diff --git a/README.md b/README.md index ee91744..7783aaf 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ # LOGAR: Fleet Log Aggregation & Centralized Provisioning System ### *Secure Log Aggregation, PKI Fleet Licensing & Centralized Delivery for Autonomous AI Analysis* -[![Version](https://img.shields.io/badge/version-0.3.5-blue.svg)](RELEASE_NOTES.md) +[![Version](https://img.shields.io/badge/version-0.3.5.1-blue.svg)](RELEASE_NOTES.md) [![Tests](https://img.shields.io/badge/tests-51%20passed-success.svg)](tests/) [![Security](https://img.shields.io/badge/mTLS-TLS%201.3-green.svg)](https://gitea.eibl.tech/me0nline/LOGAR/wiki/PKI-and-Licensing) [![Admin Guide](https://img.shields.io/badge/wiki-Admin%20Guide-blueviolet.svg)](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide) diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index 9cbc6f8..70a1c93 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -1,38 +1,39 @@ # LOGAR Release Notes -## [v0.3.5] - 2026-09-30 +## [v0.3.5.1] - 2026-09-30 -### 🗄️ Enterprise Multi-Engine Storage Architecture -- **Dynamic Backend Switching**: LOGAR Server Hub now supports runtime switching between lightweight Local SQLite (WAL Mode) and Enterprise SQL servers (PostgreSQL and MySQL / MariaDB) via SQLAlchemy. -- **Automated Schema Initialization**: Switching to an external database automatically verifies connectivity, provisions normalized tables (`telemetry_events`, `client_seats`, `license_config`, `admin_users`), creates optimized indices, and runs health verification. -- **Configuration Persistence**: Persistent backend settings are saved in `server_config.json` under `db_engine` and isolated from temporary test environments. +### 🗄️ Multi-Engine Storage Architecture +- **Dynamic Backend Switching**: LOGAR Server Hub supports runtime switching between lightweight Local SQLite (WAL Mode) and Enterprise SQL servers (PostgreSQL and MySQL / MariaDB) via SQLAlchemy. +- **Automated Schema Provisioning**: Database switching automatically verifies connectivity, provisions normalized tables (`telemetry_events`, `client_seats`, `license_config`, `admin_users`), and generates optimized query indices. +- **Config Isolation**: Runtime backend parameters are stored persistently in `server_config.json` under `db_engine` and safely isolated from ephemeral test runs. -### ⚡ Ingestion Ring Buffer & High-Throughput Batch Flusher -- **In-Memory Queue Buffering**: Built-in Python `queue.Queue` ring buffer with background worker thread decoupled from socket I/O. -- **Burst Protection & Cache Mode**: High-velocity bursts are accepted without blocking mTLS 1.3 socket listeners; configurable batch size (`buffer_batch_size`, default 100) and flush interval (`buffer_flush_interval_sec`, default 2.0s). -- **Graceful Shutdown**: Unflushed buffer entries are cleanly committed to storage on server shutdown. -- **Explicit Opt-In Administrative Control**: Ingestion buffering is strictly optional and requires explicit administrative activation (never auto-enabled upon license activation). +### ⚡ Ingestion Ring Buffer & Burst Protection +- **In-Memory Queue Buffering**: Built-in ring buffer with an asynchronous background flusher decoupled from mTLS socket I/O. +- **Cache Mode**: High-velocity log spikes are absorbed in memory without blocking incoming mTLS 1.3 frame streams. +- **Configurable Batching**: Configurable flush interval (`buffer_flush_interval_sec`, default 2.0s) and batch size (`buffer_batch_size`, default 100). +- **Graceful Shutdown**: Unflushed queue items are flushed and committed cleanly during server shutdown. +- **Opt-In Security Policy**: Buffering remains an explicit administrative choice and is not auto-enabled upon license activation. ### 