diff --git a/DOWNLOAD_AND_VERIFY_ISO.md b/DOWNLOAD_AND_VERIFY_ISO.md index 284b89ae3..68ae7f2c4 100644 --- a/DOWNLOAD_AND_VERIFY_ISO.md +++ b/DOWNLOAD_AND_VERIFY_ISO.md @@ -1,17 +1,17 @@ -### 3.3.0-20260908 ISO image released on 2026/09/08 +### 3.3.0-20260911 ISO image released on 2026/09/11 ### Download and Verify -3.3.0-20260908 ISO image: -https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260908.iso +3.3.0-20260911 ISO image: +https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso -MD5: 5A2C42D0083F2D7B4DC2178C30EBC05F -SHA1: 505220A8A3315AFEE601C13772996018425CCD29 -SHA256: 6EB8401296A1D051FEC558C520D2D4AB1912A72D351A2426FBF8C87FEE2BA844 +MD5: 12B18433D3A2198A185892FF79CF638F +SHA1: 2B3C2E1FA7A78ED1F956E7EDCC12E32593C14EEE +SHA256: 0938C73B76CE30EC9E4394D312C79EA7CAC721B6818541697279A6221F7D870D Signature for ISO image: -https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260908.iso.sig +https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260911.iso.sig Signing key: https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/main/KEYS @@ -25,22 +25,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/ Download the signature file for the ISO: ``` -wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260908.iso.sig +wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.3.0-20260911.iso.sig ``` Download the ISO image: ``` -wget https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260908.iso +wget https://download.securityonion.net/file/securityonion/securityonion-3.3.0-20260911.iso ``` Verify the downloaded ISO image using the signature file: ``` -gpg --verify securityonion-3.3.0-20260908.iso.sig securityonion-3.3.0-20260908.iso +gpg --verify securityonion-3.3.0-20260911.iso.sig securityonion-3.3.0-20260911.iso ``` The output should show "Good signature" and the Primary key fingerprint should match what's shown below: ``` -gpg: Signature made Tue 08 Sep 2026 10:07:12 AM EDT using RSA key ID FE507013 +gpg: Signature made Fri 11 Sep 2026 11:23:56 AM EDT using RSA key ID FE507013 gpg: Good signature from "Security Onion Solutions, LLC " gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. diff --git a/HOTFIX b/HOTFIX index 8b1378917..59ed0b69b 100644 --- a/HOTFIX +++ b/HOTFIX @@ -1 +1 @@ - +20260911 diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 353158b7e..7ab6d7598 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -120,6 +120,9 @@ check_err() { 161) echo 'Required intermediate Elasticsearch upgrade not complete' ;; + 162) + echo 'One or more Elastic Agent nodes do not support the x86-64-v3 CPU instruction set' + ;; 170) echo "Intermediate upgrade completed successfully to $next_step_so_version, but next soup to Security Onion $originally_requested_so_version could not be started automatically." echo "Start soup again manually to continue the upgrade to Security Onion $originally_requested_so_version." @@ -347,6 +350,83 @@ check_cluster_health() { exit 0 } +no_soup_for_you() { + echo "" + echo "No soup for you!" + exit 162 +} + +check_cpu_compatibility() { + # Roles running a container built from the so-elastic-agent image; mirrors the + # elasticagent and elasticfleet entries in salt/reactor/pillar_push_map.yaml. + local cpu_target='G@role:so-heavynode or G@role:so-eval or G@role:so-fleet or G@role:so-import or G@role:so-manager or G@role:so-managerhype or G@role:so-managersearch or G@role:so-standalone' + local expected_nodes cpu_results node result confirm + local -a unsupported=() offline=() + + echo "Checking that Elastic Agent nodes support the x86-64-v3 CPU instruction set now required by Elastic." + + if [[ "$SKIP_CPU_CHECK" == "true" ]]; then + printf "\nSkipping the x86-64-v3 CPU check because --skip-cpu-check was specified.