@calltelemetry/ct-lab-mcp 0.8.98 → 0.8.99

package/assets/stig/template.pkr.hcl

@@ -0,0 +1,252 @@
+packer {
+  required_version = "= 1.16.0"
+  required_plugins {
+    proxmox = {
+      version = "= 1.2.4"
+      source  = "github.com/hashicorp/proxmox"
+    }
+  }
+}
+
+variable "proxmox_url" { type = string }
+variable "proxmox_username" { type = string }
+variable "proxmox_token" {
+  type      = string
+  sensitive = true
+}
+variable "proxmox_node" {
+  type    = string
+  default = "minis"
+}
+variable "vm_id" { type = number }
+variable "template_name" { type = string }
+variable "disk_storage_pool" {
+  type    = string
+  default = "local-lvm"
+}
+variable "bridge" {
+  type    = string
+  default = "vmbr0"
+}
+variable "vlan_tag" {
+  type    = string
+  default = "" # untagged lab network: VLAN126 has no internet egress/DNS, and the build needs RHSM errata
+}
+variable "disk_size" {
+  type    = string
+  default = "128G"
+}
+variable "vcpus" {
+  type    = number
+  default = 4
+}
+variable "memory_mb" {
+  type    = number
+  default = 8192
+}
+variable "iso_file" {
+  type    = string
+  default = "synology-cisco-isos:iso/rhel-8.10-x86_64-dvd.iso"
+}
+
+variable "ssh_username" {
+  type    = string
+  default = "ctbuild"
+}
+variable "ssh_private_key_file" { type = string }
+variable "ssh_public_key" { type = string }
+variable "build_password" {
+  type      = string
+  sensitive = true
+}
+variable "build_password_hash" {
+  type      = string
+  sensitive = true
+}
+variable "grub_pbkdf2" {
+  type      = string
+  sensitive = true
+}
+
+variable "luks_bootstrap" {
+  type      = string
+  sensitive = true
+}
+variable "rhsm_org" {
+  type      = string
+  sensitive = true
+}
+variable "rhsm_key" {
+  type      = string
+  sensitive = true
+}
+variable "dns_servers" {
+  type    = string
+  default = "192.168.126.1,192.168.68.125"
+}
+variable "ntp_servers" {
+  type    = string
+  default = "0.rhel.pool.ntp.org,1.rhel.pool.ntp.org"
+}
+variable "tailoring_file" { type = string }
+
+variable "ssg_datastream" { type = string }
+variable "ssg_datastream_sha256" {
+  type    = string
+  default = "82592d3cff74a82ce652a65ba67cd755cf57550269798d4c449c2069417c1028"
+}
+variable "evidence_dir" { type = string }
+
+locals {
+  sudo = "echo '${var.build_password}' | sudo -S -p '' env {{ .Vars }} bash '{{ .Path }}'"
+}
+
+source "proxmox-iso" "rhel810_stig" {
+  proxmox_url              = var.proxmox_url
+  username                 = var.proxmox_username
+  token                    = var.proxmox_token
+  insecure_skip_tls_verify = true # lab self-signed PVE certificate
+  node                     = var.proxmox_node
+  vm_id                    = var.vm_id
+  vm_name                  = var.template_name
+  template_name            = var.template_name
+  template_description     = "RHEL 8.10 DISA STIG template. SSG 0.1.82 / RHEL 8 STIG V2R8. Built ${timestamp()}. LUKS2 PV with template bootstrap key; each clone re-encrypts and binds its own TPM2 at first boot."
+  tags                     = "rhel8-stig-template;ssg-0-1-82;stig-v2r8"
+  os                       = "l26"
+  machine                  = "q35"
+  bios                     = "ovmf"
+  cpu_type                 = "host"
+  cores                    = var.vcpus
+  memory                   = var.memory_mb
+  qemu_agent               = true
+  scsi_controller          = "virtio-scsi-single"
+  boot                     = "order=scsi0;ide2;net0"
+  onboot                   = false
+
+  efi_config {
+    efi_storage_pool  = var.disk_storage_pool
+    efi_type          = "4m"
+    pre_enrolled_keys = true
+  }
+
+  boot_iso {