🔐 Zero-Knowledge OpenPGP Data Encryption at Rest -- **Public-Key Cryptography**: Enterprise SQL payloads (`event_data`) can be encrypted at rest using the server's X.509 RSA-2048 certificate / OpenPGP public key via AES-256-GCM symmetric session keys and RSA-OAEP key encapsulation. -- **Zero-Knowledge on Database Host**: External database administrators or compromised SQL servers cannot read raw telemetry payloads without the private key located on the LOGAR Server Hub. -- **Explicit Opt-In Security Model**: Payload encryption is strictly optional and configurable per compliance requirements. +- **Public-Key Envelope Encryption**: External SQL payloads (`event_data`) can be encrypted at rest using the server's X.509 RSA-2048 / OpenPGP public key with AES-256-GCM symmetric session keys. +- **Zero-Knowledge on Database Host**: External DBAs or compromised database hosts cannot read plaintext telemetry without the server's private key. +- **Opt-In Security Policy**: Payload encryption is strictly opt-in and configurable per compliance requirements. ### 📜 Dynamic Licensing Introspection & Clean Dashboard WebUI -- **Modular Capability Introspection**: PKI X.509 extension OID `1.3.6.1.4.1.58888.1.3` and persistent license records are dynamically parsed to expose active modules (`enterprise_db`, etc.) in a dedicated card on the **📜 Sub-CA & Licensing** tab. -- **Distraction-Free Tab Navigation**: Cleaned all tab headers to remove redundant item counts and visual badges for a streamlined administrative interface. -- **Graceful Feature Locking**: Unlicensed enterprise features remain visible but gracefully disabled in the WebUI and rejected by backend API validation. +- **Modular Capability Introspection**: PKI X.509 extension OID `1.3.6.1.4.1.58888.1.3` and persistent license records are dynamically parsed to display active modules (`enterprise_db`, etc.) in a dedicated card on the **📜 Sub-CA & Licensing** tab. +- **Distraction-Free Tab Navigation**: Cleaned all dashboard tab headers to remove redundant item counts and visual badges for a streamlined administrative interface. +- **Graceful Feature Locking**: Unlicensed enterprise controls remain visible but gracefully disabled in the WebUI and rejected by backend API validation. -### 📖 WebUI Administrator Guide & Expanded Test Suite +### 📖 WebUI Administrator Guide & 51 Automated Tests - **WebUI Administrator Guide**: Published comprehensive WebUI management guide on the [Gitea Wiki](https://gitea.eibl.tech/me0nline/LOGAR/wiki/Admin-Guide) covering console access, telemetry filtering, seat management, licensing, database switching, queue tuning, zero-knowledge crypto, Hermes AI, and 2FA. -- **Automated Unit & Integration Tests**: Expanded test suite to **51 automated tests** covering dynamic licensing, WebUI rendering, opt-in isolation, database failovers, and mTLS pipelines. +- **Expanded Test Suite**: 51 automated unit and integration tests passing with 100% test coverage. --- ## [v0.3.4.2] - 2026-09-30 ### 🔒 Exclusive Hardware Host-Binding & Reassignment Controls -- **Automated Host Binding on First Activation**: Licenses now automatically lock to the specific server hardware fingerprint (`server_fingerprint`) and hostname upon first activation/enrollment, preventing multi-host cloning or license hijacking. +- **Automated Host Binding on First Activation**: Licenses automatically lock to the specific server hardware fingerprint (`server_fingerprint`) and hostname upon first activation/enrollment, preventing multi-host cloning or license hijacking. - **Manual Host Reassignment Control**: Added `🔓 Reset Host Binding` button to the Master License Authority dashboard (`licenseDetailsModal`), allowing administrators to unbind