LÁZÁR Imre AI Agent
32cb5b765b
Re-architect the baseline as constituents + a generator script (build-baseline.sh) instead of a checked-out deployed tree: a deployed Joomla docroot differs from the repo/source layout, so the script manifest-maps packaged extensions (lib/jmap.py), places no-source and Cadline files, applies core overrides, excludes malware/data, and emits out/ = the code baseline the operator HIDS verifier consumes. Adds RUNBOOK.md (recipe+inventory), PROVENANCE.md (upstream map), malware-iocs. Signed-off-by: LÁZÁR Imre <imre@illusion.hu> Assisted-by: claude-code@claude-opus-4-8
45 lines
2.2 KiB
Markdown
45 lines
2.2 KiB
Markdown
# www.archline.hu — clean baseline (constituents + generator)
|
|
|
|
This repo produces the **clean code baseline** of the www.archline.hu docroot
|
|
(Cadline, Joomla 3.8.11, host `tanis.cadline.hu`) — the post-compromise, malware-free,
|
|
faithful reproduction of the live server's source files. The baseline is the **input**
|
|
to the `illusion/hids` verifier (imrcli per-vhost `vanilla_ref`); the verification
|
|
itself lives there, not here.
|
|
|
|
## Model: constituents + a generator script (not a checked-out tree)
|
|
|
|
A deployed Joomla docroot differs from any repo/source layout: extensions install their
|
|
files across many docroot paths (`administrator/…`, `components/…`, `media/…`,
|
|
`plugins/…`) via their manifest. So this repo stores the baseline **constituents** and a
|
|
script **assembles** the deployed baseline:
|
|
|
|
```
|
|
./build-baseline.sh # → out/ = the deployed CODE docroot (the baseline)
|
|
```
|
|
|
|
- `core/` — Joomla 3.8.11 official package (deployed form).
|
|
- `packages/<slug>/` — upstream-obtainable extensions; the pristine package is
|
|
manifest-mapped to deployed paths by `lib/jmap.py`, then our legit delta
|
|
(`cadline.patch`) is applied — so git history shows exactly how we differ from upstream.
|
|
- `deployed/<slug>/` — no-source extensions: vetted live files, placed directly.
|
|
- `cadline/<slug>/` — Cadline own-code (+ submodules for the deployed-layout Cadline repos).
|
|
- `overrides/` — Cadline core modifications as patches on vanilla.
|
|
- Malware (`malware-iocs.md`) and runtime data are excluded; the result is code only.
|
|
|
|
See [`RUNBOOK.md`](RUNBOOK.md) for the build recipe and module inventory,
|
|
[`PROVENANCE.md`](PROVENANCE.md) for per-extension origins, and
|
|
[`malware-iocs.md`](malware-iocs.md) for the excluded IOC set.
|
|
|
|
## Authority
|
|
|
|
The live docroot (RO mirror) is the source of truth — the goal is its faithful,
|
|
malware-free reproduction. The earlier single-commit "monolith" baseline is an
|
|
unvalidated helper only (it dropped extension manifests and clean core files and kept
|
|
installer junk); it is not a target.
|
|
|
|
## References
|
|
|
|
- Audit + baseline method: `cadline/infra` — `docs/audit/archline-hu-2026/`
|
|
- Per-vhost baseline tracking: cadline/infra#47 · Incident: cadline/infra#17
|
|
- Verifier (consumer): `illusion/hids` (imrcli)
|