Add detection pack registry and publishing workflows

README.md

@@ -1,81 +1,86 @@
 # DetLab
 
-DetLab is an open-source detection-as-code platform for validating detections, generating analytics, exporting detections across platforms, and managing reusable behavioral detection content.
+DetLab is an advanced detection engineering platform for validating, translating, scoring, packaging, and distributing behavioral detections across multiple security backends.
 
-## Core Capabilities
+## Platform Capabilities
 
 - Detection validation
-- ATT&CK mapping
-- ATT&CK analytics
+- ATT&CK mapping and analytics
 - Detection maturity scoring
 - Behavioral sequence detections
-- Sigma import/export
-- Splunk SPL export
-- Microsoft Sentinel KQL export
-- Elastic EQL export
-- HTML dashboard generation
+- Multi-platform export pipelines
+- HTML analytics dashboards
 - Detection pack management
+- Pack registry workflows
 - Governance reporting
 - CI/CD integration
 
-## Detection Packs
+## Detection Pack Registry
 
-DetLab now supports reusable detection packs.
+DetLab now supports registry-oriented detection pack workflows.
 
-### Example Structure
+## Pack Lifecycle
 
 ```text
-packs/
-  windows-core/
-    pack.yml
-    detections/
-
-  insider-threat/
-    pack.yml
-    detections/
+Build -> Publish -> Install -> Validate -> Analyze
 ```
 
-### Example Manifest
+## Supported Workflows
 
-```yaml
-name: windows-core
-version: 1.0.0
-maintainer: Mell0wx
-platforms:
-  - splunk
-  - sentinel
-  - elastic
-
-attack_tactics:
-  - execution
-  - persistence
+### Build Detection Pack
+
+```bash
+detlab pack build packs/windows-core
 ```
 
-## Pack Features
+Creates:
+- distributable archives
+- checksum metadata
+- semantic version metadata
 
-- Pack manifest validation
-- Version tracking
-- Supported backend tracking
-- ATT&CK coverage summaries
-- Pack maturity scoring
-- Dependency tracking
-- Reusable detection libraries
+### Publish Detection Pack
 
-## Example Pack Workflows
+```bash
+detlab pack publish packs/windows-core
+```
+
+Creates:
+- registry archives
+- registry metadata manifests
+- reusable distributable bundles
 
-### Validate Pack
+### Install Detection Pack
 
 ```bash
-detlab pack validate packs/windows-core
+detlab pack install windows-core
 ```
 
-### Generate Pack Report
+Supports:
+- local registry cache
+- reusable deployments
+- portable content workflows
 
-```bash
-detlab pack report packs/windows-core --format markdown
+## Registry Metadata Example
+
+```json
+{
+  "name": "windows-core",
+  "version": "1.0.0",
+  "checksum": "sha256-value",
+  "archive": "windows-core-1.0.0.tar.gz"
+}
+```
+
+## Detection Pack Structure
+
+```text
+packs/
+  windows-core/
+    pack.yml
+    detections/
 ```
 
-## Behavioral Sequence Example
+## Behavioral Detection Example
 
 ```yaml
 sequence:
@@ -86,39 +91,38 @@ sequence:
       selection:
         Image: powershell.exe
 
-    - name: Suspicious Network Connection
+    - name: Network Connection
       selection:
         DestinationPort: 4444
 ```
 
-## Platform Export Matrix
+## Supported Export Targets
 
-| Backend | Supported |
+| Backend | Support |
 |---|---|
 | Sigma | Yes |
 | Splunk SPL | Yes |
 | Microsoft Sentinel KQL | Yes |
 | Elastic EQL | Yes |
 
-## Governance + Analytics
+## Governance Features
 
-DetLab supports:
-
-- ATT&CK tactic coverage analysis
-- Detection quality scoring
+- ATT&CK coverage analytics
 - Weak detection identification
-- Maturity distributions
-- HTML executive dashboards
-- Behavioral analytics foundations
-
-## Roadmap
-
-- Pack publishing
-- Community registry
-- Interactive dashboards
-- Correlation rule generation
-- Behavioral detection packs
-- Threat-informed analytics
+- Detection maturity scoring
+- Pack-level reporting
+- Behavioral analytics
+- Executive dashboards
+
+## Long-Term Vision
+
+DetLab is evolving toward:
+
+- community detection ecosystems
+- reusable behavioral detection libraries
+- enterprise detection governance
+- portable detection engineering pipelines
+- threat-informed analytics platforms
 
 ## License
 

detlab/registry.py

@@ -0,0 +1,83 @@
+from pathlib import Path
+import hashlib
+import json
+import shutil
+import tarfile
+
+from detlab.packs import load_pack_manifest
+
+LOCAL_REGISTRY = Path(".detlab/registry")
+
+
+
+def calculate_checksum(path: Path) -> str:
+    sha256 = hashlib.sha256()
+
+    with path.open("rb") as f:
+        while chunk := f.read(8192):
+            sha256.update(chunk)
+
+    return sha256.hexdigest()
+
+
+
+def build_pack(pack_dir: Path, output_dir: Path = Path("dist")) -> Path:
+    manifest = load_pack_manifest(pack_dir)
+
+    output_dir.mkdir(parents=True, exist_ok=True)
+
+    archive_name = f"{manifest['name']}-{manifest['version']}.tar.gz"
+    archive_path = output_dir / archive_name
+
+    with tarfile.open(archive_path, "w:gz") as tar:
+        tar.add(pack_dir, arcname=pack_dir.name)
+
+    checksum = calculate_checksum(archive_path)
+
+    metadata = {
+        "name": manifest["name"],
+        "version": manifest["version"],
+        "checksum": checksum,
+        "platforms": manifest.get("platforms", []),
+    }
+
+    metadata_path = output_dir / f"{manifest['name']}-{manifest['version']}.json"
+    metadata_path.write_text(json.dumps(metadata, indent=2), encoding="utf-8")
+
+    return archive_path
+
+
+
+def install_pack(archive_path: Path, install_dir: Path = LOCAL_REGISTRY) -> Path:
+    install_dir.mkdir(parents=True, exist_ok=True)
+
+    with tarfile.open(archive_path, "r:gz") as tar:
+        tar.extractall(path=install_dir)
+
+    return install_dir
+
+
+
+def publish_pack(pack_dir: Path, registry_dir: Path = Path("registry")) -> dict:
+    registry_dir.mkdir(parents=True, exist_ok=True)
+
+    archive = build_pack(pack_dir, registry_dir)
+
+    checksum = calculate_checksum(archive)
+
+    manifest = load_pack_manifest(pack_dir)
+
+    published_metadata = {
+        "name": manifest["name"],
+        "version": manifest["version"],
+        "checksum": checksum,
+        "archive": archive.name,
+    }
+
+    metadata_file = registry_dir / f"{manifest['name']}.json"
+    metadata_file.write_text(
+        json.dumps(published_metadata, indent=2),
+        encoding="utf-8",
+    )
+
+    return published_metadata

tests/test_registry.py

@@ -0,0 +1,14 @@
+from pathlib import Path
+
+from detlab.registry import calculate_checksum
+
+
+
+def test_calculate_checksum(tmp_path: Path):
+    test_file = tmp_path / "test.txt"
+    test_file.write_text("detlab", encoding="utf-8")
+
+    checksum = calculate_checksum(test_file)
+
+    assert isinstance(checksum, str)
+    assert len(checksum) == 64