From 4cc873883c21fd4c56f5e4924916ad517b9bd9f5 Mon Sep 17 00:00:00 2001 From: ochenstarik-ui Date: Fri, 7 Aug 2026 11:40:34 +0700 Subject: [PATCH 1/2] =?UTF-8?q?chore:=20repo=20hygiene=20=E2=80=94=20pin?= =?UTF-8?q?=20actions,=20dependabot,=20SBOM,=20docs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Pin all 23 GitHub Actions uses to 40-char commit SHA with tag comments: actions/checkout@v6 -> d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0) actions/setup-dotnet@v5 -> 26b0ec14cb23fa6904739307f278c14f94c95bf1 (v5.4.0) actions/upload-artifact@v6 -> b7c566a772e6b6bfb58ed0dc250532a479d7789f (v6.0.0) actions/download-artifact@v8 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1) softprops/action-gh-release@v2 -> 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2) SHAs verified via gh api repos///git/ref/tags/ - Move contents:write from workflow level to release steps only - Add dotnet CycloneDX SBOM generation to linux-release and windows-release - Add .github/dependabot.yml (github-actions + nuget, weekly, limit 5 PRs) - Add SECURITY.md with private advisory channel, 72h SLA, threat model - Add CHANGELOG.md from real git history (Keep a Changelog format) - Add CONTRIBUTING.md with build/test instructions and Linux test note - Add CODEOWNERS - Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md - Add .github/PULL_REQUEST_TEMPLATE.md with mandatory verification checklist --- .github/ISSUE_TEMPLATE/bug_report.md | 44 +++++++++ .github/ISSUE_TEMPLATE/feature_request.md | 25 ++++++ .github/PULL_REQUEST_TEMPLATE.md | 46 ++++++++++ .github/dependabot.yml | 17 ++++ .github/workflows/linux-control-agent.yml | 4 +- .github/workflows/linux-platform-matrix.yml | 14 +-- .github/workflows/linux-release.yml | 28 ++++-- .github/workflows/windows-build.yml | 6 +- .github/workflows/windows-release.yml | 18 ++-- CHANGELOG.md | 99 +++++++++++++++++++++ CODEOWNERS | 25 ++++++ CONTRIBUTING.md | 92 +++++++++++++++++++ SECURITY.md | 76 ++++++++++++++++ 13 files changed, 469 insertions(+), 25 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md create mode 100644 .github/PULL_REQUEST_TEMPLATE.md create mode 100644 .github/dependabot.yml create mode 100644 CHANGELOG.md create mode 100644 CODEOWNERS create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..459c116 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,44 @@ +--- +name: Bug report +about: Report a defect or unexpected behaviour +labels: bug +--- + +## Describe the bug + +A clear and concise description of what the bug is. + +## Steps to reproduce + +1. ... +2. ... +3. ... + +## Expected behaviour + +What you expected to happen. + +## Actual behaviour + +What actually happened. + +## Environment + +- **SMM version / commit**: +- **OS and version**: +- **Component**: + +## Logs or error output + +
+Relevant log output + +``` +paste logs here +``` + +
+ +## Additional context + +Any other context, screenshots, or related issues. diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md new file mode 100644 index 0000000..acbf381 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -0,0 +1,25 @@ +--- +name: Task / feature request +about: Propose a new feature or improvement +labels: enhancement +--- + +## Summary + +A clear and concise description of what you want to happen. + +## Motivation + +Why is this needed? What problem does it solve? + +## Proposed solution + +Describe the solution you have in mind. + +## Alternatives considered + +Any alternative solutions or features you have considered. + +## Additional context + +Any other context, mockups, or related issues. diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..ca7cd11 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,46 @@ +## Description + + + +## Related issue(s) + + + +## Type of change + +- [ ] Bug fix +- [ ] New feature / enhancement +- [ ] Documentation +- [ ] CI / tooling +- [ ] Security fix +- [ ] Refactor (no functional change) + +--- + +## Verification checklist + +> Fill in **all three sections**. Omitting a section or leaving placeholders +> will block review. Claiming something was verified when it was not is worse +> than marking it as not verified — the latter is acceptable, the former is not. + +### ✅ Verified locally + + + +### ✅ Verified in CI + + + +### ❌ Not verified / out of scope + + diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..76815eb --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,17 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + labels: + - dependencies + + - package-ecosystem: nuget + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + labels: + - dependencies diff --git a/.github/workflows/linux-control-agent.yml b/.github/workflows/linux-control-agent.yml index c157dde..2513b03 100644 --- a/.github/workflows/linux-control-agent.yml +++ b/.github/workflows/linux-control-agent.yml @@ -13,10 +13,10 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: 10.0.x diff --git a/.github/workflows/linux-platform-matrix.yml b/.github/workflows/linux-platform-matrix.yml index b018276..d9b02cb 100644 --- a/.github/workflows/linux-platform-matrix.yml +++ b/.github/workflows/linux-platform-matrix.yml @@ -36,10 +36,10 @@ jobs: runtime: [linux-x64, linux-arm64] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: 10.0.x @@ -68,7 +68,7 @@ jobs: sha256sum "$archive" >"$archive.sha256" - name: Upload release archive - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: server-monitor-manager-${{ matrix.runtime }}-matrix path: | @@ -97,10 +97,10 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Download release archive - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: server-monitor-manager-${{ matrix.runtime }}-matrix path: artifacts @@ -137,10 +137,10 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Download release archive - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: server-monitor-manager-${{ matrix.runtime }}-matrix path: artifacts diff --git a/.github/workflows/linux-release.yml b/.github/workflows/linux-release.yml index e8b263a..447952a 100644 --- a/.github/workflows/linux-release.yml +++ b/.github/workflows/linux-release.yml @@ -7,14 +7,14 @@ on: - 'v*' permissions: - contents: write + contents: read jobs: bootstrap: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Validate bootstrap run: | @@ -46,7 +46,7 @@ jobs: > server-monitor-manager-bootstrap-manifest.json - name: Upload bootstrap artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: server-monitor-manager-bootstrap path: | @@ -54,9 +54,14 @@ jobs: ochenstarik-server-monitor-manager.sh.sha256 server-monitor-manager-bootstrap-manifest.json + - name: Generate SBOM (bootstrap) + run: dotnet tool install --global CycloneDX && dotnet CycloneDX ServerMonitorManager.slnx -o sbom -j --filename server-monitor-manager-bootstrap-sbom || true + - name: Attach bootstrap to GitHub Release if: startsWith(github.ref, 'refs/tags/') - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 + permissions: + contents: write with: prerelease: ${{ contains(github.ref_name, '-') }} files: | @@ -71,10 +76,10 @@ jobs: runtime: [linux-x64, linux-arm64] steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: 10.0.x @@ -103,8 +108,13 @@ jobs: tar -C out -czf "$archive" agent control provisioning-helper deploy bootstrap sha256sum "$archive" > "$archive.sha256" + - name: Generate SBOM + run: | + dotnet tool install --global CycloneDX + dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename "server-monitor-manager-${{ matrix.runtime }}-sbom" || true + - name: Upload artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: server-monitor-manager-${{ matrix.runtime }} path: | @@ -113,7 +123,9 @@ jobs: - name: Attach to GitHub Release if: startsWith(github.ref, 'refs/tags/') - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 + permissions: + contents: write with: prerelease: ${{ contains(github.ref_name, '-') }} files: | diff --git a/.github/workflows/windows-build.yml b/.github/workflows/windows-build.yml index 83f117a..3ffb432 100644 --- a/.github/workflows/windows-build.yml +++ b/.github/workflows/windows-build.yml @@ -13,10 +13,10 @@ jobs: runs-on: windows-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: 10.0.x @@ -51,7 +51,7 @@ jobs: -Destination