cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1a88d1921a
www_archline_hu/RUNBOOK.md
LÁZÁR Imre AI Agent 32cb5b765b build(baseline): constituents+generator skeleton 
Re-architect the baseline as constituents + a generator script (build-baseline.sh)
instead of a checked-out deployed tree: a deployed Joomla docroot differs from the
repo/source layout, so the script manifest-maps packaged extensions (lib/jmap.py),
places no-source and Cadline files, applies core overrides, excludes malware/data,
and emits out/ = the code baseline the operator HIDS verifier consumes.

Adds RUNBOOK.md (recipe+inventory), PROVENANCE.md (upstream map), malware-iocs.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 09:40:46 +02:00

4.4 KiB
Raw Blame History

RUNBOOK — building the www.archline.hu baseline

This repo stores the constituents of the clean code baseline, not the deployed tree. build-baseline.sh deterministically "deploys" them into out/ — the code docroot that illusion/hids (imrcli vanilla_ref) diffs the live server against. The deployed layout differs from the repo layout, so the build maps each constituent to its Joomla-installed location.

Goal

Reproduce the live www.archline.hu source files as faithfully as possible, minus malware. Authority = the live docroot (RO mirror); the previous single-commit "monolith" baseline is an unvalidated helper only (it dropped manifests and clean core files, kept junk — not a target).

Directory contract

Dir Holds build-baseline.sh step
core/ Joomla 3.8.11 official full package (deployed form, installer removed) 1 — rsync minus demo/data
packages/<slug>/pristine/ extracted upstream package (with manifest) 2 — lib/jmap.py manifest-map
packages/<slug>/cadline.patch our legit delta on that module (optional) 2 — patch -p1 after map
deployed/<slug>/ no-source extension, vetted deployed files (deployed layout) 3 — direct rsync
cadline/<slug>/ Cadline own-code (deployed layout) 4 — direct rsync
overrides/*.patch Cadline core modifications (vs vanilla) 5 — patch -p1
malware-iocs.paths IOC exclusion safety net 6

Modified module → two git commits: pristine (packages/<slug>/pristine/) then the delta (cadline.patch), so git diff documents exactly our change vs upstream.

Build & verify

./build-baseline.sh            # → out/  (the deployed code baseline)

Verification (residual→0, malware/data buckets) lives in illusion/hids (imrcli), which consumes out/ as the per-vhost vanilla_ref. This repo only produces the input.

Module inventory (categorization)

core

  • Joomla 3.8.11 — official full package. Clean; live's 3 injected core files (see malware-iocs.md) are restored by using the package version.

packages/ — upstream package obtainable (manifest-mapped; provenance + delta)

  • oneallsociallogin — OneAll 5.5.0, github.com/oneall/social-login-joomla @5.5.0; modified (CRM) → cadline.patch
  • remoteimage — asikart/remoteimage @2.0.10 (stock)
  • phocacommander — PhocaCz/PhocaCommander @3.0.2 (stock)
  • phocadownload — PhocaCz/PhocaDownload @3.1.2; modified (10 files) → cadline.patch
  • easyfileuploader — ollily/easyfileuploader; modified (3 files) → cadline.patch
  • (K2, JoomGallery, Windwalker: git repos exist but no version-matching package → currently deployed/; promote to packages/ if a 2.8.0/3.3.4 package is obtained.)

deployed/ — no obtainable package (vetted live files)

K2, JoomGallery, Windwalker; sh404SEF, JCK Editor, SP Page Builder, iCagenda, Akeeba Backup, Convert Forms (+NR Framework), Regular Labs (Sourcerer/AMM/Modals/lib), AcyMailing, MightySites, JSN/JoomlaShine, Jumi, TF Learn, Smart Countdown, Smart Shoutbox, Slideshow CK, Social Login&Share, SP Easy Image Gallery, IceMegaMenu, Image Swoop, Helix3 (clean index.php), and the repo-less modules/plugins/libs/templates (bt_googlemaps, os_touchslider, jflickr, *_timeline, ut_joomstagram, xpertscroller, anycode, flippingbook, joombig, youtuber, jw_allvideos/sig, socialnetworks, fancybox, mootable, EUCookie, extblank, tmlazyload, p3p, xef, _theme3037, trada, …). JCK: modified (menunodes.php CVE-2018-17254 mitigation) — no upstream, documented in PROVENANCE.md.

cadline/ — Cadline own-code

com_showroom, com_albanner, com_alworkshops, com_followedlinks, com_nonprofit, com_presentation, com_project, com_tcexam, com_versions; mod_al_, mod_alusers, mod_alworkshops, mod_course_list, mod_webinar, mod_wsregister; plg content/workshopdates; templates blankframe, category; docroot apps (beiratkozas, iskolak, public, phpext); docroot PHPs (crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php, recaptchalib.php, configuration.php). Cadline-internal deployed-layout repos are git submodules: common_cadline_libraries → cadcommonlib, maintenance → maintenance.

overrides/ — Cadline core modifications (23 files)

com_content / com_users (registration/login/reset/remind), mod_login, captcha/recaptcha, language ini, phpversioncheck — the ~26 legit customizations (§16.1), as patches on vanilla.