|
|
|
@@ -1,38 +1,39 @@
|
|
|
|
|
# LOGAR Release Notes
|
|
|
|
|
|
|
|
|
|
## [v0.3.5] - 2026-09-30
|
|
|
|
|
## [v0.3.5.1] - 2026-09-30
|
|
|
|
|
|
|
|
|
|
### 🗄️ Enterprise Multi-Engine Storage Architecture
|
|
|
|
|
- **Dynamic Backend Switching**: LOGAR Server Hub now supports runtime switching between lightweight Local SQLite (WAL Mode) and Enterprise SQL servers (PostgreSQL and MySQL / MariaDB) via SQLAlchemy.
|
|
|
|
|
- **Automated Schema Initialization**: Switching to an external database automatically verifies connectivity, provisions normalized tables (`telemetry_events`, `client_seats`, `license_config`, `admin_users`), creates optimized indices, and runs health verification.
|
|
|
|
|
- **Configuration Persistence**: Persistent backend settings are saved in `server_config.json` under `db_engine` and isolated from temporary test environments.
|
|
|
|
|
### 🗄️ Multi-Engine Storage Architecture
|
|
|
|
|
- **Dynamic Backend Switching**: LOGAR Server Hub supports runtime switching between lightweight Local SQLite (WAL Mode) and Enterprise SQL servers (PostgreSQL and MySQL / MariaDB) via SQLAlchemy.
|
|
|
|
|
- **Automated Schema Provisioning**: Database switching automatically verifies connectivity, provisions normalized tables (`telemetry_events`, `client_seats`, `license_config`, `admin_users`), and generates optimized query indices.
|
|
|
|
|
- **Config Isolation**: Runtime backend parameters are stored persistently in `server_config.json` under `db_engine` and safely isolated from ephemeral test runs.
|
|
|
|
|
|
|
|
|
|
### ⚡ Ingestion Ring Buffer & High-Throughput Batch Flusher
|
|
|
|
|
- **In-Memory Queue Buffering**: Built-in Python `queue.Queue` ring buffer with background worker thread decoupled from socket I/O.
|
|
|
|
|
- **Burst Protection & Cache Mode**: High-velocity bursts are accepted without blocking mTLS 1.3 socket listeners; configurable batch size (`buffer_batch_size`, default 100) and flush interval (`buffer_flush_interval_sec`, default 2.0s).
|
|
|
|
|
- **Graceful Shutdown**: Unflushed buffer entries are cleanly committed to storage on server shutdown.
|
|
|
|
|
- **Explicit Opt-In Administrative Control**: Ingestion buffering is strictly optional and requires explicit administrative activation (never auto-enabled upon license activation).
|
|
|
|
|
### ⚡ Ingestion Ring Buffer & Burst Protection
|
|
|
|
|
- **In-Memory Queue Buffering**: Built-in ring buffer with an asynchronous background flusher decoupled from mTLS socket I/O.
|
|
|
|
|
- **Cache Mode**: High-velocity log spikes are absorbed in memory without blocking incoming mTLS 1.3 frame streams.
|
|
|
|
|
- **Configurable Batching**: Configurable flush interval (`buffer_flush_interval_sec`, default 2.0s) and batch size (`buffer_batch_size`, default 100).
|
|
|
|
|
- **Graceful Shutdown**: Unflushed queue items are flushed and committed cleanly during server shutdown.
|
|
|
|
|
- **Opt-In Security Policy**: Buffering remains an explicit administrative choice and is not auto-enabled upon license activation.
|
|
|
|
|
|
|
|
|
|
### 🔐 Zero-Knowledge OpenPGP Data Encryption at Rest
|
|
|
|
|
- **Public-Key Cryptography**: Enterprise SQL payloads (`event_data`) can be encrypted at rest using the server's X.509 RSA-2048 certificate / OpenPGP public key via AES-256-GCM symmetric session keys and RSA-OAEP key encapsulation.
|
|
|
|
|
- **Zero-Knowledge on Database Host**: External database administrators or compromised SQL servers cannot read raw telemetry payloads without the private key located on the LOGAR Server Hub.
|
|
|
|
|
- **Explicit Opt-In Security Model**: Payload encryption is strictly optional and configurable per compliance requirements.
