dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record Auth 0.1.5 consumer bumps + the pre-existing AngleSharp build break

Browse Source 
Closes out the security-fix rollout: mxaccessgw, ScadaBridge and HistorianGateway
are all on Auth 0.1.5 and pushed. Exposure was checked per repo rather than assumed --
only mxaccessgw and ScadaBridge actually resolved the vulnerable 2.1.11;
HistorianGateway already resolved 3.50.3, and OtOpcUa takes no ApiKeys/SQLite
dependency at all.

Also records two things worth not rediscovering: HistorianGateway's bump is
unverified by tests, and both it and ScadaBridge have a pre-existing AngleSharp
NU1902 error failing full-solution builds under TreatWarningsAsErrors.

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts
This commit is contained in:
Joseph Doherty
2026-07-18 03:21:00 -04:00
parent 5e9cbd3ecf
commit e46060fada
2 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+7 -5
View File
@@ -64,7 +64,7 @@ Status verified 2026-07-18 against the feed + consumer branches (see [Roadmap](#
| Component | Feed | Adoption | Folder |
|---|---|---|---|
| Auth (login / identity / authz) | `0.1.0`–`0.1.5` | all four (pins drift `0.1.1`–`0.1.4`; `0.1.5` = security fix, unconsumed) | [`components/auth/`](components/auth/) |
| Auth (login / identity / authz) | `0.1.0`–`0.1.5` | mxaccessgw / ScadaBridge / HistorianGateway @ `0.1.5`; OtOpcUa @ `0.1.1` | [`components/auth/`](components/auth/) |
| UI Theme (layout / tokens / components) | `0.2.0`–`0.3.1` | all four @ `0.3.1` | [`components/ui-theme/`](components/ui-theme/) |
| Audit (event model + writer seam) | `0.1.0` | all four (DEEP) | [`components/audit/`](components/audit/) |
| Config + validation | `0.1.0` | all four | [`components/configuration/`](components/configuration/) |
@@ -158,8 +158,9 @@ ZB_LDAP_IT=1 dotnet test # requires a reachable GLAuth (e.g. a sister repo's i
**Shipped**
- ✅ Auth normalized + `ZB.MOM.WW.Auth` built (feed: `0.1.0`–`0.1.4`) and **adopted by all four apps**.
Version pins drift on purpose: OtOpcUa `0.1.1`, ScadaBridge `0.1.3`, MxAccessGateway + HistorianGateway `0.1.4`.
- ✅ Auth normalized + `ZB.MOM.WW.Auth` built (feed: `0.1.0`–`0.1.5`) and **adopted by all four apps**.
`0.1.5` (2026-07-18) pins patched SQLitePCLRaw; **mxaccessgw, ScadaBridge and HistorianGateway bumped to it**.
OtOpcUa stays at `0.1.1` — it takes no `ApiKeys`/SQLite dependency, so it was never exposed.
- ✅ UI Theme normalized + `ZB.MOM.WW.Theme` built (feed: `0.2.0`–`0.3.1`); **all four apps on `0.3.1`**.
- ✅ Audit — `ZB.MOM.WW.Audit` `0.1.0` on the feed; adopted by all four (DEEP: canonical record everywhere).
- ✅ Configuration — `ZB.MOM.WW.Configuration` `0.1.0` on the feed; adopted by all four.
@@ -177,8 +178,9 @@ ZB_LDAP_IT=1 dotnet test # requires a reachable GLAuth (e.g. a sister repo's i
**Open**
- ⬜ Execute the G-7 clustered-replication plan (shared SQL-Server `ISecretStore`) — [`components/secrets/GAPS.md`](components/secrets/GAPS.md).
- ⬜ Bump the three Auth consumers to `0.1.5` to pick up the SQLitePCLRaw security fix
(mxaccessgw + HistorianGateway `0.1.4`→`0.1.5`, ScadaBridge `0.1.3`→`0.1.5`).
- ⬜ Bump the four Secrets consumers `0.1.2` → `0.1.3` (KEK rotation + the same security fix).
- ⬜ Clear the pre-existing `AngleSharp` NU1902 build break in ScadaBridge `CentralUI.Tests`
and HistorianGateway `Tests` — both fail full-solution builds under `TreatWarningsAsErrors`.
- ⬜ Adopt `ZB.MOM.WW.LocalDb` in an app — no consumer references it yet.
- ⬜ Give LocalDb a `components/localdb/` entry; it is the one shared lib whose design lives only in
[`docs/plans/2026-07-17-localdb-design.md`](docs/plans/2026-07-17-localdb-design.md).
components/auth/GAPS.md
+12 -3
View File
@@ -8,9 +8,18 @@ reach the shared `ZB.MOM.WW.Auth` library. Status legend: ⛔ gap · 🟡 partia
> `SQLitePCLRaw.lib.e_sqlite3 2.1.11` (GHSA-2m69-gcr7-jv3q). `0.1.5` pins the patched `2.1.12`
> (same approach as `ZB.MOM.WW.LocalDb`); the `.nuspec` declares it directly, so consumers get
> the fix on bump without pinning themselves. **No API change** — `0.1.5` is `0.1.4` plus the pin.
> **All three ApiKeys consumers are still on vulnerable versions** (mxaccessgw `0.1.4`,
> HistorianGateway `0.1.4`, ScadaBridge `0.1.3`) → bump to `0.1.5`. Note ScadaBridge's
> `0.1.3`→`0.1.5` jump also crosses the `0.1.4` `ExpiresUtc` verifier change.
> **All three consumers bumped to `0.1.5` the same day** (mxaccessgw `e107019`, ScadaBridge
> `50d79ed1`, HistorianGateway `df211ee` — all pushed). Exposure was verified per repo rather
> than assumed: mxaccessgw and ScadaBridge genuinely resolved the vulnerable `2.1.11` and now
> resolve `2.1.12`; **HistorianGateway was never exposed** (already resolved `3.50.3` via another
> dependency), so its bump is consistency-only. ScadaBridge's `0.1.3`→`0.1.5` jump crosses the
> `0.1.4` `ExpiresUtc` change, but that was additive — no source changes were needed and its
> suites match baseline exactly (Security 181, InboundAPI 269). **OtOpcUa stays at `0.1.1`** and
> was never exposed: it takes no `ApiKeys`/SQLite dependency.
>
> ⚠️ **Caveat:** HistorianGateway's bump could NOT be test-verified — a pre-existing, unrelated
> `AngleSharp` NU1902 error blocks its test project under `TreatWarningsAsErrors` (ScadaBridge's
> `CentralUI.Tests` has the same break). Both confirmed present on clean trees beforehand.
>
> **Current state (verified 2026-07-18):** feed carries `0.1.0`–`0.1.5`; consumer pins are
> OtOpcUa `0.1.1`, ScadaBridge `0.1.3`, MxAccessGateway `0.1.4`, **HistorianGateway `0.1.4`**