cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: remove operator-internal (git.illusion.hu) references

Browse Source 
This repo lives on the customer Gitea (git.cadline.hu); drop references to the
operator's internal Gitea repos (audit/incident tracker, HIDS verifier) and
describe those generically instead.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
This commit is contained in:
LÁZÁR Imre AI Agent 2026-07-16 12:14:05 +02:00
parent 00f856ccbb
commit e17c6268c5
4 changed files with 11 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@ -3,8 +3,8 @@
This repo produces the **clean code baseline** of the www.archline.hu docroot This repo produces the **clean code baseline** of the www.archline.hu docroot
(Cadline, Joomla 3.8.11, host `tanis.cadline.hu`) — the post-compromise, malware-free, (Cadline, Joomla 3.8.11, host `tanis.cadline.hu`) — the post-compromise, malware-free,
faithful reproduction of the live server's source files. The baseline is the **input** faithful reproduction of the live server's source files. The baseline is the **input**
to the `illusion/hids` verifier (imrcli per-vhost `vanilla_ref`); the verification to the operator's HIDS baseline-diff verifier (per-vhost known-good reference); the
itself lives there, not here. verification itself runs there, not here.
## Model: constituents + a generator script (not a checked-out tree) ## Model: constituents + a generator script (not a checked-out tree)
@ -39,6 +39,5 @@ installer junk); it is not a target.
## References ## References
- Audit + baseline method: `cadline/infra` — `docs/audit/archline-hu-2026/` - The archline.hu 2026 security audit and incident analysis (operator-held).
- Per-vhost baseline tracking: cadline/infra#47 · Incident: cadline/infra#17 - The baseline is consumed by the operator's per-vhost HIDS baseline-diff verifier.
- Verifier (consumer): `illusion/hids` (imrcli)

8
RUNBOOK.md
View File

@ -2,8 +2,8 @@
This repo stores the **constituents** of the clean code baseline, not the deployed This repo stores the **constituents** of the clean code baseline, not the deployed
tree. [`build-baseline.sh`](build-baseline.sh) deterministically "deploys" them into tree. [`build-baseline.sh`](build-baseline.sh) deterministically "deploys" them into
`out/` — the code docroot that `illusion/hids` (imrcli `vanilla_ref`) diffs the live `out/` — the code docroot that the operator's HIDS baseline-diff verifier compares the
server against. The deployed layout differs from the repo layout, so the build maps live server against. The deployed layout differs from the repo layout, so the build maps
each constituent to its Joomla-installed location. each constituent to its Joomla-installed location.
## Goal ## Goal
@ -34,8 +34,8 @@ delta (`cadline.patch`), so `git diff` documents exactly our change vs upstream.
./build-baseline.sh # → out/ (the deployed code baseline) ./build-baseline.sh # → out/ (the deployed code baseline)
``` ```
Verification (residual→0, malware/data buckets) lives in **`illusion/hids`** (imrcli), Verification (residual→0, malware/data buckets) lives in the operator's HIDS verifier,
which consumes `out/` as the per-vhost `vanilla_ref`. This repo only produces the input. which consumes `out/` as the per-vhost known-good reference. This repo only produces the input.
**Current build result (verified against the live RO mirror):** `out/` = 23,578 clean **Current build result (verified against the live RO mirror):** `out/` = 23,578 clean
code files. Byte-matches live for all legit code; differs only on the 4 known-infected code files. Byte-matches live for all legit code; differs only on the 4 known-infected

4
build-baseline.sh
View File

@ -2,8 +2,8 @@
# #
# build-baseline.sh — reproducibly assemble the www.archline.hu clean CODE baseline. # build-baseline.sh — reproducibly assemble the www.archline.hu clean CODE baseline.
# #
# Output (out/) = the deployed docroot (code only), which the illusion/hids # Output (out/) = the deployed docroot (code only), which the operator's HIDS
# baseline-diff (imrcli vanilla_ref) verifies the live server against. # baseline-diff verifies the live server against.
# #
# The repo stores the baseline CONSTITUENTS, not the deployed tree; this script # The repo stores the baseline CONSTITUENTS, not the deployed tree; this script
# performs the deterministic "deployment" (Joomla manifest-mapping for packaged # performs the deterministic "deployment" (Joomla manifest-mapping for packaged

2
malware-iocs.md
View File

@ -1,6 +1,6 @@
# Malware / planted IOC set — www.archline.hu # Malware / planted IOC set — www.archline.hu
Authoritative source: `cadline/infra` incidens-doksi (#17), §7/13/14/16 (human-tracked). Authoritative source: the archline.hu incident analysis (operator-held), §7/13/14/16.
These items are **excluded from the baseline** so the HIDS baseline-diff flags them These items are **excluded from the baseline** so the HIDS baseline-diff flags them
on the live server. Machine-readable path list: [`malware-iocs.paths`](malware-iocs.paths). on the live server. Machine-readable path list: [`malware-iocs.paths`](malware-iocs.paths).