|
|
|
|
|
- **Public-Key Envelope Encryption**: External SQL payloads (`event_data`) can be encrypted at rest using the server's X.509 RSA-2048 / OpenPGP public key with AES-256-GCM symmetric session keys.
|
|
|
|
|
- **Zero-Knowledge on Database Host**: External DBAs or compromised database hosts cannot read plaintext telemetry without the server's private key.
|
|
|
|
|
- **Opt-In Security Policy**: Payload encryption is strictly opt-in and configurable per compliance requirements.
|
|
|
|
|
|
|
|
|
|
### 📜 Dynamic Licensing Introspection & Clean Dashboard WebUI
|
|
|
|
|
- **Modular Capability Introspection**: PKI X.509 extension OID `1.3.6.1.4.1.58888.1.3` and persistent license records are dynamically parsed to expose active modules (`enterprise_db`, etc.) in a dedicated card on the **📜 Sub-CA & Licensing** tab.
|
|
|
|
|
- **Distraction-Free Tab Navigation**: Cleaned all tab headers to remove redundant item counts and visual badges for a streamlined administrative interface.
|
|
|
|
|
- **Graceful Feature Locking**: Unlicensed enterprise features remain visible but gracefully disabled in the WebUI and rejected by backend API validation.
|
|
|
|
|
- **Modular Capability Introspection**: PKI X.509 extension OID `1.3.6.1.4.1.58888.1.3` and persistent license records are dynamically parsed to display active modules (`enterprise_db`, etc.) in a dedicated card on the **📜 Sub-CA & Licensing** tab.
|
|
|
|
|
- **Distraction-Free Tab Navigation**: Cleaned all dashboard tab headers to remove redundant item counts and visual badges for a streamlined administrative interface.
|
|
|
|
|
- **Graceful Feature Locking**: Unlicensed enterprise controls remain visible but gracefully disabled in the WebUI and rejected by backend API validation.
|
|
|
|
|
|
|
|
|
|
### 📖 WebUI Administrator Guide & Expanded Test Suite
|
|
|
|
|
### 📖 WebUI Administrator Guide & 51 Automated Tests
|
|
|
|
|
- **WebUI Administrator Guide**: Published comprehensive WebUI management guide on the [Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide) covering console access, telemetry filtering, seat management, licensing, database switching, queue tuning, zero-knowledge crypto, Hermes AI, and 2FA.
|
|
|
|
|
- **Automated Unit & Integration Tests**: Expanded test suite to **51 automated tests** covering dynamic licensing, WebUI rendering, opt-in isolation, database failovers, and mTLS pipelines.
|
|
|
|
|
- **Expanded Test Suite**: 51 automated unit and integration tests passing with 100% test coverage.
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
## [v0.3.4.2] - 2026-09-30
|
|
|
|
|
|
|
|
|
|
### 🔒 Exclusive Hardware Host-Binding & Reassignment Controls
|
|
|
|
|
- **Automated Host Binding on First Activation**: Licenses now automatically lock to the specific server hardware fingerprint (`server_fingerprint`) and hostname upon first activation/enrollment, preventing multi-host cloning or license hijacking.
|
|
|
|
|
- **Automated Host Binding on First Activation**: Licenses automatically lock to the specific server hardware fingerprint (`server_fingerprint`) and hostname upon first activation/enrollment, preventing multi-host cloning or license hijacking.
|
|
|
|
|
- **Manual Host Reassignment Control**: Added `🔓 Reset Host Binding` button to the Master License Authority dashboard (`licenseDetailsModal`), allowing administrators to unbind a license so it can be cleanly transferred or reassigned to a new server instance.
|
|
|
|
|
- **REST & CLI Management**: Added `POST /api/license/reset-binding` and CLI argument `--reset-binding LIC_ID` for automated provisioning pipelines.
|
|
|
|
|
|
|
|
|
@@ -50,7 +51,7 @@
|
|
|
|
|
## [v0.3.4] - 2026-09-27
|
|
|
|
|
|
|
|
|
|
### 🔄 In-Place Installer Upgrades & Mutual Exclusion Guards
|
|
|
|
|
- **Seamless In-Place Upgrades**: Windows (Inno Setup & NSIS) and Linux installers now detect existing installations automatically. In upgrade mode, installers stop background services, update core binaries and runtime in-place, and restart services without overwriting configuration files (`server_config.json`, `client_config.json`), database state (`logar_state.db`), state tracking (`client_state.json`), or mTLS certificates.
