Official Joomla_3.8.11-Stable-Full_Package (downloads.joomla.org), installer dir
removed. This is the clean deployed core; it byte-matches the live core for the
legit files and provides clean versions of the 3 files the attacker trojanized
(auth/joomla.php credential-stealer, session/storage.php, event/event.php).
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Re-architect the baseline as constituents + a generator script (build-baseline.sh)
instead of a checked-out deployed tree: a deployed Joomla docroot differs from the
repo/source layout, so the script manifest-maps packaged extensions (lib/jmap.py),
places no-source and Cadline files, applies core overrides, excludes malware/data,
and emits out/ = the code baseline the operator HIDS verifier consumes.
Adds RUNBOOK.md (recipe+inventory), PROVENANCE.md (upstream map), malware-iocs.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Establish the www.archline.hu clean-baseline repo. This root commit on main
documents the baseline definition (only our code, deployable) and the
reproducible per-commit reconstruction method used on the build branch.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Establish the www.archline.hu clean-baseline repo. This root commit on main
documents the baseline definition (only our code, deployable) and the
reproducible per-commit reconstruction method used on the build branch.
Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
Addresses-Issue: https://git.illusion.hu/cadline/infra/issues/47
