Dev#13
Merged
Merged
Conversation
Refactor audit log handling and improve hardware/software collectors across platforms. - Replace ad-hoc periodic audit ticker with a logging integration started/stopped by the CLI; remove the program-level audit goroutine and startup of AuditLogService. - AuditLogService: introduce HTTP helpers (newRequest, doRequest), use context-aware SendBatchLogsWithContext, tighten types to map[string]any, improved logging, and smaller error messages; remove legacy generators/tests and deprecated batch helpers. - RAM parsing: massively refactor dmidecode parsing with helper functions (fieldValue, applyDmidecodeField), better fallback logic (readTotalMemKB, ramTypeFromEDAC, lshw helpers, manufacturerFromDMI) and cleaner lshw parsing. - Software collectors: set FirstSeenAt when available (mac: LastModified from system profiler, rpm: INSTALLTIME, windows: InstallDate, browser extensions: file mod time). - Minor fixes: make systemd unit write exempt from gosec, normalize mac GPU CurrentStatus to "unknown". These changes centralize HTTP request handling for audit logs, improve metadata accuracy for RAM and installed software, and simplify lifecycle management for the logging/audit flow.
Make audit-log checkpoint handling tolerant of different numeric types by adding CheckpointInt64/CheckpointFloat64 and updating platform collectors and parsers to use them (prevents panics after JSON round-trip). Parse syslog/mac timestamps in local time. Harden config handling: add token mutex with Get/Set accessors, atomic SaveAtomic refactor to use unique temp files and platform-specific hardening (Unix chmod / Windows DACL), reconcile persisted version with runtime, and add concurrency tests. Improve lockfile and startup semantics: use a version-independent lock name, close-before-remove, platform-specific non-destructive IsProcessRunning implementations, and make service startup synchronous with proper lock release on failure. Misc: enhanced auth token refresh logic (skewed preemptive refresh), assorted tests, and README/documentation updates.
Add ed25519-based release signing and verification plus safety fixes for task execution and agent info collection. - Release/CI: run scripts/sign in release workflow and upload SHA256SUMS; add `sign` target to Makefile and integrate it into `make release`. Requires SENTINELGO_SIGNING_KEY env var. - Updater: selectAssetWithChecksum now locates .sig and SHA256SUMS; downloadAndVerify verifies SHA256 and ed25519 signature (fail-closed on missing/invalid .sig); added embedded PublicKey and signature verification helpers and tests. - Tools: add scripts/sign (create .sig and SHA256SUMS) and scripts/keygen (generate keypair and outputs for CI/pubkey). - Tasks: prevent unsafe re-execution by marking tasks 'executing' before running, add ResetInterruptedTasks to mark stuck tasks as failed, wire ResetInterruptedTasks into polling startup flow, and add unit tests for store behavior. - Executor: refactor to executeTask to reduce complexity, ensure marking as executing before run and report results. - Scheduler/config: reduce agent-info update interval to 5m and add a timeout around osinfo.Collect to avoid hangs; add scheduler logging for intervals. These changes improve update authenticity (signed releases) and runtime robustness (task state safety and hung-collection protection).
Add cross-platform USB mass storage state collection and related refactors/tests. - macOS: add collectUSBMassStorage which reads MDM plist via plutil or checks kextstat; add JSON parser and tests. Introduce avCrowdStrikeFalcon constant and small struct formatting changes. - Linux: detect usb_storage via /sys/module or modprobe.d blacklists (scan *.conf); add helpers usbStorageStateFromModprobeDir and usbStorageStateFromConfFile with tests. Refactor SELinux and SecureBoot parsing into standalone helpers and use filepath for efivars lookup. Extract AV service probing into probeAVService. - Windows: add collectUSBMassStorage that queries USBSTOR Start DWORD and maps it to enabled/disabled with tests for mapping. - Shared: add USBMassStorageEnabled field to SecurityInfo JSON type. - CI: ensure shell scripts are executable in release workflow. These changes enable reporting of whether removable USB mass storage is permitted, improve parsing/testability of several platform checks, and make release scripts executable.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| for _, e := range entries { | ||
| if strings.HasPrefix(e.Name(), "SecureBoot-") { | ||
| data, rerr := os.ReadFile("/sys/firmware/efi/efivars/" + e.Name()) | ||
| data, rerr := os.ReadFile(filepath.Join(efivarsDir, e.Name())) |
| // replaced binary has a completely different hash, so without this launchd | ||
| // cannot restart the updated binary (Gatekeeper rejects it silently). | ||
| func recodesignForGatekeeper(selfPath string) { | ||
| _ = exec.Command("xattr", "-d", "com.apple.quarantine", selfPath).Run() |
| // cannot restart the updated binary (Gatekeeper rejects it silently). | ||
| func recodesignForGatekeeper(selfPath string) { | ||
| _ = exec.Command("xattr", "-d", "com.apple.quarantine", selfPath).Run() | ||
| _ = exec.Command("codesign", "--force", "--sign", "-", selfPath).Run() |
| func recodesignForGatekeeper(selfPath string) { | ||
| _ = exec.Command("xattr", "-d", "com.apple.quarantine", selfPath).Run() | ||
| _ = exec.Command("codesign", "--force", "--sign", "-", selfPath).Run() | ||
| _ = exec.Command("spctl", "--add", selfPath).Run() |
auto-merge was automatically disabled
June 11, 2026 17:33
Rebase failed
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.