From e46060fadae6ef02f373c95bf68f5bfe64c8f40e Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Sat, 18 Jul 2026 03:21:00 -0400 Subject: [PATCH] docs: record Auth 0.1.5 consumer bumps + the pre-existing AngleSharp build break Closes out the security-fix rollout: mxaccessgw, ScadaBridge and HistorianGateway are all on Auth 0.1.5 and pushed. Exposure was checked per repo rather than assumed -- only mxaccessgw and ScadaBridge actually resolved the vulnerable 2.1.11; HistorianGateway already resolved 3.50.3, and OtOpcUa takes no ApiKeys/SQLite dependency at all. Also records two things worth not rediscovering: HistorianGateway's bump is unverified by tests, and both it and ScadaBridge have a pre-existing AngleSharp NU1902 error failing full-solution builds under TreatWarningsAsErrors. Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts --- README.md | 12 +++++++----- components/auth/GAPS.md | 15 ++++++++++++--- 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 5762302..036d2b5 100644 --- a/README.md +++ b/README.md @@ -64,7 +64,7 @@ Status verified 2026-07-18 against the feed + consumer branches (see [Roadmap](# | Component | Feed | Adoption | Folder | |---|---|---|---| -| Auth (login / identity / authz) | `0.1.0`–`0.1.5` | all four (pins drift `0.1.1`–`0.1.4`; `0.1.5` = security fix, unconsumed) | [`components/auth/`](components/auth/) | +| Auth (login / identity / authz) | `0.1.0`–`0.1.5` | mxaccessgw / ScadaBridge / HistorianGateway @ `0.1.5`; OtOpcUa @ `0.1.1` | [`components/auth/`](components/auth/) | | UI Theme (layout / tokens / components) | `0.2.0`–`0.3.1` | all four @ `0.3.1` | [`components/ui-theme/`](components/ui-theme/) | | Audit (event model + writer seam) | `0.1.0` | all four (DEEP) | [`components/audit/`](components/audit/) | | Config + validation | `0.1.0` | all four | [`components/configuration/`](components/configuration/) | @@ -158,8 +158,9 @@ ZB_LDAP_IT=1 dotnet test # requires a reachable GLAuth (e.g. a sister repo's i **Shipped** -- ✅ Auth normalized + `ZB.MOM.WW.Auth` built (feed: `0.1.0`–`0.1.4`) and **adopted by all four apps**. - Version pins drift on purpose: OtOpcUa `0.1.1`, ScadaBridge `0.1.3`, MxAccessGateway + HistorianGateway `0.1.4`. +- ✅ Auth normalized + `ZB.MOM.WW.Auth` built (feed: `0.1.0`–`0.1.5`) and **adopted by all four apps**. + `0.1.5` (2026-07-18) pins patched SQLitePCLRaw; **mxaccessgw, ScadaBridge and HistorianGateway bumped to it**. + OtOpcUa stays at `0.1.1` — it takes no `ApiKeys`/SQLite dependency, so it was never exposed. - ✅ UI Theme normalized + `ZB.MOM.WW.Theme` built (feed: `0.2.0`–`0.3.1`); **all four apps on `0.3.1`**. - ✅ Audit — `ZB.MOM.WW.Audit` `0.1.0` on the feed; adopted by all four (DEEP: canonical record everywhere). - ✅ Configuration — `ZB.MOM.WW.Configuration` `0.1.0` on the feed; adopted by all four. @@ -177,8 +178,9 @@ ZB_LDAP_IT=1 dotnet test # requires a reachable GLAuth (e.g. a sister repo's i **Open** - ⬜ Execute the G-7 clustered-replication plan (shared SQL-Server `ISecretStore`) — [`components/secrets/GAPS.md`](components/secrets/GAPS.md). -- ⬜ Bump the three Auth consumers to `0.1.5` to pick up the SQLitePCLRaw security fix - (mxaccessgw + HistorianGateway `0.1.4`→`0.1.5`, ScadaBridge `0.1.3`→`0.1.5`). +- ⬜ Bump the four Secrets consumers `0.1.2` → `0.1.3` (KEK rotation + the same security fix). +- ⬜ Clear the pre-existing `AngleSharp` NU1902 build break in ScadaBridge `CentralUI.Tests` + and HistorianGateway `Tests` — both fail full-solution builds under `TreatWarningsAsErrors`. - ⬜ Adopt `ZB.MOM.WW.LocalDb` in an app — no consumer references it yet. - ⬜ Give LocalDb a `components/localdb/` entry; it is the one shared lib whose design lives only in [`docs/plans/2026-07-17-localdb-design.md`](docs/plans/2026-07-17-localdb-design.md). diff --git a/components/auth/GAPS.md b/components/auth/GAPS.md index 0bd7c35..81f8ca7 100644 --- a/components/auth/GAPS.md +++ b/components/auth/GAPS.md @@ -8,9 +8,18 @@ reach the shared `ZB.MOM.WW.Auth` library. Status legend: ⛔ gap · 🟡 partia > `SQLitePCLRaw.lib.e_sqlite3 2.1.11` (GHSA-2m69-gcr7-jv3q). `0.1.5` pins the patched `2.1.12` > (same approach as `ZB.MOM.WW.LocalDb`); the `.nuspec` declares it directly, so consumers get > the fix on bump without pinning themselves. **No API change** — `0.1.5` is `0.1.4` plus the pin. -> **All three ApiKeys consumers are still on vulnerable versions** (mxaccessgw `0.1.4`, -> HistorianGateway `0.1.4`, ScadaBridge `0.1.3`) → bump to `0.1.5`. Note ScadaBridge's -> `0.1.3`→`0.1.5` jump also crosses the `0.1.4` `ExpiresUtc` verifier change. +> **All three consumers bumped to `0.1.5` the same day** (mxaccessgw `e107019`, ScadaBridge +> `50d79ed1`, HistorianGateway `df211ee` — all pushed). Exposure was verified per repo rather +> than assumed: mxaccessgw and ScadaBridge genuinely resolved the vulnerable `2.1.11` and now +> resolve `2.1.12`; **HistorianGateway was never exposed** (already resolved `3.50.3` via another +> dependency), so its bump is consistency-only. ScadaBridge's `0.1.3`→`0.1.5` jump crosses the +> `0.1.4` `ExpiresUtc` change, but that was additive — no source changes were needed and its +> suites match baseline exactly (Security 181, InboundAPI 269). **OtOpcUa stays at `0.1.1`** and +> was never exposed: it takes no `ApiKeys`/SQLite dependency. +> +> ⚠️ **Caveat:** HistorianGateway's bump could NOT be test-verified — a pre-existing, unrelated +> `AngleSharp` NU1902 error blocks its test project under `TreatWarningsAsErrors` (ScadaBridge's +> `CentralUI.Tests` has the same break). Both confirmed present on clean trees beforehand. > > **Current state (verified 2026-07-18):** feed carries `0.1.0`–`0.1.5`; consumer pins are > OtOpcUa `0.1.1`, ScadaBridge `0.1.3`, MxAccessGateway `0.1.4`, **HistorianGateway `0.1.4`**