\n\n" + return + fi + + # Nodes that never answer are absent from the results, so diff against who should have. + expected_nodes=$(salt -C "$cpu_target" --preview-target --out=json 2>/dev/null | jq -r '.[]?') || true + if [[ -z "$expected_nodes" ]]; then + printf "\nCould not determine which nodes run the Elastic Agent, so the x86-64-v3 CPU check cannot run.\n" + no_soup_for_you + fi + + cpu_results=$(salt -t 30 -C "$cpu_target" cmd.run "/lib64/ld-linux-x86-64.so.2 --help | grep x86-64-v3" --out=json 2>/dev/null) || true + + while IFS= read -r node; do + [[ -z "$node" ]] && continue + result=$(jq -r --arg node "$node" '.[$node] // empty' <<< "$cpu_results" 2>/dev/null) + if [[ -z "$result" || "$result" == *"did not return"* ]]; then + offline+=("$node") + elif [[ "$result" != *"x86-64-v3 (supported"* ]]; then + # glibc appends "(supported, searched)" only when supported; the open paren keeps + # this from matching a future "(unsupported". + unsupported+=("$node") + fi + done <<< "$expected_nodes" + + if [[ ${#unsupported[@]} -eq 0 && ${#offline[@]} -eq 0 ]]; then + printf "\nAll Elastic Agent nodes support x86-64-v3. We can proceed with SOUP.\n\n" + return + fi + + echo "" + if [[ ${#unsupported[@]} -gt 0 ]]; then + echo "The following node(s) do NOT support the x86-64-v3 CPU instruction set:" + printf ' %s\n' "${unsupported[@]}" + echo "" + echo "Upstream Elastic now builds its binaries for x86-64-v3, so these nodes can no" + echo "longer run Elastic. Upgrading them WILL BREAK them." + echo "" + fi + if [[ ${#offline[@]} -gt 0 ]]; then + echo "The following node(s) did not respond and could not be checked:" + printf ' %s\n' "${offline[@]}" + echo "" + echo "These nodes are offline, so we cannot confirm they support x86-64-v3, which" + echo "upstream Elastic now requires." + echo "" + fi + + if [[ -n $UNATTENDED ]]; then + echo "Unattended mode cannot prompt for an override. Re-run soup interactively, or pass --skip-cpu-check to bypass this check." + no_soup_for_you + fi + + read -rp "Type 'override' to continue anyway, or press Enter to exit: " confirm + if [[ "${confirm,,}" == "override" ]]; then + printf "\nOverride accepted. Continuing at your own risk.\n\n" + else + no_soup_for_you + fi +} + check_fleet_server() { echo "Checking that Elastic Fleet Server is responding." # Modeled on the wait_for_so-elastic-fleet state check in elasticfleet/enabled.sls, @@ -1977,6 +2057,9 @@ main() { echo "Let's see if we need to update Security Onion." upgrade_check + + check_cpu_compatibility + upgrade_space echo "Verifying Elasticsearch version compatibility across the grid before upgrading." @@ -2255,6 +2338,17 @@ fi echo "### soup has been served at $(date) ###" } +SKIP_CPU_CHECK=false +declare -a SOUP_ARGS=() +for arg in "$@"; do + if [[ "$arg" == "--skip-cpu-check" ]]; then + SKIP_CPU_CHECK=true + else + SOUP_ARGS+=("$arg") + fi +done +set -- "${SOUP_ARGS[@]}" + while getopts ":b:f:y" opt; do case ${opt} in b ) @@ -2278,7 +2372,7 @@ while getopts ":b:f:y" opt; do ISOLOC="$OPTARG" ;; \? ) - echo "Usage: soup [-b] [-y] [-f ]" + echo "Usage: soup [-b] [-y] [-f ] [--skip-cpu-check]" exit 1 ;; : ) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index d0c60285f..774eb41da 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1537,7 +1537,7 @@ soc: Orchestrator: sonnet@SOAI Investigator: gemma@SOAI DetectionEngineer: gemma@SOAI - useMemory: true + useMemory: false useMemoryScanner: false dontScanBefore: "" memoryScanIntervalSeconds: 300 diff --git a/sigs/securityonion-3.3.0-20260911.iso.sig b/sigs/securityonion-3.3.0-20260911.iso.sig new file mode 100644 index 000000000..3f90eed8b Binary files /dev/null and b/sigs/securityonion-3.3.0-20260911.iso.sig differ