+    type         = "ide"
+    index        = "2"
+    iso_file     = var.iso_file
+    iso_checksum = "sha256:9b3c8e31bc2cdd2de9cf96abb3726347f5840ff3b176270647b3e66639af291b"
+    unmount      = true
+  }
+
+  additional_iso_files {
+    type             = "ide"
+    index            = "3"
+    iso_storage_pool = "local"
+    cd_label         = "OEMDRV"
+    cd_content = {
+      "ks.cfg" = templatefile("${path.root}/ks.cfg.pkrtpl", {
+        hostname            = var.template_name
+        ssh_username        = var.ssh_username
+        ssh_public_key      = trimspace(var.ssh_public_key)
+        build_password_hash = var.build_password_hash
+        grub_pbkdf2         = var.grub_pbkdf2
+        luks_bootstrap      = var.luks_bootstrap
+      })
+    }
+    unmount           = true
+    keep_cdrom_device = false
+  }
+
+  disks {
+    type         = "scsi"
+    storage_pool = var.disk_storage_pool
+    disk_size    = var.disk_size
+    discard      = true
+    io_thread    = true
+  }
+
+  network_adapters {
+    model    = "virtio"
+    bridge   = var.bridge
+    vlan_tag = var.vlan_tag
+  }
+
+  cloud_init              = true
+  cloud_init_storage_pool = var.disk_storage_pool
+
+  boot_wait = "3m15s" # OVMF reaches the DVD GRUB menu ~3m after power-on on minis
+  boot_command = [
+    "<up><wait>e<wait><down><down><end>",
+    " fips=1 inst.text inst.ks=hd:LABEL=OEMDRV:/ks.cfg",
+    "<leftCtrlOn>x<leftCtrlOff>",
+  ]
+
+  communicator         = "ssh"
+  ssh_username         = var.ssh_username
+  ssh_private_key_file = var.ssh_private_key_file
+  ssh_timeout          = "75m"
+}
+
+build {
+  name    = "rhel810-stig-template"
+  sources = ["source.proxmox-iso.rhel810_stig"]
+
+  provisioner "file" {
+    source      = var.ssg_datastream
+    destination = "/home/${var.ssh_username}/ssg-rhel8-ds.xml"
+  }
+  provisioner "file" {
+    source      = var.tailoring_file
+    destination = "/home/${var.ssh_username}/tailoring.xml"
+  }
+  provisioner "file" {
+    source      = "${path.root}/files"
+    destination = "/home/${var.ssh_username}/"
+  }
+
+  # Current errata through RHSM, then reboot into the updated kernel.
+  provisioner "shell" {
+    execute_command = local.sudo
+    environment_vars = [
+      "RHSM_ORG=${var.rhsm_org}",
+      "RHSM_KEY=${var.rhsm_key}",
+    ]
+    scripts           = ["${path.root}/scripts/errata.sh"]
+    expect_disconnect = true
+  }
+
+  # Organization settings + pinned SSG STIG remediation, then reboot.
+  provisioner "shell" {
+    pause_before    = "90s"
+    execute_command = local.sudo
+    environment_vars = [
+      "SSG_DATASTREAM=/home/${var.ssh_username}/ssg-rhel8-ds.xml",
+      "SSG_DATASTREAM_SHA256=${var.ssg_datastream_sha256}",
+      "TAILORING=/home/${var.ssh_username}/tailoring.xml",
+      "FILES_DIR=/home/${var.ssh_username}/files",
+      "BUILD_USER=${var.ssh_username}",
+      "DNS_SERVERS=${var.dns_servers}",
+      "NTP_SERVERS=${var.ntp_servers}",
+    ]
+    scripts           = ["${path.root}/scripts/remediate.sh"]
+    expect_disconnect = true
+  }
+
+  provisioner "shell" {
+    pause_before     = "90s"
+    execute_command  = local.sudo
+    environment_vars = ["BUILD_USER=${var.ssh_username}"]
+    scripts          = ["${path.root}/scripts/assess.sh"]
+  }
+
+  provisioner "file" {
+    direction   = "download"
+    source      = "/home/${var.ssh_username}/stig-report/"
+    destination = "${var.evidence_dir}/"
+  }
+
+  provisioner "shell" {
+    execute_command  = local.sudo
+    environment_vars = ["BUILD_USER=${var.ssh_username}"]
+    scripts          = ["${path.root}/scripts/seal.sh"]
+  }
+}

