fix false positive scan results

Merge pull request #16350 from Security-Onion-Solutions/fixsaltemudhra
Backport salt 3006.29 eMudhra/emSign CA fix into the 3006.19 onedir
2026-10-27 15:38:24 +01:00 · 2026-10-26 15:48:08 -04:00 · 2026-10-26 15:21:46 -04:00 · 2026-10-26 11:39:47 -04:00 · 2026-10-26 08:50:54 -04:00 · 2026-10-23 11:34:51 -04:00
191 changed files with 87 additions and 22 deletions
@@ -3,6 +3,31 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.

+{% set ONEDIR_PACKAGES = {'relenv': '0.22.27', 'pip': '26.2.2', 'certifi': '2026.10.19'} %}
+
+{% if grains.saltversion == '3006.19' %}
+onedir_package:
+  file.recurse:
+    - name: /opt/so/conf/salt/module_packages/onedir
+    - source: salt://salt/module_packages/onedir
+    - clean: True
+    - makedirs: True
+
+# Backport of salt 3006.29 (PR 70466): certifi 2026.10.19 and pip 26.2.2 drop the compromised
+# eMudhra/emSign root. relenv must move with pip: 0.22.2's runtime wrapper hardcodes pre-26.2 pip
+# install() signatures, so a lone pip upgrade breaks every later pip run in the onedir. Installing
+# all three in one invocation under the stock pip avoids ever being in that state.
+onedir_python_module_install:
+  cmd.run:
+    - name: /opt/saltstack/salt/bin/python3.10 -m pip install --no-index --find-links=/opt/so/conf/salt/module_packages/onedir/ --upgrade --root-user-action=ignore {% for pkg, ver in ONEDIR_PACKAGES.items() %}{{ pkg }}=={{ ver }} {% endfor %}
+    - unless: /opt/saltstack/salt/bin/python3.10 -c 'import {{ ONEDIR_PACKAGES.keys() | join(", ") }}; assert {% for pkg, ver in ONEDIR_PACKAGES.items() %}{{ pkg }}.__version__ == "{{ ver }}"{% if not loop.last %} and {% endif %}{% endfor %}'
+    - require:
+      - file: onedir_package
+    - require_in:
+      - cmd: docker_python_module_install
+    - failhard: True
+{% endif %}
+
 docker_module_package:
  file.recurse:
    - name: /opt/so/conf/salt/module_packages/docker
@@ -1,3 +1,5 @@
 requests>=2.31.0
 pyyaml>=6.0
-urllib3>=2.1.0
+urllib3>=2.1.0
+certifi>=2026.10.23
+idna>=3.20
@@ -1,2 +1,4 @@
 requests>=2.31.0
 pyyaml>=6.0
+certifi>=2026.10.23
+idna>=3.20
@@ -1,2 +1,4 @@
 requests>=2.31.0
 pyyaml>=6.0
+certifi>=2026.10.23
+idna>=3.20
@@ -1,2 +1,4 @@
 requests>=2.31.0
 pyyaml>=6.0
+certifi>=2026.10.23
+idna>=3.20
@@ -1,2 +1,4 @@
 requests>=2.31.0
 pyyaml>=6.0
+certifi>=2026.10.23
+idna>=3.20
@@ -1,2 +1,4 @@
 requests>=2.31.0
 python-whois>=0.9.5
+certifi>=2026.10.23
+idna>=3.20
@@ -1,2 +1,4 @@
 requests>=2.31.0
 pyyaml>=6.0
+certifi>=2026.10.23
+idna>=3.20
@@ -1,2 +1,4 @@
 requests>=2.31.0
 pyyaml>=6.0
+certifi>=2026.10.23
+idna>=3.20
Author	SHA1	Message	Date
Jason Ertel	aeb4e1c64c	fix false positive scan results	2026-10-26 15:48:08 -04:00
Josh Patterson	a7b4cdd813	Merge pull request #16350 from Security-Onion-Solutions/fixsaltemudhra Backport salt 3006.29 eMudhra/emSign CA fix into the 3006.19 onedir	2026-10-26 15:21:46 -04:00
Josh Patterson	a540e47672	Backport salt 3006.29 eMudhra/emSign CA fix into the 3006.19 onedir Salt 3006.29 (saltstack/salt#70466) answered the eMudhra/emSign incident by bumping certifi to 2026.10.19, which drops the "emSign ECC Root CA - G3" root whose intermediates had recoverable private keys, and by shipping pip 26.2.2, whose vendored certifi gets the same fix. We stay on 3006.19, so apply the same two upgrades inside /opt/saltstack/salt from vendored wheels. relenv is upgraded to 0.22.27 in the same pip invocation. relenv 0.22.2's runtime wrapper hardcodes pre-26.2 pip install() signatures, so a lone pip 26.2.2 upgrade breaks every later pip run with an unexpected 'script_executable' argument. 0.22.27 is what 3006.29 builds against and its runtime diff is otherwise cosmetic. Installing all three at once under the stock pip means no host ever sits in the broken intermediate state. The state lives in salt.python_modules so new installs get it from salt_install_module_deps before salt-master starts, and existing grids get it from the soup highstate plus grid push. It is gated on saltversion 3006.19 so a future Salt bump disables it, and ordered before the docker module install so docker is always installed with the fixed pip. The docker wheel set now carries certifi 2026.10.19 instead of 2024.7.4. Verified on a fresh 3.4.0 manager + sensor grid: state applies on both, reruns are no-ops, full highstate passes on both nodes.	2026-10-26 11:39:47 -04:00
Jason Ertel	6a83ea8f2f	Merge pull request #16341 from Security-Onion-Solutions/jertel/wip analyzer dep updates	2026-10-26 08:50:54 -04:00
Jason Ertel	c584675259	analyzer dep updates	2026-10-23 11:34:51 -04:00
Josh Brower	466e959340	Merge pull request #16335 from Security-Onion-Solutions/esql-default-query Refactor correlation template	2026-10-19 13:05:55 -04:00
defensivedepth	d2251d0cbc	Refactor correlation template	2026-10-19 12:55:51 -04:00
coreyogburn	78013aa5bc	Merge pull request #16333 from Security-Onion-Solutions/cogburn/automation-turn-timeout Automation Turn Timeout	2026-10-15 15:12:52 -06:00
Corey Ogburn	69b2cb2b02	Automation Turn Timeout Simplified to turnTimeoutSeconds as it sits on automationSettings and doesn't need to stutter.	2026-10-15 13:06:09 -06:00
Mike Reeves	c13085ba71	Merge pull request #16332 from Security-Onion-Solutions/TOoSmOotH-patch-6 Change readonly to readonlyUi in YAML configuration	2026-10-15 11:44:49 -04:00