a license so it can be cleanly transferred or reassigned to a new server instance. - **REST & CLI Management**: Added `POST /api/license/reset-binding` and CLI argument `--reset-binding LIC_ID` for automated provisioning pipelines. @@ -50,7 +51,7 @@ ## [v0.3.4] - 2026-09-27 ### 🔄 In-Place Installer Upgrades & Mutual Exclusion Guards -- **Seamless In-Place Upgrades**: Windows (Inno Setup & NSIS) and Linux installers now detect existing installations automatically. In upgrade mode, installers stop background services, update core binaries and runtime in-place, and restart services without overwriting configuration files (`server_config.json`, `client_config.json`), database state (`logar_state.db`), state tracking (`client_state.json`), or mTLS certificates. +- **Seamless In-Place Upgrades**: Windows (Inno Setup & NSIS) and Linux installers detect existing installations automatically. In upgrade mode, installers stop background services, update core binaries and runtime in-place, and restart services without overwriting configuration files (`server_config.json`, `client_config.json`), database state (`logar_state.db`), state tracking (`client_state.json`), or mTLS certificates. - **Host Mutual Exclusion Validation**: Added pre-installation validation across all installers to prevent accidental co-installation of LOGAR Server and LOGAR Client on the same host, showing descriptive guidance to administrators. ### 🛡️ WebUI 2FA & Telemetry Stability @@ -68,7 +69,7 @@ ### 🎨 Brand Identity, Centralized Asset Library & Design System - **Centralized `/assets` Repository**: Added official vector graphics (`logo.svg`, `logo_transparent.svg`, `logo_dark.svg`, `logo_banner.svg`), high-resolution master PNGs (16px to 512px), multi-resolution Windows ICOs (`logo.ico`, `favicon.ico`), and installer dialog bitmaps (`wizard_header.bmp`, `wizard_small.bmp`, `wizard_sidebar.bmp`). -- **Official Wiki Branding Guide**: Published comprehensive visual identity standards on the Gitea Wiki at `https://gitea.eibl.tech/me0nline/LOGAR/wiki/Branding-Guide` detailing logo anatomy, color palettes (Cyber Cyan `#00E5FF`, Emerald `#00FFA3`, Dark Navy `#0E1A2E`), typography, clear-space rules, dos and don'ts, and strict non-SIEM positioning. +- **Official Wiki Branding Guide**: Published comprehensive visual identity standards on the Gitea Wiki detailing logo anatomy, color palettes (Cyber Cyan `#00E5FF`, Emerald `#00FFA3`, Dark Navy `#0E1A2E`), typography, clear-space rules, dos and don'ts, and strict non-SIEM positioning. - **Unified Interface & Tab Branding**: Implemented transparent vector logos on all web navigation bars and browser tabs across both the LOGAR Server Hub (`:8443`) and Master Licensing Authority (`logar.eibl.tech`). - **Clean Installer Bitmaps**: Regenerated 24-bit RGB header bitmaps with seamless white backgrounds (`#FFFFFF`) matching native Windows Inno Setup wizard dialogs. - **Automated Asset Pipeline**: Enhanced `compilation/generate_branding_assets.py` to deterministically compile and distribute assets across main repo, compilation subdirectories, and the licensing submodule without third-party graphics dependencies. @@ -78,7 +79,7 @@ ## [v0.3.2] - 2026-09-27 ### 🪟 Windows Installer & Web Portal Enhancements -- **Project Showcase Landing Page**: Deployed high-impact public homepage at `GET /` on the licensing authority with architecture diagrams, quickstart commands, and direct navigation to Gitea, Wiki, and the Licensing Portal (`/licensing`). +- **Project Showcase Landing Page**: Deployed public homepage at `GET /` on the licensing authority with architecture diagrams, quickstart commands, and direct navigation to Gitea, Wiki, and the Licensing Portal (`/licensing`). - **Standalone