LOGAR/RELEASE_NOTES.md

LOGAR Release v3.0.0

Major architectural release introducing the centralized Master Licensing Authority (logar.eibl.tech), Subordinate CA hierarchy, live seat synchronization over mTLS, authenticated Hermes AI Bearer token integrations, and streamlined WebUI dashboard controls.

Key Highlights & Changes in v3.0.0:

• Enterprise Master Licensing Authority (LOGAR-LICENSING):

  • Implemented standalone hierarchical PKI Authority issuing and signing subordinate CA certificates with custom X.509 OID seat quotas (1.3.6.1.4.1.59999.1.1).
  • Automated mTLS renewal and synchronization (renew_ca_cert_mtls) connecting Hub servers to upstream authority.
  • Dedicated multi-tenant licensing dashboard with 2FA TOTP authentication, user RBAC, and WebSocket real-time seat synchronization.
  • Dedicated Docker container publishing workflow on release tags and portainer GitOps redeployment webhooks.

• Real-Time Active Seat Quota Synchronization:

  • Hub automatically tracks and reports active node seat quotas (seats_taken, active_seats, hostname, server_fingerprint) to the upstream authority upon client enrollment, approval, revocation, and removal.
  • Non-blocking asynchronous thread dispatch ensures instantaneous client responses while keeping central licensing metrics synchronized.

• Hermes AI Integration & Token Authentication:

  • Dedicated /api/hermes/report ingestion endpoint delivering verified anomalies within a 12-hour evaluation window.
  • Bearer token administration (/api/hermes/tokens) with dedicated generation, copying, revocation, and deletion in the Hub WebUI.

• Streamlined WebUI Dashboard:

  • Cleaned up top summary KPI cards to focus strictly on operational status and fleet health.
  • Centralized full cryptographic inspection (Master Authority URL, Server Hub Fingerprint, CA Fingerprint) into the dedicated Sub-CA & Licensing tab.

• Standalone CI & Modular Testing:

  • Decoupled LOGAR and LOGAR-LICENSING CI pipelines so each repository tests independently without submodule dependencies.
  • 100% test coverage across 35 LOGAR unit tests and 14 Licensing Authority unit tests.

---

LOGAR Release v2.0.1

Maintenance and deployment release consolidating Gitea Actions release automation into a unified single workflow file, standardizing release dispatching across platforms, and bumping version definitions across server hub and Windows installers.

Key Highlights & Changes in v2.0.1:

• Consolidated Single Release Automation Workflow (.gitea/workflows/release.yml):

  • Unified separate platform release files into a single, cohesive workflow (release.yml) running parallel jobs (release-linux on ubuntu-latest and release-windows on windows-latest).
  • Standardized tag matching for Gitea Actions on push: tags: ['v*'].
  • Added streamlined manual workflow_dispatch triggers with automated release tag defaulting (v2.0.1).
  • Retired deprecated release-linux.yml and release-windows.yml files.

• Installer & Engine Version Bump:

  • Updated FastAPI Hub engine version to 2.0.1 in src/Server.py.
  • Bumped Inno Setup Windows Client Installer (compilation/installer_client.iss) AppVersion to 2.0.1.
  • Bumped Inno Setup Windows Server Installer (compilation/installer_server.iss) AppVersion to 2.0.1.

• Distribution & Release Documentation:

  • Updated root and distribution documentation across all 5 deployment targets to reflect the 25 passing unit tests and tripartite release options.

---

LOGAR Release v2.0.0

Major architectural release introducing Mutual TLS 1.3 (mTLS) transport security, built-in dynamic PKI & license accounting, in-flight certificate validity monitoring and auto-renewal, and automated Windows and Linux service installers.

Key Highlights & Changes in v2.0.0:

• mTLS 1.3 Transport Security & Runtime Licensing:

  • Replaced legacy plain TCP sockets with mutual TLS 1.3 authentication (ssl.CERT_REQUIRED, TLS 1.3 minimum version).
  • Hub dynamically validates incoming client Common Name (client_id) against active license seats in SQLite during the TLS handshake.
  • Drops unauthorized, un-enrolled, or revoked clients at the transport layer before payload reading.

• Dynamic Hub PKI Engine (src/server_enrollment.py):

  • Automatically initializes an internal RSA-4096 Root CA (ca.crt / ca.key).
  • Generates RSA-2048 Server TLS certificates with SANs for localhost, loopback, and server hostnames.
  • Full OpenSSL 3.x and Python 3.12–3.14 compatibility via SubjectKeyIdentifier and AuthorityKeyIdentifier certificate extensions.
  • Generates and signs client certificates on demand via POST /api/client/enroll.

• In-Flight Certificate Validity Watchdog & Dynamic SSLContext Reloading:

  • Server hub runs a continuous background watchdog coroutine (cert_validity_watchdog, evaluated every 12 hours) alongside startup checks.
  • Automatically checks Root CA and server TLS certificate expiration against a 30-day threshold.
  • Generates renewed certificates on disk with timestamped backups (.bak), and reloads active ssl.SSLContext in memory dynamically without dropping socket listeners or restarting the background service.

• Client Proactive Expiry Check & Reactive Self-Healing Auto-Renewal:

  • Proactive: Forwarders (Win_Client.py and Linux_Client.py) evaluate client.crt validity before each run, auto-renewing via /api/client/enroll if expiring within 30 days.
  • Reactive: If the hub rotates its Root CA or a TLS verification error (ssl.SSLError / SSLCertVerificationError) occurs, clients automatically catch the error, re-enroll with the hub using their enrollment secret, and reconnect cleanly.

• Database Schema & License Quota Accounting:

  • SQLite tables license_config (max_seats, enrollment_secret) and clients (client_id, hostname, os_type, cert_fingerprint, status, timestamps).
  • Enforces seat limits on enrollment (HTTP 403 License seat limit reached) while allowing active registered nodes to re-enroll/renew indefinitely.
  • Added GET /api/clients endpoint for license auditing and telemetry tracking.

• Automated Service Installers:

  • Windows: Self-contained Inno Setup installers (LOGAR-Client-Setup.exe and LOGAR-Server-Setup.exe) bundling nssm.exe to register, configure, and start Windows services automatically.
  • Linux: Automated installer scripts (compilation/install_linux_client.sh and install_linux_server.sh) deploying systemd service units with auto-restart policies.

• CI/CD Release Workflows:

  • Windows workflow (.gitea/workflows/release-windows.yml) and Linux workflow (.gitea/workflows/release-linux.yml) automated to build native executables, installers, and upload release assets on tag push.