oracle 10 testing

Hotfix/3.1.0

DOWNLOAD_AND_VERIFY_ISO.md

@@ -1,17 +1,17 @@
-### 3.1.0-20260521 ISO image released on 2026/05/21
+### 3.1.0-20260528 ISO image released on 2026/05/28
 
 
 ### Download and Verify
 
-3.1.0-20260521 ISO image:  
-https://download.securityonion.net/file/securityonion/securityonion-3.1.0-20260521.iso
+3.1.0-20260528 ISO image:  
+https://download.securityonion.net/file/securityonion/securityonion-3.1.0-20260528.iso
  
-MD5: A853BC118639ABCE1795D6E313BFFBDE  
-SHA1: FCA615AD6E31710B33AE5870FEF447861FDB3B8F  
-SHA256: CE2A5947274D9ED2C5068A1FD46B64C4FEF70445EA9B61A98DD3621781329F2C  
+MD5: 9D6FF58DEEE24089D722C73169765B3E  
+SHA1: 2B8B816B6CEC3B7F96B3C5E040EBF502DD2C412F  
+SHA256: 62FAB57E247C843D6A04F0796D8162C732B65D82FC3E4A59D087135B9FD32912  
 
 Signature for ISO image:  
-https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.1.0-20260521.iso.sig
+https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.1.0-20260528.iso.sig
 
 Signing key:  
 https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/main/KEYS  
@@ -25,22 +25,22 @@ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/3/
 
 Download the signature file for the ISO:  
 ```
-wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.1.0-20260521.iso.sig
+wget https://github.com/Security-Onion-Solutions/securityonion/raw/3/main/sigs/securityonion-3.1.0-20260528.iso.sig
 ```
 
 Download the ISO image:  
 ```
-wget https://download.securityonion.net/file/securityonion/securityonion-3.1.0-20260521.iso
+wget https://download.securityonion.net/file/securityonion/securityonion-3.1.0-20260528.iso
 ```
 
 Verify the downloaded ISO image using the signature file:  
 ```
-gpg --verify securityonion-3.1.0-20260521.iso.sig securityonion-3.1.0-20260521.iso
+gpg --verify securityonion-3.1.0-20260528.iso.sig securityonion-3.1.0-20260528.iso
 ```
 
