Skip to content

Commit 32949d8

Browse files
mearvkmearvk
committed
Science Commit 5.
1 parent c8926e6 commit 32949d8

9 files changed

Lines changed: 497 additions & 105 deletions

File tree

‎configuration/nwe-config.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -655,10 +655,16 @@
655655
<tech-id>Gifted Install Tech ID</tech-id>
656656
<digest-algorithms>SHA-256,MD5</digest-algorithms>
657657
<digest-db>integrity/digest.db</digest-db>
658+
<self-integrity-db>integrity/self.sha256</self-integrity-db>
658659
<concerns-dir>integrity/concerns</concerns-dir>
660+
<history-dir>integrity/history</history-dir>
659661
<database>nwe_integrity</database>
660662
<schema>integrity/integrity-schema.sql</schema>
661663
<blocking>false</blocking>
664+
<restore-on-fail>true</restore-on-fail>
665+
<preserve-originals>true</preserve-originals>
666+
<honor-oath-table>honor_oath</honor-oath-table>
667+
<read-only-tables>file_digests,integrity_concerns,file_digests_history</read-only-tables>
662668
<trusted-servers>
663669
<server name="mearvk" url="https://github.com/mearvk/Java.Web.Server.Telnet.Front.Java.21" branch="main"/>
664670
<server name="ElisabethHarkins5509" url="https://github.com/ElisabethHarkins5509" branch="main"/>

‎cron/README.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Cron — Noble Registry
2+
3+
Reliable cron services for NitroWebExpress™ — a Noble Mear before Noble Ministries.
4+
5+
## Install
6+
7+
```bash
8+
sudo bash cron/install-cron.sh
9+
```
10+
11+
Installs to `/etc/cron.d/nwe-mearvk`. Logs to `/var/log/nwe/`.
12+
13+
## Schedule
14+
15+
| Job | Schedule | Script | Purpose |
16+
|-----|----------|--------|---------|
17+
| AE6E66-Crawl | `0 3 1 * *` | `cron/install-cron.sh` | Monthly HOL/HOC crawl |
18+
| GitHubPullNewer | `0 4 * * *` | `scripts/github/pull-newer-only.sh` | Daily pull newer files only |
19+
| SignalHealth | `*/15 * * * *` | `cron/signal-health.sh` | Signal server liveness |
20+
| PostfixFlush | `*/30 * * * *` | `/usr/sbin/postqueue -f` | Flush mail queue |
21+
| MySQLBackup | `0 2 * * *` | `cron/mysql-backup.sh` | Daily DB backup (14-day retention) |
22+
| StrernaryLiveness | `*/5 * * * *` | `cron/strernary-liveness.sh` | Strernary™ port 20000 check |
23+
| GrayLeaseCheck | `0 * * * *` | `cron/gray-lease-check.sh` | Port registry lease expiry |
24+
| CryptoVerify | `0 */48 * * *` | `cron/crypto-verify.sh` | Binary integrity (BTC/Dash/LTC/Star) |
25+
| IntegrityCheck | `0 6 */2 * *` | `cron/integrity-check.sh` | SHA-256 file integrity vs GitHub |
26+
27+
## Noble Registry Configuration
28+
29+
In `configuration/nwe-config.xml` under `<noble-registry>`:
30+
- **Enabled:** true (default)
31+
- **Reset interval:** 48 hours (noble 2rways days)
32+
- **Shutdown concern:** Saves brothers' state before termination (`cron/.noble-state`)
33+
34+
## Shutdown Concern
35+
36+
On shutdown (`scripts/bash/Shutdown.sh`), `cron/save-noble-state.sh` runs first:
37+
- Records last-run timestamps for all jobs
38+
- Captures port liveness status
39+
- Saves postfix queue count
40+
- State preserved to `cron/.noble-state`
41+
42+
## Scripts
43+
44+
| Script | Purpose |
45+
|--------|---------|
46+
| `install-cron.sh` | Install all cron jobs to system |
47+
| `signal-health.sh` | Probe signal server ports |
48+
| `strernary-liveness.sh` | Probe Strernary™ port 20000 |
49+
| `mysql-backup.sh` | Backup all NWE databases |
50+
| `gray-lease-check.sh` | Check Gray port registries |
51+
| `crypto-verify.sh` | SHA-256 verify crypto binaries |
52+
| `integrity-check.sh` | File integrity wrapper |
53+
| `save-noble-state.sh` | Shutdown state preservation |