artifacts/windows-installer/ServerMonitorManager-test-signing.cer - name: Upload test installer - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: ServerMonitorManager-win-x64-test path: | diff --git a/.github/workflows/windows-release.yml b/.github/workflows/windows-release.yml index 5cfdeaa..38a4c0d 100644 --- a/.github/workflows/windows-release.yml +++ b/.github/workflows/windows-release.yml @@ -7,7 +7,7 @@ on: - 'v*' permissions: - contents: write + contents: read jobs: package: @@ -17,10 +17,10 @@ jobs: SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }} steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 - name: Set up .NET 10 - uses: actions/setup-dotnet@v5 + uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0 with: dotnet-version: 10.0.x @@ -64,8 +64,14 @@ jobs: $actual = (Get-FileHash artifacts/windows-installer/ServerMonitorManager-win-x64.msix -Algorithm SHA256).Hash.ToLowerInvariant() if ($actual -ne $expected) { throw 'Windows installer checksum mismatch.' } + - name: Generate SBOM + run: | + dotnet tool install --global CycloneDX + dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename server-monitor-manager-win-x64-sbom || true + shell: bash + - name: Upload installer artifact - uses: actions/upload-artifact@v6 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: name: ServerMonitorManager-win-x64 path: | @@ -76,7 +82,9 @@ jobs: - name: Attach installer to GitHub Release if: startsWith(github.ref, 'refs/tags/') - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 + permissions: + contents: write with: prerelease: ${{ contains(github.ref_name, '-') }} files: | diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..b8996c1 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,99 @@ +# Changelog + +All notable changes to Server Monitor Manager are documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). +Versions follow the tags in this repository. + +## [Unreleased] + +### Added +- Background link reconciliation service for the Control plane (#12) + +### Changed +- Link policy reconciliation now runs continuously (#11) + +### Fixed +- Closed security debts in the Desktop app and provisioning helper (#10) + +--- + +## [v0.1.0-alpha.6] — 2026-07-31 + +### Added +- Standalone Linux bootstrap foundation: one-command server installation + script (`deploy/ochenstarik-server-monitor-manager.sh`) (#5) +- Standalone Server Monitor Manager roadmap (`docs/roadmap.md`) (#5) +- Confirmed timezone provisioning executed safely (#6) +- Hardened enrollment and provisioning helper (#7) +- SSH trust pinning and session key protection (#8) + +### Changed +- MSIX version bumped to 1.0.0.6 (#9) + +--- + +## [v0.1.0-alpha.5] — 2026-07-17 + +### Added +- Signed Windows MSIX release pipeline +- Dedicated desktop management pages +- 100-node Hub load test +- Source-scoped automation identity +- Kill switch helper failure tests +- Export of redacted desktop diagnostics + +### Fixed +- Diagnostics JSON made trim-safe +- Disabled links enforced after reconnect +- MSIX publishing fixed on clean runners +- Windows workflow script indentation normalized + +--- + +## [v0.1.0-alpha.4] — 2026-07-17 + +### Added +- Certificate re-enrollment lifecycle + +--- + +## [v0.1.0-alpha.3] — 2026-07-16 + +### Added +- Apache 2.0 license +- Offline agent metrics buffering +- Project documentation in twelve languages + +--- + +## [v0.1.0-alpha.2] — 2026-07-16 + +### Changed +- Links migrated to SQLite control plane + +--- + +## [v0.1.0-alpha.1] — 2026-07-16 + +### Added +- Initial repository with persistent mTLS control layer +- Windows SSH monitoring MVP +- One-command server installation foundation +- Directed server mesh controls +- Server profile editing and deletion +- Restricted Link policy controls +- Confirmed applied Link state in Windows client +- Health warnings and automatic refresh +- Charted short metrics history +- Application icon assets +- Secure node enrollment documentation +- Windows build verification in CI + +[Unreleased]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.6...HEAD +[v0.1.0-alpha.6]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.5...v0.1.0-alpha.6 +[v0.1.0-alpha.5]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.4...v0.1.0-alpha.5 +[v0.1.0-alpha.4]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.3...v0.1.0-alpha.4 +[v0.1.0-alpha.3]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.2...v0.1.0-alpha.3 +[v0.1.0-alpha.2]: https://github.com/ochenstarik-ui/server-monitor-manager/compare/v0.1.0-alpha.1...v0.1.0-alpha.2 +[v0.1.0-alpha.1]: https://github.com/ochenstarik-ui/server-monitor-manager/releases/tag/v0.1.0-alpha.1 diff --git a/CODEOWNERS b/CODEOWNERS new file mode 100644 index 0000000..8f24a93 --- /dev/null +++ b/CODEOWNERS @@ -0,0 +1,25 @@ +# CODEOWNERS +# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners + +# Default owner for everything +* @ochenstarik + +# Workflow and CI configuration +.github/ @ochenstarik + +# Security-sensitive deployment and provisioning +deploy/ @ochenstarik +src/ServerMonitorManager.Provisioning.Helper/ @ochenstarik + +# Core server components +src/ServerMonitorManager.Agent/ @ochenstarik +src/ServerMonitorManager.Control/ @ochenstarik +src/ServerMonitorManager.Core/ @ochenstarik + +# Desktop client +src/ServerMonitorManager.Desktop/ @ochenstarik + +# Security policy and documentation +SECURITY.md @ochenstarik +docs/security-model.md @ochenstarik + diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..7bb8e75 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,92 @@ +# Contributing to Server Monitor Manager + +Thank you for your interest in contributing. This document describes how to +build the project, run tests, and submit changes. + +## Building + +### Prerequisites + +- [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet/10.0) +- A Linux host or WSL for server-side components (see [Testing](#testing)) +- `shellcheck` for shell script linting + +### Build + +```bash +dotnet build ServerMonitorManager.slnx --configuration Release +``` + +### Publish (Linux binaries) + +```bash +dotnet publish src/ServerMonitorManager.Agent/ServerMonitorManager.Agent.csproj \ + --configuration Release --runtime linux-x64 --self-contained true \ + -p:PublishSingleFile=true -p:PublishTrimmed=true -o out/agent + +dotnet publish src/ServerMonitorManager.Control/ServerMonitorManager.Control.csproj \ + --configuration Release --runtime linux-x64 --self-contained true \ + -p:PublishSingleFile=true -p:PublishTrimmed=true -o out/control +``` + +## Testing + +### Unit and integration tests + +```bash +dotnet test tests/ServerMonitorManager.Control.Tests/ServerMonitorManager.Control.Tests.csproj \ + --configuration Release +``` + +> **Important:** The Control test suite must be run on **Linux**. A subset of +> tests is gated with `[SupportedOSPlatform("linux")]` / `OperatingSystem.IsLinux()` +> and will be **silently skipped on Windows**. CI always runs these on Ubuntu; +> do not interpret a green local run on Windows as full test coverage. + +### Bootstrap contract tests + +```bash +bash tests/bootstrap/test-bootstrap-contract.sh +bash tests/bootstrap/test-enrollment-token-argv.sh +``` + +### Shell script linting + +```bash +shellcheck --severity=error deploy/ochenstarik-server-monitor-manager.sh +shellcheck --severity=error deploy/ochenstarik-smm-policy-apply +shellcheck --severity=error deploy/ochenstarik-smm-emergency +``` + +### Windows Desktop tests + +```powershell +./tests/windows/Test-DesktopContracts.ps1 +dotnet test tests/ServerMonitorManager.Desktop.Security.Tests/ServerMonitorManager.Desktop.Security.Tests.csproj --configuration Release +``` + +## Code Style + +Verify formatting before committing: + +```bash +dotnet format ServerMonitorManager.slnx --verify-no-changes +``` + +## Submitting Changes + +**One PR — one topic.** Do not bundle unrelated changes in a single pull +request. Small, focused PRs are reviewed faster and are easier to revert if +needed. + +1. Fork the repository and create a branch from `main`. +2. Make your changes, keeping the scope focused. +3. Run all relevant tests locally (see above). +4. Open a pull request using the PR template — fill in **all sections**, + including what was *not* tested and why. + +## What Not to Change + +See [`TASK.md`](TASK.md) and inline comments in the codebase for files that +are currently locked by parallel work streams. When in doubt, ask in the issue +or PR before making changes to files in `src/`, `deploy/`, or `tests/`. