558aa", + "asset_lock_sha256": "c6817ee38b62035842592d5bdc533b02f716b688c2e0542a285da82189923821", "qualification_report_ref": "release/qualification/guided-purple-v1.json" }, "budgets": { diff --git a/pyproject.toml b/pyproject.toml index 117392e64..78f59378c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -31,7 +31,7 @@ dependencies = [ "opentelemetry-semantic-conventions>=0.54b0", "cryptography>=50.0.0", "raes==6.0.1", - "raes-env-packs==6.2.0", + "raes-env-packs==6.2.1", "mcp>=2,<3", "rfc8785>=0.1.4,<0.2.0", "packaging>=24.2", diff --git a/requirements/dev.txt b/requirements/dev.txt index 709fde80c..52dcd3462 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -847,9 +847,9 @@ raes==6.0.1 \ # via # aptl-labs # raes-env-packs -raes-env-packs==6.2.0 \ - --hash=sha256:47565e4b77297ef8c908aaad063c213777fd3a96a0fc488c2c0133573f91654c \ - --hash=sha256:833f9160dc2ccb0958d2be635c0a901312efbd447888cade6de074b13fe756f5 +raes-env-packs==6.2.1 \ + --hash=sha256:2144f4460cbcd8a2579820b6962fd59fb714c437b980a11ef4041017b22661b2 \ + --hash=sha256:6a235e6c75697cb8a1afcb011b70b77e6bdc6fa302911aaa607f25856689b657 # via aptl-labs referencing==0.37.0 \ --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231 \ diff --git a/requirements/docs.txt b/requirements/docs.txt index 631036e1a..059ce2af0 100644 --- a/requirements/docs.txt +++ b/requirements/docs.txt @@ -796,9 +796,9 @@ raes==6.0.1 \ # via # aptl-labs # raes-env-packs -raes-env-packs==6.2.0 \ - --hash=sha256:47565e4b77297ef8c908aaad063c213777fd3a96a0fc488c2c0133573f91654c \ - --hash=sha256:833f9160dc2ccb0958d2be635c0a901312efbd447888cade6de074b13fe756f5 +raes-env-packs==6.2.1 \ + --hash=sha256:2144f4460cbcd8a2579820b6962fd59fb714c437b980a11ef4041017b22661b2 \ + --hash=sha256:6a235e6c75697cb8a1afcb011b70b77e6bdc6fa302911aaa607f25856689b657 # via aptl-labs referencing==0.37.0 \ --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231 \ diff --git a/requirements/runtime.txt b/requirements/runtime.txt index 38f965697..1fbc08e65 100644 --- a/requirements/runtime.txt +++ b/requirements/runtime.txt @@ -637,9 +637,9 @@ raes==6.0.1 \ # via # aptl-labs # raes-env-packs -raes-env-packs==6.2.0 \ - --hash=sha256:47565e4b77297ef8c908aaad063c213777fd3a96a0fc488c2c0133573f91654c \ - --hash=sha256:833f9160dc2ccb0958d2be635c0a901312efbd447888cade6de074b13fe756f5 +raes-env-packs==6.2.1 \ + --hash=sha256:2144f4460cbcd8a2579820b6962fd59fb714c437b980a11ef4041017b22661b2 \ + --hash=sha256:6a235e6c75697cb8a1afcb011b70b77e6bdc6fa302911aaa607f25856689b657 # via aptl-labs referencing==0.37.0 \ --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231 \ diff --git a/requirements/web.txt b/requirements/web.txt index e0a68e030..138adf747 100644 --- a/requirements/web.txt +++ b/requirements/web.txt @@ -655,9 +655,9 @@ raes==6.0.1 \ # via # aptl-labs # raes-env-packs -raes-env-packs==6.2.0 \ - --hash=sha256:47565e4b77297ef8c908aaad063c213777fd3a96a0fc488c2c0133573f91654c \ - --hash=sha256:833f9160dc2ccb0958d2be635c0a901312efbd447888cade6de074b13fe756f5 +raes-env-packs==6.2.1 \ + --hash=sha256:2144f4460cbcd8a2579820b6962fd59fb714c437b980a11ef4041017b22661b2 \ + --hash=sha256:6a235e6c75697cb8a1afcb011b70b77e6bdc6fa302911aaa607f25856689b657 # via aptl-labs referencing==0.37.0 \ --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231 \ diff --git a/src/aptl/backends/raes_runtime_attestation.py b/src/aptl/backends/raes_runtime_attestation.py index 446049f39..4b39b5648 100644 --- a/src/aptl/backends/raes_runtime_attestation.py +++ b/src/aptl/backends/raes_runtime_attestation.py @@ -40,10 +40,10 @@ TECHVAULT_RUNTIME_ATTESTATION_SET_DIGEST = ( - "sha256:df00ea2a2672864ad8c711a3eab3a8a7bffff4db058b4a9acde032a61b2a1504" + "sha256:1229f94f31bd35d3997d47ef8316ffebb3d2d2919c995838e458420b70456fcf" ) TECHVAULT_STUDY_RUNTIME_ATTESTATION_SET_DIGEST = ( - "sha256:fdde7b1a8b9377f7ddd473417de1f3fd3e24549e4560d8d6392f1727b3af5357" + "sha256:03baae367b452527be4affd7f29369bf5aa32a2a3c1c82f73bfbc759d642af14" ) # These are configuration descriptions whose realized implementation is bound @@ -84,7 +84,7 @@ "runtime-software-components": "software_components", } -# Canonical projections from raes-env-packs 6.2.0's content-identified +# Canonical projections from raes-env-packs 6.2.1's content-identified # TechVault semantic parent. Each key is independently pinned so changing one # SDL claim cannot borrow the pack-level identity and pass as the old contract. _TECHVAULT_PROJECTION_DIGESTS: Mapping[tuple[str, str], str] = { diff --git a/src/aptl_techvault/runtime_parameters.py b/src/aptl_techvault/runtime_parameters.py index d67acdb76..a6d45030b 100644 --- a/src/aptl_techvault/runtime_parameters.py +++ b/src/aptl_techvault/runtime_parameters.py @@ -12,7 +12,7 @@ from aptl.core.scenario_bundle import ScenarioBundle TECHVAULT_PACK_SET_DIGEST = ( - "sha256:df00ea2a2672864ad8c711a3eab3a8a7bffff4db058b4a9acde032a61b2a1504" + "sha256:1229f94f31bd35d3997d47ef8316ffebb3d2d2919c995838e458420b70456fcf" ) _TECHVAULT_PACK_VERSION = "0.1.1" STUDY_PACK_SET_DIGEST = TECHVAULT_STUDY_RUNTIME_ATTESTATION_SET_DIGEST diff --git a/src/aptl_techvault/serving.py b/src/aptl_techvault/serving.py index 40e11c042..6c70417a9 100644 --- a/src/aptl_techvault/serving.py +++ b/src/aptl_techvault/serving.py @@ -17,7 +17,7 @@ __version__ = "0.1.0" _PACK_SET_DIGEST = ( - "sha256:df00ea2a2672864ad8c711a3eab3a8a7bffff4db058b4a9acde032a61b2a1504" + "sha256:1229f94f31bd35d3997d47ef8316ffebb3d2d2919c995838e458420b70456fcf" ) _GROUP_BY_COMPONENT = { diff --git a/src/aptl_techvault/verification.py b/src/aptl_techvault/verification.py index 3e846fe2d..5820b904b 100644 --- a/src/aptl_techvault/verification.py +++ b/src/aptl_techvault/verification.py @@ -48,7 +48,7 @@ #: against, and it takes a verifier release -- not a wider declaration -- to #: admit one. An empty claim is not a wildcard for future scenario content. TECHVAULT_PACK_SET_DIGEST = ( - "sha256:df00ea2a2672864ad8c711a3eab3a8a7bffff4db058b4a9acde032a61b2a1504" + "sha256:1229f94f31bd35d3997d47ef8316ffebb3d2d2919c995838e458420b70456fcf" ) #: The pack release these bytes belong to. Version and digest are declared as diff --git a/tests/test_api_scenarios.py b/tests/test_api_scenarios.py index 0eca8858c..3cdd65f68 100644 --- a/tests/test_api_scenarios.py +++ b/tests/test_api_scenarios.py @@ -35,7 +35,7 @@ def test_list_reports_validated_acquired_pack_identity(api_client, tmp_path): assert body[0]["pack"] == { "id": "techvault-participant-study", "version": "0.1.1", - "set_digest": "sha256:fdde7b1a8b9377f7ddd473417de1f3fd3e24549e4560d8d6392f1727b3af5357", + "set_digest": "sha256:03baae367b452527be4affd7f29369bf5aa32a2a3c1c82f73bfbc759d642af14", "maturity": "built", } assert body[0]["validation"]["valid"] is True diff --git a/tests/test_env_pack_bundle.py b/tests/test_env_pack_bundle.py index af95cfa69..bd8d2254d 100644 --- a/tests/test_env_pack_bundle.py +++ b/tests/test_env_pack_bundle.py @@ -79,7 +79,7 @@ def test_released_pack_owns_only_scenario_and_retains_its_evidence_contracts( from raes import parse_sdl from raes_processor.capture_admission import compile_scenario_capture_demands - assert version("raes-env-packs") == "6.2.0" + assert version("raes-env-packs") == "6.2.1" assert version("raes") == "6.0.1" bundle = env_pack_bundle(tmp_path / "released", "techvault") scenario = parse_sdl(bundle.sdl_path.read_text()) @@ -121,7 +121,7 @@ def test_env_pack_bundle_stages_and_validates_the_bundled_techvault_pack( pack_id="techvault", pack_version="0.1.1", set_digest=( - "sha256:df00ea2a2672864ad8c711a3eab3a8a7bffff4db058b4a9acde032a61b2a1504" + "sha256:1229f94f31bd35d3997d47ef8316ffebb3d2d2919c995838e458420b70456fcf" ), ) # The bundle roots at the staged copy, never at the installed package. diff --git a/tests/test_misp_redis_realization_contract.py