auditea 0.1.0.beta.5 → 0.1.0.beta.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ed0a68e5bfed09c0f764146e65c9b995d11c7070224a19fc6e682367626d0d1
-  data.tar.gz: cfdc642f25cab8125b3c8479b9aacbbaa13613650fa12a9b8160e21d92c2881f
+  metadata.gz: a53fe361e4064b6efcdc0102f09a27a356f76d116b88b531774e93e1ffaafeb6
+  data.tar.gz: be811c131585c9ba97cdf4cef22c57309d293af0709b1b65ef756a44602d50e3
 SHA512:
-  metadata.gz: 35cd56bc10b1010767e8078d5719639e12a056bc13aacd9472d1cda46d9679ddefba7519988af49faa26f7efd8ee664bdb1fe3f78eb27655b74c391a556406b6
-  data.tar.gz: 7911d88e0322ceba880eaeb09f0825d74079107612022aa60fbfff1e6e974a43a44b31d386ee304a5ff1d855d17ea1ca657198c4c3637eb7db6700ac2cb03dd6
+  metadata.gz: 270fabedbb574108c32286ae01149d38e23ad17c3e28fd65abaf924d77f9244172807225e0e0c013a59551514ff82372ec1134ef75ad02b16c605cd87198e3dd
+  data.tar.gz: e42afa22d152260e21f3826075b2b2b1a07a0bedf78541bc320020b439dc23cb601f853e790606f847c124879c9331e1a59ef97e17593a387294cb2d10cc7bce

data/CHANGELOG.md

@@ -1,6 +1,14 @@
 # Changelog
 
-## 0.1.0.beta.5 (unreleased)
+## 0.1.0.beta.6 (unreleased)
+
+### Windows host inventory (additive)
+
+- Conservative Windows OS edition detection for host inventory posture (`WindowsOs` consumers on the server)
+- Conservative read-only Windows Apache service discovery (`AUD-SDK-APACHE-SERVICE01`) — service-name observation only; never claims Apache is absent when not observed
+- Windows smoke helpers under `examples/` for controlled field validation (IRCM native smoke deferred to a separate scheduled run)
+
+## 0.1.0.beta.5
 
 ### SDK readiness diagnostic
 

data/README.md

@@ -2,7 +2,7 @@
 
 Ruby / Rails SDK for [AudiTea](https://github.com/reznis/AudiTea) event collection.
 
-Version: **0.1.0.beta.5** (proposed, not yet published)
+Version: **0.1.0.beta.6** (published)
 
 Captures durable technical and business evidence. AudiTea **server** owns taxonomy, dictionary, human labels, vulnerability matching, correlation, and reinterpretation.
 
@@ -12,7 +12,7 @@ The SDK does **not** perform vulnerability scanning, OS package/CVE inventory, d
 
 ```ruby
 # Gemfile
-gem "auditea", "0.1.0.beta.5"
+gem "auditea", "0.1.0.beta.6"
 ```
 
 ```bash

data/RELEASE.md

@@ -1,4 +1,4 @@
-# Release: auditea 0.1.0.beta.5
+# Release: auditea 0.1.0.beta.6
 
 Authoritative runbook for controlled beta publication of the Ruby SDK.
 
@@ -169,10 +169,10 @@ PR status may say `READY FOR HUMAN PUBLICATION REVIEW` while still listing exter
 ```bash
 git checkout main
 git pull
-# confirm VERSION and CHANGELOG still say 0.1.0.beta.5
+# confirm VERSION and CHANGELOG still say 0.1.0.beta.6
 gem build auditea.gemspec
 # inspect package once more
-gem push auditea-0.1.0.beta.5.gem
+gem push auditea-0.1.0.beta.6.gem
 ```
 
 Then mark CHANGELOG released with the publication date in a follow-up commit.
@@ -182,9 +182,9 @@ Then mark CHANGELOG released with the publication date in a follow-up commit.
 ## Post-publication verification
 
