From 85e5713c10cd46bdb99f614e0391890905d63137 Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Thu, 23 Jul 2026 17:10:29 +0000 Subject: [PATCH] runtime: publish HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384 --- ...ADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384.json | 30 +++++++ ...LADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384.txt | 84 +++++++++++++++++++ runtime/latest.json | 18 ++-- runtime/latest.txt | 73 ++++++++++++++-- 4 files changed, 188 insertions(+), 17 deletions(-) create mode 100644 runtime/history/HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384.json create mode 100644 runtime/history/HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384.txt diff --git a/runtime/history/HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384.json b/runtime/history/HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384.json new file mode 100644 index 0000000..856ad1a --- /dev/null +++ b/runtime/history/HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384.json @@ -0,0 +1,30 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "read-only", + "component": "cluster-audit", + "started_at_utc": "2026-07-23T17:10:28Z", + "finished_at_utc": "2026-07-23T17:10:28Z", + "reference_register_checked": true, + "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", + "error_register_checked": true, + "error_register_sha256": "08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752", + "command_sha256": "a7320ed2ae1becc8871f7fe2d84c11a3fa8380eab4f383fa906a10bbb9049da7", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "changes_made": false, + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "119a7528288c446ea5d3ce64bb0e3a3132688450cc725ca8e1bcdb26dce0e4ce", + "sanitized_output_sha256": "119a7528288c446ea5d3ce64bb0e3a3132688450cc725ca8e1bcdb26dce0e4ce", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "DETAIL=READER_TRANSPORT_COMPONENTS=PASS\nDETAIL=PENDING_COOKIE_META=0:0|600|752|regular file\nDETAIL=PENDING_COOKIE_SHA256=3c260f0622999b94e1c3b45d5042532fe001b8118dff0d326636b2ad8609d8c4\nDETAIL=PENDING_COOKIE_CAPTURE_FORMAT=RAW_COOKIE_VALUE\nDETAIL=PENDING_COOKIE_PAIR_COUNT=5\nDETAIL=PENDING_COOKIE_DUPLICATE_NAME_COUNT=0\nDETAIL=PENDING_COOKIE_UTF8_BOM=NO\nDETAIL=PENDING_COOKIE_CRLF=NO\nDETAIL=PENDING_COOKIE_TRAILING_NEWLINE=NO\nDETAIL=PENDING_COOKIE_SECRET_OUTPUT=NONE\nDETAIL=SERVICE_LOADSTATE=loaded\nDETAIL=SERVICE_ACTIVESTATE=failed\nDETAIL=SERVICE_SUBSTATE=failed\nDETAIL=SERVICE_RESULT=exit-code\nDETAIL=SERVICE_EXECMAINSTATUS=1\nDETAIL=SERVICE_FRAGMENTPATH=/etc/systemd/system/skladchik-reports-monitor-supervisor.service\nDETAIL=SERVICE_USER=\nDETAIL=SERVICE_GROUP=\nDETAIL=SERVICE_WORKINGDIRECTORY=\nDETAIL=SERVICE_RESTART=no\nDETAIL=SERVICE_RESTARTUSEC=100ms\nDETAIL=RUNTIME_SOURCE=/usr/local/sbin/skladchik-reports-monitor-status|ROLE=STATUS_SCRIPT|META=0:0|755|3427|regular file|SHA256=f902a61109efbac5918360f2235c2523bd10704ac484a4e8591e8a1c490faf5a\nDETAIL=SOURCE_LINE=STATUS_SCRIPT|82|echo \"SHELL_SESSION_PRESERVED=yes\"\nDETAIL=RUNTIME_SOURCE=/usr/local/sbin/skladchik-reports-monitor-supervisor|ROLE=SUPERVISOR|META=0:0|755|20463|regular file|SHA256=35c68ae0929ff3795be2bde40de334fc8e26413a3d8a620a137be90d1f2c164e\nDETAIL=SOURCE_LINE=SUPERVISOR|22|COOKIE_EXPIRY_WARN_SECONDS = int(os.environ.get(\"SKLADCHIK_COOKIE_EXPIRY_WARN_SECONDS\", \"604800\"))\nDETAIL=SOURCE_LINE=SUPERVISOR|127|test -s /var/lib/skladchik-reports-monitor/cookies.jar && echo cookies_jar=yes || echo cookies_jar=no\nDETAIL=SOURCE_LINE=SUPERVISOR|128|[ -s /var/lib/skladchik-reports-monitor/cookies.jar ] && echo cookies_jar_bytes=$(stat -c %s /var/lib/skladchik-reports-monitor/cookies.jar 2>/dev/null) || echo cookies_jar_bytes=0\nDETAIL=SOURCE_LINE=SUPERVISOR|153| facts[\"session_keepalive\"] = mon.get(\"session_keepalive\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|154| facts[\"cookie_jar\"] = mon.get(\"cookie_jar\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|155| facts[\"cookie_jar_bytes\"] = mon.get(\"cookie_jar_bytes\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|156| facts[\"cookie_expiry_status\"] = mon.get(\"cookie_expiry_status\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|157| facts[\"cookie_expiry_utc\"] = mon.get(\"cookie_expiry_utc\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|158| facts[\"cookie_expires_in_seconds\"] = mon.get(\"cookie_expires_in_seconds\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|159| facts[\"cookie_expires_in_days\"] = mon.get(\"cookie_expires_in_days\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|160| facts[\"cookie_persistent_count\"] = mon.get(\"cookie_persistent_count\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|168| if mon.get(\"session_keepalive\") != \"persistent_cookie_jar\":\nDETAIL=SOURCE_LINE=SUPERVISOR|169| problems.append(\"session_keepalive_not_persistent\")\nDETAIL=SOURCE_LINE=SUPERVISOR|170| if mon.get(\"cookie_jar\") not in (\"yes\", \"empty\"):\nDETAIL=SOURCE_LINE=SUPERVISOR|171| problems.append(\"monitor_cookie_jar_bad\")\nDETAIL=SOURCE_LINE=SUPERVISOR|172| expiry_status = mon.get(\"cookie_expiry_status\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|174| expires_in = int(mon.get(\"cookie_expires_in_seconds\", \"\"))\nDETAIL=SOURCE_LINE=SUPERVISOR|177| if expiry_status in (\"\", \"NO_COOKIE_JAR\", \"NO_PERSISTENT_COOKIE\", \"ERROR\"):\nDETAIL=SOURCE_LINE=SUPERVISOR|178| problems.append(\"cookie_expiry_missing\")\nDETAIL=SOURCE_LINE=SUPERVISOR|180| problems.append(\"cookie_expiry_expired\")\nDETAIL=SOURCE_LINE=SUPERVISOR|181| elif expiry_status == \"WARN\" or (expires_in is not None and expires_in < COOKIE_EXPIRY_WARN_SECONDS):\nDETAIL=SOURCE_LINE=SUPERVISOR|182| problems.append(\"cookie_expiry_warn\")\nDETAIL=SOURCE_LINE=SUPERVISOR|202| for k in [\"monitor_py\", \"config_ini\", \"secrets_env\", \"cookies_jar\", \"operational_digest_py\", \"event_selftest_runner_py\", \"event_selftest_core\", \"weekly_summary_health\", \"age_alert_health\", \"event_selftest_health\", \"py_compile\"]:\nDETAIL=SOURCE_LINE=SUPERVISOR|206| facts[\"cookies_jar_bytes_file\"] = files.get(\"cookies_jar_bytes\", \"0\")\nDETAIL=COOKIE_TARGET_CANDIDATE=/var/lib/skladchik-reports-monitor/cookies.jar|STATE=ABSENT\nDETAIL=JOURNAL_MARKER_AUTH_COUNT=20\nDETAIL=JOURNAL_MARKER_COOKIE_COUNT=0\nDETAIL=JOURNAL_MARKER_LOGIN_COUNT=0\nDETAIL=JOURNAL_MARKER_HTTP_401_COUNT=0\nDETAIL=JOURNAL_MARKER_HTTP_403_COUNT=0\nDETAIL=JOURNAL_MARKER_CAPTCHA_COUNT=0\nDETAIL=JOURNAL_MARKER_FAILED_COUNT=40\nDETAIL=JOURNAL_MARKER_ERROR_COUNT=0\nDETAIL=COOKIE_FORMAT_MARKERS=NONE\nDETAIL=SKLADCHIK_COOKIE_SAFE_CONTRACT_AUDIT=PASS\nCHANGES_MADE=NO\n" +} diff --git a/runtime/history/HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384.txt b/runtime/history/HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384.txt new file mode 100644 index 0000000..00330a5 --- /dev/null +++ b/runtime/history/HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384.txt @@ -0,0 +1,84 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384 +STATUS=OK +RC=0 +HOST=pve01 +MODE=read-only +COMPONENT=cluster-audit +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752 +COMMAND_SHA256=a7320ed2ae1becc8871f7fe2d84c11a3fa8380eab4f383fa906a10bbb9049da7 +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGES_MADE=false +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=119a7528288c446ea5d3ce64bb0e3a3132688450cc725ca8e1bcdb26dce0e4ce +SANITIZED_OUTPUT_SHA256=119a7528288c446ea5d3ce64bb0e3a3132688450cc725ca8e1bcdb26dce0e4ce +OUTPUT_BEGIN +DETAIL=READER_TRANSPORT_COMPONENTS=PASS +DETAIL=PENDING_COOKIE_META=0:0|600|752|regular file +DETAIL=PENDING_COOKIE_SHA256=3c260f0622999b94e1c3b45d5042532fe001b8118dff0d326636b2ad8609d8c4 +DETAIL=PENDING_COOKIE_CAPTURE_FORMAT=RAW_COOKIE_VALUE +DETAIL=PENDING_COOKIE_PAIR_COUNT=5 +DETAIL=PENDING_COOKIE_DUPLICATE_NAME_COUNT=0 +DETAIL=PENDING_COOKIE_UTF8_BOM=NO +DETAIL=PENDING_COOKIE_CRLF=NO +DETAIL=PENDING_COOKIE_TRAILING_NEWLINE=NO +DETAIL=PENDING_COOKIE_SECRET_OUTPUT=NONE +DETAIL=SERVICE_LOADSTATE=loaded +DETAIL=SERVICE_ACTIVESTATE=failed +DETAIL=SERVICE_SUBSTATE=failed +DETAIL=SERVICE_RESULT=exit-code +DETAIL=SERVICE_EXECMAINSTATUS=1 +DETAIL=SERVICE_FRAGMENTPATH=/etc/systemd/system/skladchik-reports-monitor-supervisor.service +DETAIL=SERVICE_USER= +DETAIL=SERVICE_GROUP= +DETAIL=SERVICE_WORKINGDIRECTORY= +DETAIL=SERVICE_RESTART=no +DETAIL=SERVICE_RESTARTUSEC=100ms +DETAIL=RUNTIME_SOURCE=/usr/local/sbin/skladchik-reports-monitor-status|ROLE=STATUS_SCRIPT|META=0:0|755|3427|regular file|SHA256=f902a61109efbac5918360f2235c2523bd10704ac484a4e8591e8a1c490faf5a +DETAIL=SOURCE_LINE=STATUS_SCRIPT|82|echo "SHELL_SESSION_PRESERVED=yes" +DETAIL=RUNTIME_SOURCE=/usr/local/sbin/skladchik-reports-monitor-supervisor|ROLE=SUPERVISOR|META=0:0|755|20463|regular file|SHA256=35c68ae0929ff3795be2bde40de334fc8e26413a3d8a620a137be90d1f2c164e +DETAIL=SOURCE_LINE=SUPERVISOR|22|COOKIE_EXPIRY_WARN_SECONDS = int(os.environ.get("SKLADCHIK_COOKIE_EXPIRY_WARN_SECONDS", "604800")) +DETAIL=SOURCE_LINE=SUPERVISOR|127|test -s /var/lib/skladchik-reports-monitor/cookies.jar && echo cookies_jar=yes || echo cookies_jar=no +DETAIL=SOURCE_LINE=SUPERVISOR|128|[ -s /var/lib/skladchik-reports-monitor/cookies.jar ] && echo cookies_jar_bytes=$(stat -c %s /var/lib/skladchik-reports-monitor/cookies.jar 2>/dev/null) || echo cookies_jar_bytes=0 +DETAIL=SOURCE_LINE=SUPERVISOR|153| facts["session_keepalive"] = mon.get("session_keepalive", "") +DETAIL=SOURCE_LINE=SUPERVISOR|154| facts["cookie_jar"] = mon.get("cookie_jar", "") +DETAIL=SOURCE_LINE=SUPERVISOR|155| facts["cookie_jar_bytes"] = mon.get("cookie_jar_bytes", "") +DETAIL=SOURCE_LINE=SUPERVISOR|156| facts["cookie_expiry_status"] = mon.get("cookie_expiry_status", "") +DETAIL=SOURCE_LINE=SUPERVISOR|157| facts["cookie_expiry_utc"] = mon.get("cookie_expiry_utc", "") +DETAIL=SOURCE_LINE=SUPERVISOR|158| facts["cookie_expires_in_seconds"] = mon.get("cookie_expires_in_seconds", "") +DETAIL=SOURCE_LINE=SUPERVISOR|159| facts["cookie_expires_in_days"] = mon.get("cookie_expires_in_days", "") +DETAIL=SOURCE_LINE=SUPERVISOR|160| facts["cookie_persistent_count"] = mon.get("cookie_persistent_count", "") +DETAIL=SOURCE_LINE=SUPERVISOR|168| if mon.get("session_keepalive") != "persistent_cookie_jar": +DETAIL=SOURCE_LINE=SUPERVISOR|169| problems.append("session_keepalive_not_persistent") +DETAIL=SOURCE_LINE=SUPERVISOR|170| if mon.get("cookie_jar") not in ("yes", "empty"): +DETAIL=SOURCE_LINE=SUPERVISOR|171| problems.append("monitor_cookie_jar_bad") +DETAIL=SOURCE_LINE=SUPERVISOR|172| expiry_status = mon.get("cookie_expiry_status", "") +DETAIL=SOURCE_LINE=SUPERVISOR|174| expires_in = int(mon.get("cookie_expires_in_seconds", "")) +DETAIL=SOURCE_LINE=SUPERVISOR|177| if expiry_status in ("", "NO_COOKIE_JAR", "NO_PERSISTENT_COOKIE", "ERROR"): +DETAIL=SOURCE_LINE=SUPERVISOR|178| problems.append("cookie_expiry_missing") +DETAIL=SOURCE_LINE=SUPERVISOR|180| problems.append("cookie_expiry_expired") +DETAIL=SOURCE_LINE=SUPERVISOR|181| elif expiry_status == "WARN" or (expires_in is not None and expires_in < COOKIE_EXPIRY_WARN_SECONDS): +DETAIL=SOURCE_LINE=SUPERVISOR|182| problems.append("cookie_expiry_warn") +DETAIL=SOURCE_LINE=SUPERVISOR|202| for k in ["monitor_py", "config_ini", "secrets_env", "cookies_jar", "operational_digest_py", "event_selftest_runner_py", "event_selftest_core", "weekly_summary_health", "age_alert_health", "event_selftest_health", "py_compile"]: +DETAIL=SOURCE_LINE=SUPERVISOR|206| facts["cookies_jar_bytes_file"] = files.get("cookies_jar_bytes", "0") +DETAIL=COOKIE_TARGET_CANDIDATE=/var/lib/skladchik-reports-monitor/cookies.jar|STATE=ABSENT +DETAIL=JOURNAL_MARKER_AUTH_COUNT=20 +DETAIL=JOURNAL_MARKER_COOKIE_COUNT=0 +DETAIL=JOURNAL_MARKER_LOGIN_COUNT=0 +DETAIL=JOURNAL_MARKER_HTTP_401_COUNT=0 +DETAIL=JOURNAL_MARKER_HTTP_403_COUNT=0 +DETAIL=JOURNAL_MARKER_CAPTCHA_COUNT=0 +DETAIL=JOURNAL_MARKER_FAILED_COUNT=40 +DETAIL=JOURNAL_MARKER_ERROR_COUNT=0 +DETAIL=COOKIE_FORMAT_MARKERS=NONE +DETAIL=SKLADCHIK_COOKIE_SAFE_CONTRACT_AUDIT=PASS +CHANGES_MADE=NO + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index bbda3eb..856ad1a 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "HOMELAB-SKLADCHIK-COOKIE-RUNTIME-CONTRACT-AUDIT-383", - "status": "FAIL", - "rc": 