‎integrity/README.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Integrity System
2+
3+
Post-install SHA-256 file integrity verification with auto-restore.
4+
5+
## Gifted Install Tech ID
6+
7+
This system operates under the **Gifted Install Tech ID** designation — not the Max Rupplin MEARVK LLC Installer Tech ID. It verifies software integrity against trusted GitHub commits and restores corrupted files automatically.
8+
9+
## How It Works
10+
11+
1. **Cron runs every 2 days** (`0 6 */2 * *`) via `cron/integrity-check.sh`
12+
2. **Self-integrity first** — verifies its own scripts haven't been tampered with
13+
3. **Full scan** — SHA-256 + MD5 for all git-tracked files
14+
4. **Compare** — checks digests against stored database (same commit = must match)
15+
5. **On corruption** — fetches original from trusted repo, restores, backs up corrupted file
16+
6. **On software update** — preserves previous digests in `integrity/history/`
17+
7. **Non-blocking** — program continues running; concerns logged to `integrity/concerns/`
18+
19+
## Files
20+
21+
| File | Purpose |
22+
|------|---------|
23+
| `post-install-integrity-check.sh` | Main integrity script |
24+
| `integrity-schema.sql` | MySQL schema (`nwe_integrity` database) |
25+
| `digest.db` | Current file digests (auto-generated) |
26+
| `self.sha256` | SHA-256 of integrity scripts themselves |
27+
| `concerns/` | Concern files (timestamped, non-blocking) |
28+
| `history/` | Preserved original digests on update |
29+
30+
## Database (`nwe_integrity`)
31+
32+
| Table | Purpose | Permissions |
33+
|-------|---------|-------------|
34+
| `honor_oath` | Locks integrity system — swears honor to process and country | Read-only |
35+
| `file_digests` | SHA-256/MD5 for all tracked files | SELECT, INSERT, limited UPDATE |
36+
| `file_digests_history` | Preserved originals (append-only) | SELECT, INSERT only |
37+
| `self_integrity` | SHA-256 of integrity scripts | SELECT, INSERT only |
38+
| `integrity_concerns` | Logged concerns (append-only) | SELECT, INSERT only |
39+
| `scan_history` | Scan results and stats | SELECT, INSERT only |
40+
41+
**No DELETE granted on any table. No UPDATE on history or concerns.**
42+
43+
## Trusted Servers
44+
45+
- `github.com/mearvk/Java.Web.Server.Telnet.Front.Java.21` (primary)
46+
- `github.com/ElisabethHarkins5509` (secondary)
47+
48+
## Restore Behavior
49+
50+
- Same commit + different hash = **corruption** → auto-restore from trusted repo
51+
- Different commit + different hash = **update** → preserve original, update digest
52+
- Self-integrity fail → restore integrity scripts first, then continue scan
53+
54+
## Install
55+
56+
```bash
57+
# Create database
58+
mysql < integrity/integrity-schema.sql
59+
60+
# Run first scan (creates digest.db)
61+
bash integrity/post-install-integrity-check.sh
62+
63+
# Install cron (includes integrity check)
64+
sudo bash cron/install-cron.sh
65+
```
66+
67+
## Configuration
68+
69+
Configured in `configuration/nwe-config.xml` under `<integrity>`:
70+
- `enabled`: true
71+
- `restore-on-fail`: true
72+
- `preserve-originals`: true
73+
- `blocking`: false
74+
- `honor-oath-table`: honor_oath

‎integrity/integrity-schema.sql‎

Lines changed: 64 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,86 @@
11
-- integrity/integrity-schema.sql
2-
-- SHA-256/MD5 File Integrity Database
2+
-- SHA-256 File Integrity Database
33
-- Gifted Install Tech ID
4-
-- Security principles: immutable audit log, no deletes, timestamped
4+
--
5+
-- Security: read-only digest table locked by honor_oath table.
6+
-- Originals preserved on update. Self-integrity stored in DB.
57

68
CREATE DATABASE IF NOT EXISTS nwe_integrity
79
CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
810

911
USE nwe_integrity;
1012

11-
-- File digest records (append-only)
13+
-- Honor oath — locks the integrity tables. Must be intact for digests to be trusted.
14+
-- Swears honor to process and country.
15+
CREATE TABLE IF NOT EXISTS honor_oath (
16+
id INT PRIMARY KEY DEFAULT 1,
17+
oath TEXT NOT NULL DEFAULT 'I swear honor to process and country. This integrity system serves truth, transparency, and the preservation of trusted software.',
18+
oath_sha256 CHAR(64) NOT NULL,
19+
created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
20+
sworn_by VARCHAR(100) NOT NULL DEFAULT 'Gifted Install Tech ID',
21+
country VARCHAR(50) NOT NULL DEFAULT 'United States of America',
22+
CONSTRAINT single_oath CHECK (id = 1)
23+
) ENGINE=InnoDB;
24+
25+
-- Insert the oath (SHA-256 of the oath text itself)
26+
INSERT IGNORE INTO honor_oath (id, oath, oath_sha256, sworn_by) VALUES (
27+
1,
28+
'I swear honor to process and country. This integrity system serves truth, transparency, and the preservation of trusted software.',
29+
SHA2('I swear honor to process and country. This integrity system serves truth, transparency, and the preservation of trusted software.', 256),
30+
'Gifted Install Tech ID'
31+
);
32+
33+
-- File digests — the main integrity table (read-only by application)
34+
-- Updates allowed but originals preserved in file_digests_history
1235
CREATE TABLE IF NOT EXISTS file_digests (
1336
id BIGINT AUTO_INCREMENT PRIMARY KEY,
1437
file_path VARCHAR(512) NOT NULL,
1538
sha256 CHAR(64) NOT NULL,
1639
md5 CHAR(32) NOT NULL,
1740
size_bytes BIGINT NOT NULL,
18-
mtime_epoch BIGINT NOT NULL,
41+
commit_sha CHAR(40) NOT NULL,
42+
trusted_repo VARCHAR(255) NOT NULL,
43+
branch VARCHAR(100) NOT NULL DEFAULT 'main',
1944
scan_timestamp TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
20-
commit_sha CHAR(40),
21-
trusted_repo VARCHAR(255),
22-
match_status ENUM('MATCH', 'MISMATCH', 'UNVERIFIED') NOT NULL DEFAULT 'UNVERIFIED',
23-
INDEX idx_file_path (file_path),
24-
INDEX idx_scan_ts (scan_timestamp),
45+
match_status ENUM('MATCH', 'MISMATCH', 'RESTORED', 'UPDATED') NOT NULL DEFAULT 'MATCH',
46+
UNIQUE KEY uk_file_commit (file_path, commit_sha),
2547
INDEX idx_status (match_status)
2648
) ENGINE=InnoDB;
2749