package/dist/src/generated-version.d.ts

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export declare const PACKAGE_VERSION = "0.8.98";
+export declare const PACKAGE_VERSION = "0.8.99";
 //# sourceMappingURL=generated-version.d.ts.map

package/dist/src/generated-version.js

@@ -2,5 +2,5 @@
  * Auto-synced package version fallback for non-filesystem runtimes (Cloudflare Workers).
  * Updated automatically during release publication in .github/workflows/publish.yml.
  */
-export const PACKAGE_VERSION = "0.8.98";
+export const PACKAGE_VERSION = "0.8.99";
 //# sourceMappingURL=generated-version.js.map

package/dist/src/stig/live.d.ts

@@ -0,0 +1,116 @@
+import type { BuildMaterial, ClaimPort, ClaimRecord, GuestShell, Materials, PackerPort, PveShell, RunOpts, SecretStore, ShellResult, StigDeps, StigProvider } from "./ports.js";
+/** assets/stig next to dist/src/stig (published) or next to src/stig (dev). */
+export declare function defaultAssetsDir(): string;
+export declare class SshPveShell implements PveShell {
+    private readonly host;
+    private readonly user;
+    constructor(host?: string, user?: string);
+    run(script: string, opts?: RunOpts): Promise<ShellResult>;
+}
+export declare class SshGuestShell implements GuestShell {
+    private user;
+    private keyFile;
+    private known;
+    private ip;
+    configure(cfg: {
+        user: string;
+        keyFile: string;
+        knownHostsFile: string;
+    }): void;
+    setTarget(ip: string): void;
+    private opts;
+    private ssh;
+    runScript(script: string, o?: {
+        sudo?: boolean;
+        stdin?: string;
+        timeoutMs?: number;
+    }): Promise<ShellResult>;
+    waitSsh(hostKey: "accept-new" | "yes", tries: number, intervalMs?: number): Promise<boolean>;
+    fileExists(path: string): Promise<boolean>;
+    fetchDir(remote: string, localDir: string): Promise<void>;
+}
+export declare class DopplerSecrets implements SecretStore {
+    private readonly project;
+    private readonly config;
+    constructor(project?: string, config?: string);
+    get(name: string): Promise<string | undefined>;
+    set(name: string, value: string): Promise<void>;
+}
+export declare class LabClaims implements ClaimPort {
+    private readonly ns;
+    private text;
+    list(): Promise<ClaimRecord[]>;
+    get(name: string): Promise<ClaimRecord | null>;
+    create(a: {
+        name: string;
+        vmid: number;
+        vmName: string;
+        ttlHours: number;
+        stig: Record<string, unknown>;
+    }): Promise<ClaimRecord>;
+    waitReady(name: string): Promise<ClaimRecord>;
+    annotate(name: string, annotations: Record<string, string>): Promise<void>;
+    renew(name: string, extendHours: number): Promise<{
+        ttlHours: number;
+    }>;
+    pause(name: string, paused: boolean, reason?: string): Promise<void>;
+    delete(name: string, expectedUid: string): Promise<void>;
+}
+export declare class PackerCli implements PackerPort {
+    private readonly cwd;
+    private readonly pluginPath;
+    constructor(cwd: string, pluginPath?: string | undefined);
+    version(): Promise<string>;
+    build(a: {
+        vars: Record<string, string>;
+        env: Record<string, string>;
+        logFile: string;
+    }): Promise<number>;
+}
+export declare class NodeMaterials implements Materials {
+    private openssl;
+    randomAlnum(length: number): string;
+    sha512Crypt(plain: string): Promise<string>;
+    sshKeypair(dir: string, label: string): Promise<{
+        privateKeyFile: string;
+        publicKey: string;
+    }>;
+    buildMaterial(runDir: string, label: string): Promise<BuildMaterial>;
+}
+/**
+ * Canonical provider: the `lab-inventory stig` verbs (plan, then apply with the plan digest). Secrets travel in 0600
+ * files inside a private temp directory that is removed afterwards; argv carries only public values.
+ */
+export declare class CliStigProvider implements StigProvider {
+    private readonly cli;
+    private readonly exec;
+    private readonly tmpRoot;
+    constructor(cli: string, exec?: (file: string, args: string[], o?: RunOpts) => Promise<ShellResult>, tmpRoot?: string);
+    private call;
+    clone(a: {
+        operationId: string;
+        name: string;
+        templateName: string;
+        vmid: number;
+        claimedVmids: number[];
+        sshPublicKey: string;
+        passwordHash: string;
+        dns: string[];
+    }): Promise<{
+        vmid: number;
+    }>;
+    destroyTemplate(a: {
+        operationId: string;
+        name: string;
+        vmid: number;
+    }): Promise<void>;
+    guestIp(vmid: number): Promise<string>;
+}
+export declare function defaultRunDir(): string;
+/** The lab-inventory CLI path when the canonical bridge is configured (CT_LAB_CANONICAL_CLI). */
+export declare function canonicalCli(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function liveDeps(opts?: {
+    baseDir?: string;
+    log?: (line: string) => void;
+}): StigDeps;
+//# sourceMappingURL=live.d.ts.map