 ```bash
-gem install auditea -v 0.1.0.beta.5 --pre
+gem install auditea -v 0.1.0.beta.6 --pre
 ruby -rauditea -e 'puts Auditea::VERSION'
-# expect: 0.1.0.beta.5
+# expect: 0.1.0.beta.6
 ```
 
 Prefer installing the RubyGems artifact (not a git branch) into the controlled TEST app.

data/lib/auditea/host_inventory/windows_components.rb

@@ -2,6 +2,7 @@
 
 require "timeout"
 require_relative "../inventory/components"
+require_relative "windows_services"
 
 module Auditea
   module HostInventory
@@ -97,7 +98,17 @@ module Auditea
             )
           end
         end
-        seen.values
+
+        components = seen.values
+        # Service discovery is a fallback for products the uninstall registry
+        # misses (manually unpacked ZIP, service-only install). When uninstall
+        # already proves an Apache HTTP Server installation (with a version), do
+        # not add a version-less service observation for the same installation.
+        unless components.any? { |c| c["product"] == "Apache HTTP Server" }
+          components += WindowsServices.collect(deadline: deadline)
+        end
+
+        components
       end
 
       def parse_uninstall(output)

data/lib/auditea/host_inventory/windows_services.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require_relative "windows_components"
+
+module Auditea
+  module HostInventory
+    # Conservative read-only Windows service discovery. Proves Apache HTTP
+    # Server identity from trusted service metadata WITHOUT executing the
+    # binary, trusting caller paths, or inferring a version from a directory
+    # name. A proven-but-unversioned service is reported with version nil so
+    # the server can show "Not reported" rather than hiding a known install.
+    #
+    # Reads only HKLM\SYSTEM\CurrentControlSet\Services (a single, non-WOW64-
+    # redirected view). Reuses WindowsComponents.run_reg so the read remains
+    # bounded, timeout-protected, fail-open, and read-only.
+    module WindowsServices
+      SERVICES_KEY = 'HKLM\SYSTEM\CurrentControlSet\Services'
+      # Explicit generic Windows software channel (same as uninstall detection).
+      WINDOWS_PACKAGE = { "ecosystem" => "windows" }.freeze
+
+      module_function
+
+      # Single deterministic read-only services query.
+      def service_queries
+        [["query", SERVICES_KEY, "/s"]]
+      end
+
+      def collect(deadline:)
+        components = []
+        apache_emitted = false
+
+        service_queries.each do |argv|
+          remaining = deadline - WindowsComponents.monotonic_now
+          break if remaining <= 0
+
+          output = WindowsComponents.run_reg(
+            argv,
+            timeout: [WindowsComponents::PER_COMMAND_TIMEOUT_SECONDS, remaining].min
+          )
+          next if output.nil?
+
+          parse_services(output).each do |(display_name, image_path)|
+            next unless apache_http_server_service?(display_name, image_path)
+            next if apache_emitted
+
+            apache_emitted = true
+            components << Inventory::Components.build_without_version(
+              product: "Apache HTTP Server",
+              scope: "reverse_proxy",
+              observation_method: "windows.service_registry",
+              package: WINDOWS_PACKAGE,
+              evidence: { "command" => "reg.exe" }
+            )
+          end
+        end
+
+        components
+      end
+
+      # Parses `reg query ...\Services /s` output into [display_name, image_path]
+      # pairs, one per service subkey. Ignores values we do not need; never
+      # returns raw output or paths as evidence.
+      def parse_services(output)
+        services = []
+        display_name = nil
+        image_path = nil
+        output.to_s.each_line do |line|
+          stripped = line.strip
+          if stripped.start_with?("HKEY_")
+            services << [display_name, image_path] if display_name || image_path
+            display_name = nil
+            image_path = nil
+            next
+          end
+
+          if (match = stripped.match(/\ADisplayName\s+REG_\S+\s+(.+)\z/i))
+            display_name = match[1].to_s.strip
+          elsif (match = stripped.match(/\AImagePath\s+REG_\S+\s+(.+)\z/i))
+            image_path = match[1].to_s.strip
+          end
+        end
+        services << [display_name, image_path] if display_name || image_path
+        services
+      end
+
+      # Proves Apache HTTP Server identity from trusted service metadata. An
+      # `httpd.exe` ImagePath is the unambiguous Apache HTTP Server binary;
+      # a conservative DisplayName match covers the common "Apache2.4" /
+      # "Apache HTTP Server" names while rejecting unrelated Apache projects
+      # (Tomcat, Cassandra, DS, ...).
+      def apache_http_server_service?(display_name, image_path)
+        path = image_path.to_s.strip
+        return true if path.match?(%r{(?:\A|[\\/])httpd\.exe(?:["'\s]|\z)}i)
+
+        name = display_name.to_s.strip
+        return false if name.empty?
+        return false if name.match?(/\btomcat\b/i)
+
+        name.match?(/\Aapache(?:\s+http\s+server(?:\s+\d+(?:\.\d+)*)?|\s*\d+(?:\.\d+)*)?\s*\z/i)
+      end
+    end
+  end
+end

data/lib/auditea/inventory/components.rb

@@ -41,6 +41,26 @@ module Auditea
         entry
       end
 
+      # A component whose identity is proven but whose version is not available
+      # (e.g. an Apache HTTP Server proven as a Windows service, where no
+      # authoritative version metadata exists). Emits the component WITHOUT a
+      # `version` key so the server can truthfully render "Not reported" rather
+      # than inventing or silently dropping the known installed product.
+      def build_without_version(product:, scope:, observation_method:, package: nil, evidence: nil)
+        return nil unless SCOPES.include?(scope.to_s)
+        return nil if blank?(product)
+
+        entry = {
+          "product" => truncate(product, MAX_PRODUCT),
+          "scope" => scope.to_s,
+          "observation_method" => truncate(observation_method, MAX_METHOD)
+        }
+        entry["package"] = package if package.is_a?(Hash) && !package.empty?
+        sanitized = sanitize_evidence(evidence)
+        entry["evidence"] = sanitized if sanitized
+        entry
+      end
+
       def sanitize_evidence(value)
         return nil unless value.is_a?(Hash)
 

data/lib/auditea/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Auditea
-  VERSION = "0.1.0.beta.5"
+  VERSION = "0.1.0.beta.6"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: auditea
 version: !ruby/object:Gem::Version
-  version: 0.1.0.beta.5
+  version: 0.1.0.beta.6
 platform: ruby
 authors:
 - AudiTea
@@ -39,6 +39,7 @@ files:
 - lib/auditea/host_inventory/component_detectors.rb
 - lib/auditea/host_inventory/emitter.rb
 - lib/auditea/host_inventory/windows_components.rb
+- lib/auditea/host_inventory/windows_services.rb
 - lib/auditea/instrumentation/active_job.rb
 - lib/auditea/instrumentation/error_subscriber.rb
 - lib/auditea/instrumentation/exception.rb