1, + "command_id": "HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384", + "status": "OK", + "rc": 0, "host": "pve01", "mode": "read-only", "component": "cluster-audit", - "started_at_utc": "2026-07-23T17:06:54Z", - "finished_at_utc": "2026-07-23T17:06:54Z", + "started_at_utc": "2026-07-23T17:10:28Z", + "finished_at_utc": "2026-07-23T17:10:28Z", "reference_register_checked": true, "reference_sha256": "5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e", "error_register_checked": true, "error_register_sha256": "08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752", - "command_sha256": "3c7fc08a50227a73a7b0c334cb1dcc8403295eb6512132b170a3e16b5a2f08e7", + "command_sha256": "a7320ed2ae1becc8871f7fe2d84c11a3fa8380eab4f383fa906a10bbb9049da7", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -22,9 +22,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "dda83d14299c19179ce37040bd60a90addf630f61a350ea49fd17e585076e0ba", - "sanitized_output_sha256": "dda83d14299c19179ce37040bd60a90addf630f61a350ea49fd17e585076e0ba", + "raw_evidence_sha256": "119a7528288c446ea5d3ce64bb0e3a3132688450cc725ca8e1bcdb26dce0e4ce", + "sanitized_output_sha256": "119a7528288c446ea5d3ce64bb0e3a3132688450cc725ca8e1bcdb26dce0e4ce", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "DETAIL=READER_TRANSPORT_COMPONENTS=PASS\nDETAIL=PENDING_COOKIE_HEADER_META=root:root|600|752|regular file\nDETAIL=PENDING_COOKIE_HEADER_SHA256=3c260f0622999b94e1c3b45d5042532fe001b8118dff0d326636b2ad8609d8c4\n" + "output": "DETAIL=READER_TRANSPORT_COMPONENTS=PASS\nDETAIL=PENDING_COOKIE_META=0:0|600|752|regular file\nDETAIL=PENDING_COOKIE_SHA256=3c260f0622999b94e1c3b45d5042532fe001b8118dff0d326636b2ad8609d8c4\nDETAIL=PENDING_COOKIE_CAPTURE_FORMAT=RAW_COOKIE_VALUE\nDETAIL=PENDING_COOKIE_PAIR_COUNT=5\nDETAIL=PENDING_COOKIE_DUPLICATE_NAME_COUNT=0\nDETAIL=PENDING_COOKIE_UTF8_BOM=NO\nDETAIL=PENDING_COOKIE_CRLF=NO\nDETAIL=PENDING_COOKIE_TRAILING_NEWLINE=NO\nDETAIL=PENDING_COOKIE_SECRET_OUTPUT=NONE\nDETAIL=SERVICE_LOADSTATE=loaded\nDETAIL=SERVICE_ACTIVESTATE=failed\nDETAIL=SERVICE_SUBSTATE=failed\nDETAIL=SERVICE_RESULT=exit-code\nDETAIL=SERVICE_EXECMAINSTATUS=1\nDETAIL=SERVICE_FRAGMENTPATH=/etc/systemd/system/skladchik-reports-monitor-supervisor.service\nDETAIL=SERVICE_USER=\nDETAIL=SERVICE_GROUP=\nDETAIL=SERVICE_WORKINGDIRECTORY=\nDETAIL=SERVICE_RESTART=no\nDETAIL=SERVICE_RESTARTUSEC=100ms\nDETAIL=RUNTIME_SOURCE=/usr/local/sbin/skladchik-reports-monitor-status|ROLE=STATUS_SCRIPT|META=0:0|755|3427|regular file|SHA256=f902a61109efbac5918360f2235c2523bd10704ac484a4e8591e8a1c490faf5a\nDETAIL=SOURCE_LINE=STATUS_SCRIPT|82|echo \"SHELL_SESSION_PRESERVED=yes\"\nDETAIL=RUNTIME_SOURCE=/usr/local/sbin/skladchik-reports-monitor-supervisor|ROLE=SUPERVISOR|META=0:0|755|20463|regular file|SHA256=35c68ae0929ff3795be2bde40de334fc8e26413a3d8a620a137be90d1f2c164e\nDETAIL=SOURCE_LINE=SUPERVISOR|22|COOKIE_EXPIRY_WARN_SECONDS = int(os.environ.get(\"SKLADCHIK_COOKIE_EXPIRY_WARN_SECONDS\", \"604800\"))\nDETAIL=SOURCE_LINE=SUPERVISOR|127|test -s /var/lib/skladchik-reports-monitor/cookies.jar && echo cookies_jar=yes || echo cookies_jar=no\nDETAIL=SOURCE_LINE=SUPERVISOR|128|[ -s /var/lib/skladchik-reports-monitor/cookies.jar ] && echo cookies_jar_bytes=$(stat -c %s /var/lib/skladchik-reports-monitor/cookies.jar 2>/dev/null) || echo cookies_jar_bytes=0\nDETAIL=SOURCE_LINE=SUPERVISOR|153| facts[\"session_keepalive\"] = mon.get(\"session_keepalive\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|154| facts[\"cookie_jar\"] = mon.get(\"cookie_jar\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|155| facts[\"cookie_jar_bytes\"] = mon.get(\"cookie_jar_bytes\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|156| facts[\"cookie_expiry_status\"] = mon.get(\"cookie_expiry_status\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|157| facts[\"cookie_expiry_utc\"] = mon.get(\"cookie_expiry_utc\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|158| facts[\"cookie_expires_in_seconds\"] = mon.get(\"cookie_expires_in_seconds\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|159| facts[\"cookie_expires_in_days\"] = mon.get(\"cookie_expires_in_days\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|160| facts[\"cookie_persistent_count\"] = mon.get(\"cookie_persistent_count\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|168| if mon.get(\"session_keepalive\") != \"persistent_cookie_jar\":\nDETAIL=SOURCE_LINE=SUPERVISOR|169| problems.append(\"session_keepalive_not_persistent\")\nDETAIL=SOURCE_LINE=SUPERVISOR|170| if mon.get(\"cookie_jar\") not in (\"yes\", \"empty\"):\nDETAIL=SOURCE_LINE=SUPERVISOR|171| problems.append(\"monitor_cookie_jar_bad\")\nDETAIL=SOURCE_LINE=SUPERVISOR|172| expiry_status = mon.get(\"cookie_expiry_status\", \"\")\nDETAIL=SOURCE_LINE=SUPERVISOR|174| expires_in = int(mon.get(\"cookie_expires_in_seconds\", \"\"))\nDETAIL=SOURCE_LINE=SUPERVISOR|177| if expiry_status in (\"\", \"NO_COOKIE_JAR\", \"NO_PERSISTENT_COOKIE\", \"ERROR\"):\nDETAIL=SOURCE_LINE=SUPERVISOR|178| problems.append(\"cookie_expiry_missing\")\nDETAIL=SOURCE_LINE=SUPERVISOR|180| problems.append(\"cookie_expiry_expired\")\nDETAIL=SOURCE_LINE=SUPERVISOR|181| elif expiry_status == \"WARN\" or (expires_in is not None and expires_in < COOKIE_EXPIRY_WARN_SECONDS):\nDETAIL=SOURCE_LINE=SUPERVISOR|182| problems.append(\"cookie_expiry_warn\")\nDETAIL=SOURCE_LINE=SUPERVISOR|202| for k in [\"monitor_py\", \"config_ini\", \"secrets_env\", \"cookies_jar\", \"operational_digest_py\", \"event_selftest_runner_py\", \"event_selftest_core\", \"weekly_summary_health\", \"age_alert_health\", \"event_selftest_health\", \"py_compile\"]:\nDETAIL=SOURCE_LINE=SUPERVISOR|206| facts[\"cookies_jar_bytes_file\"] = files.get(\"cookies_jar_bytes\", \"0\")\nDETAIL=COOKIE_TARGET_CANDIDATE=/var/lib/skladchik-reports-monitor/cookies.jar|STATE=ABSENT\nDETAIL=JOURNAL_MARKER_AUTH_COUNT=20\nDETAIL=JOURNAL_MARKER_COOKIE_COUNT=0\nDETAIL=JOURNAL_MARKER_LOGIN_COUNT=0\nDETAIL=JOURNAL_MARKER_HTTP_401_COUNT=0\nDETAIL=JOURNAL_MARKER_HTTP_403_COUNT=0\nDETAIL=JOURNAL_MARKER_CAPTCHA_COUNT=0\nDETAIL=JOURNAL_MARKER_FAILED_COUNT=40\nDETAIL=JOURNAL_MARKER_ERROR_COUNT=0\nDETAIL=COOKIE_FORMAT_MARKERS=NONE\nDETAIL=SKLADCHIK_COOKIE_SAFE_CONTRACT_AUDIT=PASS\nCHANGES_MADE=NO\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 