 The output should show "Good signature" and the Primary key fingerprint should match what's shown below:
 ```
-gpg: Signature made Thu 21 May 2026 11:10:01 AM EDT using RSA key ID FE507013
+gpg: Signature made Wed 27 May 2026 03:03:59 PM EDT using RSA key ID FE507013
 gpg: Good signature from "Security Onion Solutions, LLC <info@securityonionsolutions.com>"
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.

HOTFIX

@@ -0,0 +1 @@
+20260528

salt/common/packages.sls

@@ -26,14 +26,33 @@ commonpkgs:
       - net-tools
       - nmap-ncat
       - procps-ng
+{# OL10 test path: python3-docker / python3-m2crypto are not packaged in EPEL 10 and are not
+   referenced by SO code (salt uses its bundled docker module from salt/python_modules.sls).
+   python3-rich is also unavailable on EL10 (its pygments dep is not packaged), so it is
+   installed via pip below. Gate on the grain because GLOBALS/pillars are not available this
+   early (see header note). #}
+{% if grains['osmajorrelease']|int < 10 %}
       - python3-docker
       - python3-m2crypto
+      - python3-rich
+{% else %}
+      - python3-pip
+{% endif %}
       - python3-packaging
       - python3-pyyaml
-      - python3-rich
       - rsync
       - sqlite
       - tcpdump
       - unzip
       - wget
       - yum-utils
+
+{% if grains['osmajorrelease']|int >= 10 %}
+# OL10 test path: rich is not packaged for EL10; install it into the system python3 for so-status.
+commonpkgs_pip_rich:
+  cmd.run:
+    - name: python3 -m pip install rich
+    - unless: python3 -c "import rich"
+    - require:
+      - pkg: commonpkgs
+{% endif %}

salt/common/tools/sbin/so-common

@@ -354,7 +354,12 @@ gpg_rpm_import() {
 	else
 		local RPMKEYSLOC="$UPDATE_DIR/salt/repo/client/files/$OS/keys"
 	fi
-	RPMKEYS=('RPM-GPG-KEY-oracle' 'RPM-GPG-KEY-EPEL-9' 'SALT-PROJECT-GPG-PUBKEY-2023.pub' 'docker.pub' 'securityonion.pub')
+	if [[ "$OSVER" == "10" ]]; then
+		# OL10 test path uses public repos; the public oracle-epel-release and docker repos provide their own keys
+		RPMKEYS=('RPM-GPG-KEY-oracle' 'SALT-PROJECT-GPG-PUBKEY-2023.pub')
+	else
+		RPMKEYS=('RPM-GPG-KEY-oracle' 'RPM-GPG-KEY-EPEL-9' 'SALT-PROJECT-GPG-PUBKEY-2023.pub' 'docker.pub' 'securityonion.pub')
+	fi
 	for RPMKEY in "${RPMKEYS[@]}"; do
 		rpm --import $RPMKEYSLOC/$RPMKEY
 		echo "Imported $RPMKEY"
@@ -626,9 +631,9 @@ salt_minion_count() {
 }
 
 set_os() {
-	if [ -f /etc/redhat-release ] && grep -q "Red Hat Enterprise Linux release 9" /etc/redhat-release && [ -f /etc/oracle-release ]; then
+	if [ -f /etc/oracle-release ] && grep -qE "release (9|10)\b" /etc/oracle-release; then
 		OS=oracle
-		OSVER=9
+		OSVER=$(grep -oE "release [0-9]+" /etc/oracle-release | grep -oE "[0-9]+")
 		is_oracle=true
 		is_rpm=true
 	fi

salt/common/tools/sbin/so-image-common

@@ -112,8 +112,23 @@ update_docker_containers() {
   # does not include so-elastic-fleet since that container uses so-elastic-agent image
   local IMAGES_USING_ES_VERSION=("so-elasticsearch")
 
-  rm -rf $SIGNPATH >> "$LOG_FILE" 2>&1 
-  mkdir -p $SIGNPATH >> "$LOG_FILE" 2>&1 
+  rm -rf $SIGNPATH >> "$LOG_FILE" 2>&1
+  mkdir -p $SIGNPATH >> "$LOG_FILE" 2>&1
+
+  # OL10 test path: GnuPG 2.4 enables the keybox daemon (keyboxd) by default, which deadlocks
+  # under the rapid sequential gpg --verify calls below ("waiting for lock ... keydb_search
+  # failed: Connection timed out ... No public key"). Editing the default homedir's common.conf
+  # is unreliable (gpg re-adds use-keyboxd when it re-initializes the homedir), so run all the