28-
-- Concerns log (immutable — no UPDATE/DELETE granted)
50+
-- History — originals preserved here on update (append-only, no delete)
51+
CREATE TABLE IF NOT EXISTS file_digests_history (
52+
id BIGINT AUTO_INCREMENT PRIMARY KEY,
53+
original_id BIGINT NOT NULL,
54+
file_path VARCHAR(512) NOT NULL,
55+
sha256 CHAR(64) NOT NULL,
56+
md5 CHAR(32) NOT NULL,
57+
commit_sha CHAR(40) NOT NULL,
58+
archived_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
59+
reason ENUM('UPDATE', 'RESTORE', 'SUPERSEDED') NOT NULL,
60+
INDEX idx_file (file_path),
61+
INDEX idx_archived (archived_at)
62+
) ENGINE=InnoDB;
63+
64+
-- Self-integrity: SHA-256 of the integrity scripts themselves
65+
CREATE TABLE IF NOT EXISTS self_integrity (
66+
id BIGINT AUTO_INCREMENT PRIMARY KEY,
67+
script_path VARCHAR(512) NOT NULL,
68+
sha256 CHAR(64) NOT NULL,
69+
commit_sha CHAR(40) NOT NULL,
70+
recorded_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
71+
UNIQUE KEY uk_script (script_path)
72+
) ENGINE=InnoDB;
73+
74+
-- Concerns log (append-only)
2975
CREATE TABLE IF NOT EXISTS integrity_concerns (
3076
id BIGINT AUTO_INCREMENT PRIMARY KEY,
3177
concern_time TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
3278
file_path VARCHAR(512) NOT NULL,
33-
local_sha256 CHAR(64),
34-
remote_sha CHAR(40),
79+
expected_sha256 CHAR(64),
80+
actual_sha256 CHAR(64),
3581
commit_sha CHAR(40),
36-
trusted_repo VARCHAR(255),
37-
severity ENUM('INFO', 'WARN', 'CRITICAL') NOT NULL DEFAULT 'WARN',
38-
resolved BOOLEAN NOT NULL DEFAULT FALSE,
39-
INDEX idx_concern_time (concern_time),
40-
INDEX idx_severity (severity)
82+
action_taken ENUM('LOGGED', 'RESTORED', 'FAILED_RESTORE') NOT NULL DEFAULT 'LOGGED',
83+
INDEX idx_time (concern_time)
4184
) ENGINE=InnoDB;
4285

4386
-- Scan history
@@ -46,17 +89,18 @@ CREATE TABLE IF NOT EXISTS scan_history (
4689
scan_timestamp TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
4790
total_files INT NOT NULL,
4891
concerns_found INT NOT NULL DEFAULT 0,
92+
restorations INT NOT NULL DEFAULT 0,
4993
commit_sha CHAR(40),
5094
tech_id VARCHAR(100) NOT NULL DEFAULT 'Gifted Install Tech ID'
5195
) ENGINE=InnoDB;
5296

53-
-- Security: read-only user for application, no DELETE/UPDATE on concerns
97+
-- Security users: app gets SELECT + INSERT only. No DELETE anywhere.
5498
CREATE USER IF NOT EXISTS 'nwe_integrity_ro'@'localhost' IDENTIFIED BY 'integrity_read_only_2026';
5599
GRANT SELECT ON nwe_integrity.* TO 'nwe_integrity_ro'@'localhost';
56100

57101
CREATE USER IF NOT EXISTS 'nwe_integrity_rw'@'localhost' IDENTIFIED BY 'integrity_write_2026';
58102
GRANT SELECT, INSERT ON nwe_integrity.* TO 'nwe_integrity_rw'@'localhost';
59-
-- No UPDATE or DELETE on integrity_concerns — immutable audit
60-
GRANT UPDATE ON nwe_integrity.file_digests TO 'nwe_integrity_rw'@'localhost';
103+
GRANT UPDATE (match_status, scan_timestamp) ON nwe_integrity.file_digests TO 'nwe_integrity_rw'@'localhost';
104+
-- No DELETE on any table. No UPDATE on history or concerns.
61105

62106
FLUSH PRIVILEGES;

0 commit comments

Comments
 (0)