05bdaec..00330a5 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,7 +1,7 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=HOMELAB-SKLADCHIK-COOKIE-RUNTIME-CONTRACT-AUDIT-383 -STATUS=FAIL -RC=1 +COMMAND_ID=HOMELAB-SKLADCHIK-COOKIE-SAFE-CONTRACT-AUDIT-384 +STATUS=OK +RC=0 HOST=pve01 MODE=read-only COMPONENT=cluster-audit @@ -9,19 +9,76 @@ REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5763f2f8edc75fcf6f3951f8c95896d1cc112ceccb6cf5b64a383f540a4deb8e ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=08b3a769b8e38eaa1acec915352fb328180d70caa7ff6cd9d1ec0da426262752 -COMMAND_SHA256=3c7fc08a50227a73a7b0c334cb1dcc8403295eb6512132b170a3e16b5a2f08e7 +COMMAND_SHA256=a7320ed2ae1becc8871f7fe2d84c11a3fa8380eab4f383fa906a10bbb9049da7 DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGES_MADE=false SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=dda83d14299c19179ce37040bd60a90addf630f61a350ea49fd17e585076e0ba -SANITIZED_OUTPUT_SHA256=dda83d14299c19179ce37040bd60a90addf630f61a350ea49fd17e585076e0ba +RAW_EVIDENCE_SHA256=119a7528288c446ea5d3ce64bb0e3a3132688450cc725ca8e1bcdb26dce0e4ce +SANITIZED_OUTPUT_SHA256=119a7528288c446ea5d3ce64bb0e3a3132688450cc725ca8e1bcdb26dce0e4ce OUTPUT_BEGIN DETAIL=READER_TRANSPORT_COMPONENTS=PASS -DETAIL=PENDING_COOKIE_HEADER_META=root:root|600|752|regular file -DETAIL=PENDING_COOKIE_HEADER_SHA256=3c260f0622999b94e1c3b45d5042532fe001b8118dff0d326636b2ad8609d8c4 +DETAIL=PENDING_COOKIE_META=0:0|600|752|regular file +DETAIL=PENDING_COOKIE_SHA256=3c260f0622999b94e1c3b45d5042532fe001b8118dff0d326636b2ad8609d8c4 +DETAIL=PENDING_COOKIE_CAPTURE_FORMAT=RAW_COOKIE_VALUE +DETAIL=PENDING_COOKIE_PAIR_COUNT=5 +DETAIL=PENDING_COOKIE_DUPLICATE_NAME_COUNT=0 +DETAIL=PENDING_COOKIE_UTF8_BOM=NO +DETAIL=PENDING_COOKIE_CRLF=NO +DETAIL=PENDING_COOKIE_TRAILING_NEWLINE=NO +DETAIL=PENDING_COOKIE_SECRET_OUTPUT=NONE +DETAIL=SERVICE_LOADSTATE=loaded +DETAIL=SERVICE_ACTIVESTATE=failed +DETAIL=SERVICE_SUBSTATE=failed +DETAIL=SERVICE_RESULT=exit-code +DETAIL=SERVICE_EXECMAINSTATUS=1 +DETAIL=SERVICE_FRAGMENTPATH=/etc/systemd/system/skladchik-reports-monitor-supervisor.service +DETAIL=SERVICE_USER= +DETAIL=SERVICE_GROUP= +DETAIL=SERVICE_WORKINGDIRECTORY= +DETAIL=SERVICE_RESTART=no +DETAIL=SERVICE_RESTARTUSEC=100ms +DETAIL=RUNTIME_SOURCE=/usr/local/sbin/skladchik-reports-monitor-status|ROLE=STATUS_SCRIPT|META=0:0|755|3427|regular file|SHA256=f902a61109efbac5918360f2235c2523bd10704ac484a4e8591e8a1c490faf5a +DETAIL=SOURCE_LINE=STATUS_SCRIPT|82|echo "SHELL_SESSION_PRESERVED=yes" +DETAIL=RUNTIME_SOURCE=/usr/local/sbin/skladchik-reports-monitor-supervisor|ROLE=SUPERVISOR|META=0:0|755|20463|regular file|SHA256=35c68ae0929ff3795be2bde40de334fc8e26413a3d8a620a137be90d1f2c164e +DETAIL=SOURCE_LINE=SUPERVISOR|22|COOKIE_EXPIRY_WARN_SECONDS = int(os.environ.get("SKLADCHIK_COOKIE_EXPIRY_WARN_SECONDS", "604800")) +DETAIL=SOURCE_LINE=SUPERVISOR|127|test -s /var/lib/skladchik-reports-monitor/cookies.jar && echo cookies_jar=yes || echo cookies_jar=no +DETAIL=SOURCE_LINE=SUPERVISOR|128|[ -s /var/lib/skladchik-reports-monitor/cookies.jar ] && echo cookies_jar_bytes=$(stat -c %s /var/lib/skladchik-reports-monitor/cookies.jar 2>/dev/null) || echo cookies_jar_bytes=0 +DETAIL=SOURCE_LINE=SUPERVISOR|153| facts["session_keepalive"] = mon.get("session_keepalive", "") +DETAIL=SOURCE_LINE=SUPERVISOR|154| facts["cookie_jar"] = mon.get("cookie_jar", "") +DETAIL=SOURCE_LINE=SUPERVISOR|155| facts["cookie_jar_bytes"] = mon.get("cookie_jar_bytes", "") +DETAIL=SOURCE_LINE=SUPERVISOR|156| facts["cookie_expiry_status"] = mon.get("cookie_expiry_status", "") +DETAIL=SOURCE_LINE=SUPERVISOR|157| facts["cookie_expiry_utc"] = mon.get("cookie_expiry_utc", "") +DETAIL=SOURCE_LINE=SUPERVISOR|158| facts["cookie_expires_in_seconds"] = mon.get("cookie_expires_in_seconds", "") +DETAIL=SOURCE_LINE=SUPERVISOR|159| facts["cookie_expires_in_days"] = mon.get("cookie_expires_in_days", "") +DETAIL=SOURCE_LINE=SUPERVISOR|160| facts["cookie_persistent_count"] = mon.get("cookie_persistent_count", "") +DETAIL=SOURCE_LINE=SUPERVISOR|168| if mon.get("session_keepalive") != "persistent_cookie_jar": +DETAIL=SOURCE_LINE=SUPERVISOR|169| problems.append("session_keepalive_not_persistent") +DETAIL=SOURCE_LINE=SUPERVISOR|170| if mon.get("cookie_jar") not in ("yes", "empty"): +DETAIL=SOURCE_LINE=SUPERVISOR|171| problems.append("monitor_cookie_jar_bad") +DETAIL=SOURCE_LINE=SUPERVISOR|172| expiry_status = mon.get("cookie_expiry_status", "") +DETAIL=SOURCE_LINE=SUPERVISOR|174| expires_in = int(mon.get("cookie_expires_in_seconds", "")) +DETAIL=SOURCE_LINE=SUPERVISOR|177| if expiry_status in ("", "NO_COOKIE_JAR", "NO_PERSISTENT_COOKIE", "ERROR"): +DETAIL=SOURCE_LINE=SUPERVISOR|178| problems.append("cookie_expiry_missing") +DETAIL=SOURCE_LINE=SUPERVISOR|180| problems.append("cookie_expiry_expired") +DETAIL=SOURCE_LINE=SUPERVISOR|181| elif expiry_status == "WARN" or (expires_in is not None and expires_in < COOKIE_EXPIRY_WARN_SECONDS): +DETAIL=SOURCE_LINE=SUPERVISOR|182| problems.append("cookie_expiry_warn") +DETAIL=SOURCE_LINE=SUPERVISOR|202| for k in ["monitor_py", "config_ini", "secrets_env", "cookies_jar", "operational_digest_py", "event_selftest_runner_py", "event_selftest_core", "weekly_summary_health", "age_alert_health", "event_selftest_health", "py_compile"]: +DETAIL=SOURCE_LINE=SUPERVISOR|206| facts["cookies_jar_bytes_file"] = files.get("cookies_jar_bytes", "0") +DETAIL=COOKIE_TARGET_CANDIDATE=/var/lib/skladchik-reports-monitor/cookies.jar|STATE=ABSENT +DETAIL=JOURNAL_MARKER_AUTH_COUNT=20 +DETAIL=JOURNAL_MARKER_COOKIE_COUNT=0 +DETAIL=JOURNAL_MARKER_LOGIN_COUNT=0 +DETAIL=JOURNAL_MARKER_HTTP_401_COUNT=0 +DETAIL=JOURNAL_MARKER_HTTP_403_COUNT=0 +DETAIL=JOURNAL_MARKER_CAPTCHA_COUNT=0 +DETAIL=JOURNAL_MARKER_FAILED_COUNT=40 +DETAIL=JOURNAL_MARKER_ERROR_COUNT=0 +DETAIL=COOKIE_FORMAT_MARKERS=NONE +DETAIL=SKLADCHIK_COOKIE_SAFE_CONTRACT_AUDIT=PASS +CHANGES_MADE=NO OUTPUT_END CHAT_OUTPUT_END