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..434a4a1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,76 @@ +# Security Policy + +## Supported Versions + +Server Monitor Manager is currently in alpha. Only the latest pre-release is +supported with security fixes: + +| Version | Supported | +|---|---| +| latest alpha (v0.1.0-alpha.6) | ✅ | +| earlier alphas | ❌ | + +## Reporting a Vulnerability + +**Do not open a public GitHub issue for security vulnerabilities.** + +Report vulnerabilities privately via GitHub's built-in mechanism: +[Security → Report a vulnerability](https://github.com/ochenstarik-ui/server-monitor-manager/security/advisories/new) + +This opens a private advisory draft visible only to repository maintainers. + +### What to include + +- A description of the vulnerability and its potential impact. +- Steps to reproduce or a proof-of-concept (even a minimal one). +- The version or commit you tested against. +- Your GitHub handle or email if you want to be credited. + +### Response timeline + +| Milestone | Target | +|---|---| +| Initial acknowledgement | Within **72 hours** of receipt | +| Triage and severity assessment | Within **7 days** | +| Patch or mitigation plan | Communicated within **14 days** | +| Public disclosure | Coordinated with the reporter | + +## Threat Model and Scope + +Server Monitor Manager installs binaries that run as **root** on servers and +manages firewall rules. The following are considered **in-scope +vulnerabilities**: + +- **Role separation bypass** — an Agent being able to perform Control + operations or vice versa without explicit provisioning. +- **Unauthorized root execution** — obtaining root-level code execution + outside of the typed provisioning flow (`install-control`, + `install-agent`). +- **Private key or enrollment token leakage** — exposure of mTLS private + keys, CA keys, or enrollment tokens to unprivileged processes or logs. +- **Kill switch bypass** — circumventing the emergency kill switch + (`ochenstarik-smm-emergency`) or the disabled-link enforcement. +- **Supply chain / artifact substitution** — an attacker substituting + release artifacts or bootstrap scripts to deliver malicious binaries. + +## Known Limitations (Not Vulnerabilities) + +The following are **documented alpha limitations** and will not be treated as +security vulnerabilities until addressed in the roadmap: + +- **Release manifest is not cryptographically signed.** The bootstrap manifest + (`server-monitor-manager-bootstrap-manifest.json`) includes a SHA-256 + checksum but the manifest itself carries no signature. Tracked in + [`docs/roadmap.md`](docs/roadmap.md). +- **Windows MSIX is not trusted-signed.** The Windows installer is signed with + a test or self-signed certificate in CI. Trust requires a commercial code + signing certificate. Tracked in [`docs/roadmap.md`](docs/roadmap.md). + +Both items are openly acknowledged limitations of the alpha stage. Reports +about these specific issues will be noted but not assigned a CVE or priority +fix until the roadmap items are scheduled. + +## Security Model Reference + +For a complete description of the trust boundaries, role separation, and +threat model see [`docs/security-model.md`](docs/security-model.md). From 2745ee55a56f449e11d6d07c2588c9dc282f9062 Mon Sep 17 00:00:00 2001 From: ochenstarik-ui Date: Fri, 7 Aug 2026 12:03:50 +0700 Subject: [PATCH 2/2] fix: move permissions to job level, fix SBOM attachment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - permissions: contents: write moved from step to job level in linux-release.yml (both 'bootstrap' and 'publish' jobs) and windows-release.yml ('package' job); step-level permissions key is not valid in GitHub Actions schema - Remove redundant SBOM generation from 'bootstrap' job (no .NET setup there; 'publish' job already covers the full solution) - Remove '|| true' from SBOM