LÁZÁR Imre AI Agent
e17c6268c5
This repo lives on the customer Gitea (git.cadline.hu); drop references to the operator's internal Gitea repos (audit/incident tracker, HIDS verifier) and describe those generically instead. Signed-off-by: LÁZÁR Imre <imre@illusion.hu> Assisted-by: claude-code@claude-opus-4-8
90 lines
5.2 KiB
Markdown
90 lines
5.2 KiB
Markdown
# RUNBOOK — building the www.archline.hu baseline
|
|
|
|
This repo stores the **constituents** of the clean code baseline, not the deployed
|
|
tree. [`build-baseline.sh`](build-baseline.sh) deterministically "deploys" them into
|
|
`out/` — the code docroot that the operator's HIDS baseline-diff verifier compares the
|
|
live server against. The deployed layout differs from the repo layout, so the build maps
|
|
each constituent to its Joomla-installed location.
|
|
|
|
## Goal
|
|
|
|
Reproduce the live www.archline.hu **source files as faithfully as possible, minus
|
|
malware**. Authority = the live docroot (RO mirror); the previous single-commit
|
|
"monolith" baseline is an unvalidated helper only (it dropped manifests and clean
|
|
core files, kept junk — not a target).
|
|
|
|
## Directory contract
|
|
|
|
| Dir | Holds | build-baseline.sh step |
|
|
|---|---|---|
|
|
| `core/` | Joomla 3.8.11 official full package (deployed form, installer removed) | 1 — rsync minus demo/data |
|
|
| `packages/<slug>/pristine/` | extracted upstream package (with manifest) | 2 — `lib/jmap.py` manifest-map |
|
|
| `packages/<slug>/cadline.patch` | our legit delta on that module (optional) | 2 — `patch -p1` after map |
|
|
| `deployed/<slug>/` | no-source extension, vetted deployed files (deployed layout) | 3 — direct rsync |
|
|
| `cadline/<slug>/` | Cadline own-code (deployed layout) | 4 — direct rsync |
|
|
| `overrides/*.patch` | Cadline core modifications (vs vanilla) | 5 — `patch -p1` |
|
|
| `malware-iocs.paths` | IOC exclusion safety net | 6 |
|
|
|
|
Modified module → **two git commits**: pristine (`packages/<slug>/pristine/`) then the
|
|
delta (`cadline.patch`), so `git diff` documents exactly our change vs upstream.
|
|
|
|
## Build & verify
|
|
|
|
```
|
|
./build-baseline.sh # → out/ (the deployed code baseline)
|
|
```
|
|
|
|
Verification (residual→0, malware/data buckets) lives in the operator's HIDS verifier,
|
|
which consumes `out/` as the per-vhost known-good reference. This repo only produces the input.
|
|
|
|
**Current build result (verified against the live RO mirror):** `out/` = 23,578 clean
|
|
code files. Byte-matches live for all legit code; differs only on the 4 known-infected
|
|
files where the baseline is intentionally clean (3 trojanized core files + the
|
|
`shaper_helix3/index.php` cloaking). **Non-malware code residual = 0** — every live code
|
|
file is either in the baseline or is excluded malware / scan artifact. 5 benign extra
|
|
files (clean core the package carries but live dropped). `public/` (~219k files) and
|
|
other runtime data are excluded as data, not code.
|
|
|
|
## Module inventory (categorization)
|
|
|
|
### core
|
|
- Joomla 3.8.11 — official full package. Clean; live's 3 injected core files (see
|
|
`malware-iocs.md`) are restored by using the package version.
|
|
|
|
### packages/ — upstream package obtainable (manifest-mapped; provenance + delta)
|
|
- `oneallsociallogin` — OneAll 5.5.0, github.com/oneall/social-login-joomla @5.5.0; **modified** (CRM) → cadline.patch
|
|
- `remoteimage` — asikart/remoteimage @2.0.10 (stock)
|
|
- `phocacommander` — PhocaCz/PhocaCommander @3.0.2 (stock)
|
|
- `phocadownload` — PhocaCz/PhocaDownload @3.1.2; **modified** (10 files) → cadline.patch
|
|
- `easyfileuploader` — ollily/easyfileuploader; **modified** (3 files) → cadline.patch
|
|
- *(K2, JoomGallery, Windwalker: git repos exist but no version-matching package →
|
|
currently `deployed/`; promote to `packages/` if a 2.8.0/3.3.4 package is obtained.)*
|
|
|
|
### deployed/ — no obtainable package (vetted live files)
|
|
K2, JoomGallery, Windwalker; sh404SEF, JCK Editor, SP Page Builder, iCagenda, Akeeba
|
|
Backup, Convert Forms (+NR Framework), Regular Labs (Sourcerer/AMM/Modals/lib),
|
|
AcyMailing, MightySites, JSN/JoomlaShine, Jumi, TF Learn, Smart Countdown, Smart
|
|
Shoutbox, Slideshow CK, Social Login&Share, SP Easy Image Gallery, IceMegaMenu, Image
|
|
Swoop, Helix3 (clean index.php), and the repo-less modules/plugins/libs/templates
|
|
(bt_googlemaps, os_touchslider, jflickr, *_timeline, ut_joomstagram, xpertscroller,
|
|
anycode, flippingbook, joombig, youtuber, jw_allvideos/sig, socialnetworks, fancybox,
|
|
mootable, EUCookie, extblank, tmlazyload, p3p, xef, _theme3037, trada, …).
|
|
JCK: **modified** (menunodes.php CVE-2018-17254 mitigation) — no upstream, documented
|
|
in PROVENANCE.md.
|
|
|
|
### cadline/ — Cadline own-code
|
|
com_showroom, com_albanner, com_alworkshops, com_followedlinks, com_nonprofit,
|
|
com_presentation, com_project, com_tcexam, com_versions; mod_al_*, mod_alusers,
|
|
mod_alworkshops, mod_course_list, mod_webinar*, mod_wsregister; plg content/workshopdates;
|
|
templates blankframe, category; docroot apps (beiratkozas, iskolak, phpext) + root PHPs
|
|
(crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php, sbtrack.php,
|
|
recaptchalib.php, configuration.php). `common_cadline_libraries` and `maintenance/` come
|
|
from the Cadline-internal repos cadcommonlib / maintenance (see PROVENANCE.md) but are
|
|
kept as **vetted live files for byte-fidelity** (could be converted to git submodules
|
|
later — that would not change the byte-baseline). `public/` is **excluded — user data**
|
|
(~219k images/project files), not code.
|
|
|
|
### overrides/ — Cadline core modifications (23 files)
|
|
com_content / com_users (registration/login/reset/remind), mod_login, captcha/recaptcha,
|
|
language ini, phpversioncheck — the ~26 legit customizations (§16.1), as patches on vanilla.
|