|
|
|
|
|
- **Seamless In-Place Upgrades**: Windows (Inno Setup & NSIS) and Linux installers detect existing installations automatically. In upgrade mode, installers stop background services, update core binaries and runtime in-place, and restart services without overwriting configuration files (`server_config.json`, `client_config.json`), database state (`logar_state.db`), state tracking (`client_state.json`), or mTLS certificates.
|
|
|
|
|
- **Host Mutual Exclusion Validation**: Added pre-installation validation across all installers to prevent accidental co-installation of LOGAR Server and LOGAR Client on the same host, showing descriptive guidance to administrators.
|
|
|
|
|
|
|
|
|
|
### 🛡️ WebUI 2FA & Telemetry Stability
|
|
|
|
@@ -68,7 +69,7 @@
|
|
|
|
|
|
|
|
|
|
### 🎨 Brand Identity, Centralized Asset Library & Design System
|
|
|
|
|
- **Centralized `/assets` Repository**: Added official vector graphics (`logo.svg`, `logo_transparent.svg`, `logo_dark.svg`, `logo_banner.svg`), high-resolution master PNGs (16px to 512px), multi-resolution Windows ICOs (`logo.ico`, `favicon.ico`), and installer dialog bitmaps (`wizard_header.bmp`, `wizard_small.bmp`, `wizard_sidebar.bmp`).
|
|
|
|
|
- **Official Wiki Branding Guide**: Published comprehensive visual identity standards on the Gitea Wiki at `https://gitea.eibl.tech/me0nline/LOGAR/wiki/Branding-Guide` detailing logo anatomy, color palettes (Cyber Cyan `#00E5FF`, Emerald `#00FFA3`, Dark Navy `#0E1A2E`), typography, clear-space rules, dos and don'ts, and strict non-SIEM positioning.
|
|
|
|
|
- **Official Wiki Branding Guide**: Published comprehensive visual identity standards on the Gitea Wiki detailing logo anatomy, color palettes (Cyber Cyan `#00E5FF`, Emerald `#00FFA3`, Dark Navy `#0E1A2E`), typography, clear-space rules, dos and don'ts, and strict non-SIEM positioning.
|
|
|
|
|
- **Unified Interface & Tab Branding**: Implemented transparent vector logos on all web navigation bars and browser tabs across both the LOGAR Server Hub (`:8443`) and Master Licensing Authority (`logar.eibl.tech`).
|
|
|
|
|
- **Clean Installer Bitmaps**: Regenerated 24-bit RGB header bitmaps with seamless white backgrounds (`#FFFFFF`) matching native Windows Inno Setup wizard dialogs.
|
|
|
|
|
- **Automated Asset Pipeline**: Enhanced `compilation/generate_branding_assets.py` to deterministically compile and distribute assets across main repo, compilation subdirectories, and the licensing submodule without third-party graphics dependencies.
|
|
|
|
@@ -78,7 +79,7 @@
|
|
|
|
|
## [v0.3.2] - 2026-09-27
|
|
|
|
|
|
|
|
|
|
### 🪟 Windows Installer & Web Portal Enhancements
|
|
|
|
|
- **Project Showcase Landing Page**: Deployed high-impact public homepage at `GET /` on the licensing authority with architecture diagrams, quickstart commands, and direct navigation to Gitea, Wiki, and the Licensing Portal (`/licensing`).
|
|
|
|
|
- **Project Showcase Landing Page**: Deployed public homepage at `GET /` on the licensing authority with architecture diagrams, quickstart commands, and direct navigation to Gitea, Wiki, and the Licensing Portal (`/licensing`).
|
|
|
|
|
- **Standalone Windows Binaries & Python Runtime**: Resolved issues with standalone Windows executable execution and bundled runtime paths.
|
|
|
|
|
- **Data Directory Selection & Permissions**: Added custom data directory selection during setup and fixed permissions for background Windows services.
|
|
|
|
|
- **Service Lifecycle & Clean Uninstallation**: Resolved service startup issues and ensured complete cleanup of state files upon uninstallation.
|
|
|
|
|