steps — failures are now visible - Add SBOM JSON to upload-artifact path and release files in linux-release.yml (publish job) and windows-release.yml Verified with actionlint 1.7.7 — 0 errors on all 5 workflow files --- .github/workflows/linux-release.yml | 15 +++++++-------- .github/workflows/windows-release.yml | 10 ++++++---- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/.github/workflows/linux-release.yml b/.github/workflows/linux-release.yml index 447952a..7168931 100644 --- a/.github/workflows/linux-release.yml +++ b/.github/workflows/linux-release.yml @@ -12,6 +12,8 @@ permissions: jobs: bootstrap: runs-on: ubuntu-latest + permissions: + contents: write steps: - name: Checkout uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 @@ -54,14 +56,9 @@ jobs: ochenstarik-server-monitor-manager.sh.sha256 server-monitor-manager-bootstrap-manifest.json - - name: Generate SBOM (bootstrap) - run: dotnet tool install --global CycloneDX && dotnet CycloneDX ServerMonitorManager.slnx -o sbom -j --filename server-monitor-manager-bootstrap-sbom || true - - name: Attach bootstrap to GitHub Release if: startsWith(github.ref, 'refs/tags/') uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 - permissions: - contents: write with: prerelease: ${{ contains(github.ref_name, '-') }} files: | @@ -71,6 +68,8 @@ jobs: publish: runs-on: ubuntu-latest + permissions: + contents: write strategy: matrix: runtime: [linux-x64, linux-arm64] @@ -111,7 +110,7 @@ jobs: - name: Generate SBOM run: | dotnet tool install --global CycloneDX - dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename "server-monitor-manager-${{ matrix.runtime }}-sbom" || true + dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename "server-monitor-manager-${{ matrix.runtime }}-sbom" - name: Upload artifact uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 @@ -120,14 +119,14 @@ jobs: path: | server-monitor-manager-${{ matrix.runtime }}.tar.gz server-monitor-manager-${{ matrix.runtime }}.tar.gz.sha256 + server-monitor-manager-${{ matrix.runtime }}-sbom.json - name: Attach to GitHub Release if: startsWith(github.ref, 'refs/tags/') uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 - permissions: - contents: write with: prerelease: ${{ contains(github.ref_name, '-') }} files: | server-monitor-manager-${{ matrix.runtime }}.tar.gz server-monitor-manager-${{ matrix.runtime }}.tar.gz.sha256 + server-monitor-manager-${{ matrix.runtime }}-sbom.json diff --git a/.github/workflows/windows-release.yml b/.github/workflows/windows-release.yml index 38a4c0d..54b5e6c 100644 --- a/.github/workflows/windows-release.yml +++ b/.github/workflows/windows-release.yml @@ -12,6 +12,8 @@ permissions: jobs: package: runs-on: windows-latest + permissions: + contents: write env: SIGNING_CERTIFICATE_BASE64: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_BASE64 }} SIGNING_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PASSWORD }} @@ -65,10 +67,10 @@ jobs: if ($actual -ne $expected) { throw 'Windows installer checksum mismatch.' } - name: Generate SBOM + shell: bash run: | dotnet tool install --global CycloneDX - dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename server-monitor-manager-win-x64-sbom || true - shell: bash + dotnet CycloneDX ServerMonitorManager.slnx -o . -j --filename server-monitor-manager-win-x64-sbom - name: Upload installer artifact uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 @@ -78,16 +80,16 @@ jobs: artifacts/windows-installer/ServerMonitorManager-win-x64.msix artifacts/windows-installer/ServerMonitorManager-test-signing.cer artifacts/windows-installer/SHA256SUMS + server-monitor-manager-win-x64-sbom.json if-no-files-found: error - name: Attach installer to GitHub Release if: startsWith(github.ref, 'refs/tags/') uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 - permissions: - contents: write with: prerelease: ${{ contains(github.ref_name, '-') }} files: | artifacts/windows-installer/ServerMonitorManager-win-x64.msix artifacts/windows-installer/ServerMonitorManager-test-signing.cer artifacts/windows-installer/SHA256SUMS + server-monitor-manager-win-x64-sbom.json