Windows Binaries & Python Runtime**: Resolved issues with standalone Windows executable execution and bundled runtime paths. - **Data Directory Selection & Permissions**: Added custom data directory selection during setup and fixed permissions for background Windows services. - **Service Lifecycle & Clean Uninstallation**: Resolved service startup issues and ensured complete cleanup of state files upon uninstallation. diff --git a/compilation/installer_client.iss b/compilation/installer_client.iss index 690f832..78073ba 100644 --- a/compilation/installer_client.iss +++ b/compilation/installer_client.iss @@ -1,7 +1,7 @@ [Setup] AppId={{9C4A6F1D-8975-476E-8512-4217DE029A88}} AppName=LOGAR Client -AppVersion=0.3.4.2 +AppVersion=0.3.5.1 AppPublisher=LOGAR AppPublisherURL=https://logar.eibl.tech AppSupportURL=https://logar.eibl.tech @@ -19,9 +19,9 @@ WizardImageFile=assets\wizard_sidebar.bmp WizardSmallImageFile=assets\wizard_small.bmp VersionInfoCompany=LOGAR VersionInfoDescription=LOGAR Windows Edge Log Forwarder Setup -VersionInfoVersion=0.3.4.2 +VersionInfoVersion=0.3.5.1 VersionInfoProductName=LOGAR Client -VersionInfoProductVersion=0.3.4.2 +VersionInfoProductVersion=0.3.5.1 [Files] Source: "..\dist\Win_Client.exe"; DestDir: "{app}"; Flags: ignoreversion diff --git a/compilation/installer_client.nsi b/compilation/installer_client.nsi index 604aedf..c7eb57c 100644 --- a/compilation/installer_client.nsi +++ b/compilation/installer_client.nsi @@ -9,13 +9,13 @@ RequestExecutionLevel admin BrandingText "LOGAR Centralized Log Aggregator && Forwarder" -VIProductVersion "0.3.4.2" +VIProductVersion "0.3.5.1" VIAddVersionKey "ProductName" "LOGAR Client" VIAddVersionKey "CompanyName" "LOGAR" VIAddVersionKey "LegalCopyright" "© 2026 LOGAR" VIAddVersionKey "FileDescription" "LOGAR Windows Edge Log Forwarder Setup" -VIAddVersionKey "FileVersion" "0.3.4.2" -VIAddVersionKey "ProductVersion" "0.3.4.2" +VIAddVersionKey "FileVersion" "0.3.5.1" +VIAddVersionKey "ProductVersion" "0.3.5.1" # --- Visual Graphics & Branding --- !define MUI_ICON "assets/logo.ico" diff --git a/compilation/installer_server.iss b/compilation/installer_server.iss index 219f903..4101521 100644 --- a/compilation/installer_server.iss +++ b/compilation/installer_server.iss @@ -1,7 +1,7 @@ [Setup] AppId={{4F3D675E-1E4E-43B6-8C84-B47DE290BE4A}} AppName=LOGAR Server -AppVersion=0.3.4.2 +AppVersion=0.3.5.1 AppPublisher=LOGAR AppPublisherURL=https://logar.eibl.tech AppSupportURL=https://logar.eibl.tech @@ -19,9 +19,9 @@ WizardImageFile=assets\wizard_sidebar.bmp WizardSmallImageFile=assets\wizard_small.bmp VersionInfoCompany=LOGAR VersionInfoDescription=LOGAR Cloud Hub & TCP Ingestion Server Setup -VersionInfoVersion=0.3.4.2 +VersionInfoVersion=0.3.5.1 VersionInfoProductName=LOGAR Server -VersionInfoProductVersion=0.3.4.2 +VersionInfoProductVersion=0.3.5.1 [Files] Source: "..\dist\Server.exe"; DestDir: "{app}"; Flags: ignoreversion diff --git a/compilation/installer_server.nsi b/compilation/installer_server.nsi index 68f4bb4..65c4d12 100644 --- a/compilation/installer_server.nsi +++ b/compilation/installer_server.nsi @@ -8,13 +8,13 @@ RequestExecutionLevel admin BrandingText "LOGAR Centralized Log Aggregator && Ingestion Hub" -VIProductVersion "0.3.4.2" +VIProductVersion "0.3.5.1" VIAddVersionKey "ProductName" "LOGAR Server" VIAddVersionKey "CompanyName" "LOGAR" VIAddVersionKey "LegalCopyright" "© 2026 LOGAR" VIAddVersionKey "FileDescription" "LOGAR Cloud Hub & TCP Ingestion Server Setup" -VIAddVersionKey "FileVersion" "0.3.4.2" -VIAddVersionKey "ProductVersion" "0.3.4.2" +VIAddVersionKey "FileVersion" "0.3.5.1" +VIAddVersionKey "ProductVersion" "0.3.5.1" # --- Visual Graphics & Branding --- !define MUI_ICON "assets/logo.ico"