+  # image-signature gpg ops in a dedicated homedir whose pre-written common.conf leaves keyboxd
+  # off, forcing the classic keybox. Isolated from the system keyring and deterministic.
+  if [ "$OSVER" = "10" ]; then
+    export GNUPGHOME="$SIGNPATH/gnupg"
+    rm -rf "$GNUPGHOME" >> "$LOG_FILE" 2>&1
+    mkdir -p "$GNUPGHOME" >> "$LOG_FILE" 2>&1
+    chmod 700 "$GNUPGHOME"
+    echo "# keyboxd disabled for SO image signature verification on EL10" > "$GNUPGHOME/common.conf"
+    gpgconf --kill keyboxd gpg-agent >> "$LOG_FILE" 2>&1 || true
+  fi
 
   # Let's make sure we have the public key
   run_check_net_err \

salt/docker/init.sls

@@ -18,10 +18,18 @@ dockergroup:
 dockerheldpackages:
   pkg.installed:
     - pkgs:
+{% if GLOBALS.os_version|int >= 10 %}
+      # OL10 test path: install latest Docker CE from the public repo (no .el9 builds available)
+      - containerd.io
+      - docker-ce
+      - docker-ce-cli
+      - docker-ce-rootless-extras
+{% else %}
       - containerd.io: 2.2.1-1.el9
       - docker-ce: 3:29.2.1-1.el9
       - docker-ce-cli: 1:29.2.1-1.el9
       - docker-ce-rootless-extras: 29.2.1-1.el9
+{% endif %}
     - hold: True
     - update_holds: True
 

salt/manager/tools/sbin/soup

@@ -533,6 +533,23 @@ elasticfleet_set_agent_logging_level_warn() {
     done <<< "$policies_to_update"
 }
 
+update_logstash_pipeline_name() {
+    local original_pipeline_name="$1"
+    local new_pipeline_name="$2"
+
+    echo "Checking for conflicting logstash defined_pipelines pillar value."
+    local LOGSTASH_FILE=/opt/so/saltstack/local/pillar/logstash/soc_logstash.sls
+    local MINIONDIR=/opt/so/saltstack/local/pillar/minions
+    for pillar_file in "$LOGSTASH_FILE" "$MINIONDIR"/*.sls; do
+        [[ -f "$pillar_file" ]] || continue
+        if grep -q "$original_pipeline_name$" "$pillar_file"; then
+            echo "Found conflicting defined_pipeline pillar value in $pillar_file. Updating to use the new logstash pipeline name."
+            sed -i "s#$original_pipeline_name\$#$new_pipeline_name#g" "$pillar_file"
+            chown socore:socore "$pillar_file"
+        fi
+    done
+}
+
 check_transform_health_and_reauthorize() {
     . /usr/sbin/so-elastic-fleet-common
 
@@ -676,6 +693,10 @@ rename_strelka_scan_lnk() {
   rm -f "$TMP_VALUE_FILE"
 }
 
+fix_logstash_0013_lumberjack_pipeline_name() {
+    update_logstash_pipeline_name "so/0013_input_lumberjack_fleet.conf" "so/0013_input_lumberjack_fleet.conf.jinja"
+}
+
 up_to_3.1.0() {
   ensure_postgres_local_pillar
   ensure_postgres_secret
@@ -684,6 +705,7 @@ up_to_3.1.0() {
   # Clear existing component template state file.
   rm -f /opt/so/state/esfleet_component_templates.json
   rename_strelka_scan_lnk
+  fix_logstash_0013_lumberjack_pipeline_name
 
   INSTALLEDVERSION=3.1.0
 }
@@ -1139,7 +1161,7 @@ verify_es_version_compatibility() {
 
             while IFS= read -r heavynode_minion; do
                 [[ -z "$heavynode_minion" ]] && continue
-                if ! echo "$HEAVYNODE_ES_VERSIONS" | jq -e --arg minion "$heavynode_minion" 'has($minion)' > /dev/null; then
+                if ! echo "$HEAVYNODE_ES_VERSIONS" | jq -se --arg minion "$heavynode_minion" 'add | has($minion)' > /dev/null; then
                     echo "Heavynode $heavynode_minion did not report an Elasticsearch version. It may be offline or still upgrading."
                     all_heavynodes_compatible=false
                 fi
@@ -1506,7 +1528,13 @@ EOF
 