b/tests/test_misp_redis_realization_contract.py index 32f716ee2..9b505cd3c 100644 --- a/tests/test_misp_redis_realization_contract.py +++ b/tests/test_misp_redis_realization_contract.py @@ -45,7 +45,7 @@ def _enum(value: object) -> object: def test_released_pack_authors_the_misp_and_cache_contract(tmp_path: Path) -> None: """The released pack retains OpenRAE/env-packs#280's MISP contract.""" - assert version("raes-env-packs") == "6.2.0" + assert version("raes-env-packs") == "6.2.1" scenario = parse_sdl_file(techvault_scenario_path(tmp_path)) application = scenario.nodes["misp"].runtime.platform_applications[0] diff --git a/tests/test_shuffle_realization_contract.py b/tests/test_shuffle_realization_contract.py index 3f3caf9cd..be9c1b4fb 100644 --- a/tests/test_shuffle_realization_contract.py +++ b/tests/test_shuffle_realization_contract.py @@ -36,7 +36,7 @@ def _enum_value(value: object) -> object: def test_released_pack_supplies_shuffle_semantics_and_leaves_mechanics_open( tmp_path: Path, ) -> None: - assert version("raes-env-packs") == "6.2.0" + assert version("raes-env-packs") == "6.2.1" scenario = parse_sdl_file(techvault_scenario_path(tmp_path)) backend = scenario.nodes["shuffle-backend"].runtime opensearch = scenario.nodes["shuffle-opensearch"].runtime diff --git a/tests/test_techvault_pack_interaction_provider.py b/tests/test_techvault_pack_interaction_provider.py index dc8ac0f14..bac628f06 100644 --- a/tests/test_techvault_pack_interaction_provider.py +++ b/tests/test_techvault_pack_interaction_provider.py @@ -13,7 +13,7 @@ PACK = PackIdentity( pack_id="techvault", pack_version="0.1.1", - set_digest="sha256:df00ea2a2672864ad8c711a3eab3a8a7bffff4db058b4a9acde032a61b2a1504", + set_digest="sha256:1229f94f31bd35d3997d47ef8316ffebb3d2d2919c995838e458420b70456fcf", ) BACKEND = BackendIdentity("aptl", "0.1.0", "full-remote-control-plane") diff --git a/uv.lock b/uv.lock index 9abc5e65f..ad7f9ae6e 100644 --- a/uv.lock +++ b/uv.lock @@ -130,7 +130,7 @@ requires-dist = [ { name = "pytest-xdist", marker = "extra == 'dev'", specifier = ">=3.6.0" }, { name = "pyyaml", specifier = ">=6.0" }, { name = "raes", specifier = "==6.0.1" }, - { name = "raes-env-packs", specifier = "==6.2.0" }, + { name = "raes-env-packs", specifier = "==6.2.1" }, { name = "rfc8785", specifier = ">=0.1.4,<0.2.0" }, { name = "rich", specifier = ">=13.0.0" }, { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.15.0" }, @@ -2182,7 +2182,7 @@ wheels = [ [[package]] name = "raes-env-packs" -version = "6.2.0" +version = "6.2.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "anyio" }, @@ -2191,9 +2191,9 @@ dependencies = [ { name = "pyyaml" }, { name = "raes" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/93/ed/3f4af32d4ee13a687f33c5a1a2751e2673a2705ca553745192c86778b579/raes_env_packs-6.2.0.tar.gz", hash = "sha256:47565e4b77297ef8c908aaad063c213777fd3a96a0fc488c2c0133573f91654c", size = 3023509, upload-time = "2026-10-03T19:51:42.068Z" } +sdist = { url = "https://files.pythonhosted.org/packages/24/08/a968eeb56a306d42b8ce1bd5b041e3e0d81b6c564b4c5e3aef3bb23054f7/raes_env_packs-6.2.1.tar.gz", hash = "sha256:6a235e6c75697cb8a1afcb011b70b77e6bdc6fa302911aaa607f25856689b657", size = 3027670, upload-time = "2026-10-06T03:12:23.962Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/15/c0/a1ed6badaed1d3aa0dec32822a1c21091feab63dfaf6cb478152dfecef13/raes_env_packs-6.2.0-py3-none-any.whl", hash = "sha256:833f9160dc2ccb0958d2be635c0a901312efbd447888cade6de074b13fe756f5", size = 2726259, upload-time = "2026-10-03T19:51:40.488Z" }, + { url = "https://files.pythonhosted.org/packages/88/06/dff449d1a47a690228b692d9f98a2129c625031b5e437c3bb9de11fe8ada/raes_env_packs-6.2.1-py3-none-any.whl", hash = "sha256:2144f4460cbcd8a2579820b6962fd59fb714c437b980a11ef4041017b22661b2", size = 2728677, upload-time = "2026-10-06T03:12:22.185Z" }, ] [[package]]