dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(audit): hash-chain tamper evidence shipped, default off (ScadaBridge#41)

Browse Source 
Component-AuditLog Security & Tamper-Evidence describes the per-month chain,
the chaining job and its lock, both purge paths (checkpoint anchor,
tombstones), pre-existing rows, verification and what an unsigned chain does
not prove. alog.md §11.4/§16, CLAUDE.md, HighLevelReqs AL-11/12,
Component-CLI, Component-ManagementService, docs/components/CLI.md and the
CLI README drop the "no-op placeholder" wording.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
This commit is contained in:
Joseph Doherty
2026-11-09 16:28:54 -05:00
parent 548bb9a725
commit dd99a9f5a5
8 changed files with 109 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ZB.MOM.WW.ScadaBridge.CLI/README.md
+17 -6
View File
@@ -2050,13 +2050,24 @@ scadabridge --url <url> audit verify-chain --month <YYYY-MM>
| Option | Required | Default | Description |
|--------|----------|---------|-------------|
| `--month` | yes | — | Month to verify, `YYYY-MM` (e.g. `2026-05`) |
| `--month` | yes | — | UTC calendar month to verify, `YYYY-MM` (e.g. `2026-05`) |
> **v1 no-op.** Hash-chain tamper-evidence is not enabled in this release (T1
> deferred to v1.x). The subcommand validates the `--month` argument and prints a
> notice pointing at the v1.x roadmap in `Component-AuditLog.md`; it exits `0`
> without contacting the server. The command exists now so scripts and operator
> habits do not need to change when tamper-evidence ships.
Sends the `VerifyAuditChain` management command (ScadaBridge#41). The server
recomputes every link of that month's AuditLog hash chain and reports the first
break, if any: partition, `ChainSeq`, `EventId` and kind (`HashMismatch` = edited or
reordered row, `MissingRow` = deleted row, `HeadMismatch` = rows deleted from the
end, `DuplicateSequence`, `IncompleteLink`). `--format table` prints a summary;
`json` prints the result object.
| Exit code | Meaning |
|-----------|---------|
| `0` | `Intact`, or `NotChained` (nothing chained for that month yet) |
| `3` | `Broken` — tamper evidence; see `firstBreak` |
| `1` | Request error (bad month, `CHAIN_BUSY`, server error) |
| `2` | Authorization failure (needs `Administrator` or `Viewer`, not site-scoped) |
The chain only exists once `AuditLog:HashChain:Enabled` is on for the central nodes
(default off); see `Component-AuditLog.md`, Security & Tamper-Evidence.
---