 # Keeping this block in case we need to do a hotfix that requires salt update
 apply_hotfix() {
-   echo "No actions required. ($INSTALLEDVERSION/$HOTFIXVERSION)"
+    if [[ "$INSTALLEDVERSION" == "3.1.0" ]] ; then
+       # Do not remove this fix_logstash_0013_lumberjack_pipeline_name in future hotfixes without first validating older
+       #  installs referencing "so/0013_input_lumberjack_fleet.conf" via pillar are upgradable
+       fix_logstash_0013_lumberjack_pipeline_name
+    else
+        echo "No actions required. ($INSTALLEDVERSION/$HOTFIXVERSION)"
+    fi
 }
 
 failed_soup_restore_items() {

salt/repo/client/init.sls

@@ -1,5 +1,6 @@
 {% from 'vars/globals.map.jinja' import GLOBALS %}
-{% if GLOBALS.os == 'OEL' %}
+{# OL10 test path uses public repos; skip the SO repo state (which removes public repos and points at /nsm/repo) #}
+{% if GLOBALS.os == 'OEL' and GLOBALS.os_version|int == 9 %}
 include:
   - repo.client.oracle
 {% endif %}

salt/vars/globals.map.jinja

@@ -31,6 +31,7 @@
     'so_model': INIT.GRAINS.get('sosmodel',''),
     'sensoroni_key': INIT.PILLAR.sensoroni.config.sensoronikey,
     'os': INIT.GRAINS.os,
+    'os_version': INIT.GRAINS.osmajorrelease,
     'os_family': INIT.GRAINS.os_family,
     'application_urls': {},
     'manager_roles': [

setup/so-functions

@@ -903,14 +903,14 @@ detect_cloud() {
 
 detect_os() {
 	title "Detecting Base OS"
-	if [ -f /etc/redhat-release ] && grep -q "Red Hat Enterprise Linux release 9" /etc/redhat-release && [ -f /etc/oracle-release ]; then
+	if [ -f /etc/oracle-release ] && grep -qE "release (9|10)\b" /etc/oracle-release; then
 		OS=oracle
-		OSVER=9
+		OSVER=$(grep -oE "release [0-9]+" /etc/oracle-release | grep -oE "[0-9]+")
 		is_oracle=true
 		is_rpm=true
 		is_supported=true
 	else
-		info "This OS is not supported. Security Onion requires Oracle Linux 9."
+		info "This OS is not supported. Security Onion requires Oracle Linux 9 or 10."
 		fail_setup
 	fi
 
@@ -1783,6 +1783,15 @@ ensure_pyyaml() {
 # - securityonion/salt/salt/minion.defaults.yaml
 
 securityonion_repo() {
+	if [[ "$OSVER" == "10" ]]; then
+		# TEST PATH: Oracle Linux 10 uses the public OL10 + EPEL + Docker CE repos.
+		# Keep the stock /etc/yum.repos.d/* in place, skip the SO mirror and local reposync.
+		gpg_rpm_import
+		logCmd "dnf -y install oracle-epel-release-el10"
+		logCmd "dnf -y config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo"
+		logCmd "dnf repolist"
+		return
+	fi
 	# Remove all the current repos
 	logCmd "dnf -v clean all"
 	logCmd "mkdir -vp /root/oldrepos"
@@ -1877,12 +1886,19 @@ saltify() {
 	info "Installing Salt $SALTVERSION"
 	chmod u+x ../salt/salt/scripts/bootstrap-salt.sh
 
+	# Normally Salt packages come from the SO mirror, so -r disables the bootstrap's own repo setup.
+	# On the OL10 test path there is no SO mirror, so let bootstrap configure the public Salt repo.
+	local saltrepoflag="-r"
+	if [[ "$OSVER" == "10" ]]; then
+		saltrepoflag=""
+	fi
+
 	if [[ $waitforstate ]]; then
 		# install all for a manager
-		retry 30 10 "bash ../salt/salt/scripts/bootstrap-salt.sh -r -M -X stable $SALTVERSION" || fail_setup
+		retry 30 10 "bash ../salt/salt/scripts/bootstrap-salt.sh $saltrepoflag -M -X stable $SALTVERSION" || fail_setup
 	else
 		# just a minion
-		retry 30 10 "bash ../salt/salt/scripts/bootstrap-salt.sh -r -X stable $SALTVERSION" || fail_setup
+		retry 30 10 "bash ../salt/salt/scripts/bootstrap-salt.sh $saltrepoflag -X stable $SALTVERSION" || fail_setup
 	fi
 
 	salt_install_module_deps