package/dist/src/stig/live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../../../src/stig/live.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAC9I,MAAM,YAAY,CAAC;AAWpB,+EAA+E;AAC/E,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAkBD,qBAAa,WAAY,YAAW,QAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAA0D,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAnF,IAAI,SAAwD,EAAmB,IAAI,SAAS;IACzH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;CAI1D;AAED,qBAAa,aAAc,YAAW,UAAU;IAC9C,OAAO,CAAC,IAAI,CAAa;IAAC,OAAO,CAAC,OAAO,CAAM;IAAC,OAAO,CAAC,KAAK,CAAM;IAAC,OAAO,CAAC,EAAE,CAAM;IACpF,SAAS,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAC/E,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAC3B,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,GAAG;IAGL,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3G,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAO5F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAKhE;AAED,qBAAa,cAAe,YAAW,WAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAkD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAhF,OAAO,SAAgD,EAAmB,MAAM,SAAsC;IAC7I,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUtD;AAED,qBAAa,SAAU,YAAW,SAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,IAAI;IAIN,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAK9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAI9C,MAAM,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC;IAKhI,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAK7C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAKvE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI/D;AAED,qBAAa,SAAU,YAAW,UAAU;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAxC,GAAG,EAAE,MAAM,EAAmB,UAAU,qBAA6C;IAC5G,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAMhC,KAAK,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;CAW1G;AAED,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,OAAO;IAIf,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAK7B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK3C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAO9F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAe3E;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,YAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAA6E,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAvI,GAAG,EAAE,MAAM,EAAmB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAO,EAAmB,OAAO,SAAW;YAEjK,IAAI;IAWZ,KAAK,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBjM,eAAe,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAI7C;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAGrF;AAED,wBAAgB,QAAQ,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAAG,QAAQ,CAYhG"}