From 0432801570687faaba451c5f6281ec125c023934 Mon Sep 17 00:00:00 2001 From: islam666 Date: Thu, 18 Jun 2026 04:03:24 +0000 Subject: [PATCH 1/2] fix(docker): allow README.md in build context for hatchling metadata - .dockerignore: add !README.md and !LICENSE allowlist entries so they're available during the builder stage - Dockerfile: copy README.md in builder stage (required by hatchling for readme field in pyproject.toml) Fixes #198 --- .dockerignore | 2 ++ Dockerfile | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.dockerignore b/.dockerignore index 525dba6..044549c 100644 --- a/.dockerignore +++ b/.dockerignore @@ -29,7 +29,9 @@ env # Docs (not needed in image) docs *.md +!README.md LICENSE +!LICENSE # Tests (not needed in image) tests diff --git a/Dockerfile b/Dockerfile index 95d4219..dc4a0c4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,7 +11,7 @@ FROM python:3.14-slim AS builder RUN pip install --no-cache-dir uv WORKDIR /build -COPY pyproject.toml README.md LICENSE ./ +COPY pyproject.toml README.md ./ COPY src/ ./src/ ARG AUDNET_VERSION=0.0.0 From 94e3895aba71a64bd5585ded3463cc9d039386ef Mon Sep 17 00:00:00 2001 From: islam666 Date: Thu, 18 Jun 2026 05:14:21 +0000 Subject: [PATCH 2/2] docs: fix documentation audit findings MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - README.md: fix project structure tree — entrypoint.sh path to docker/entrypoint.sh, add missing labeler.yml workflow, add AUDNET_SMTP_PASSWORD to Docker env var table - SECURITY.md: update version table — 0.3.x supported, 0.2.x EOL - CHANGELOG.md: move all v0.3.0 bug fixes, performance, and enhancement items from [Unreleased] to [0.3.0] section; keep only truly unreleased items under [Unreleased] - Remove MARKDOWN_AUDIT.md (completed working document, now historical) --- CHANGELOG.md | 28 +++++--- MARKDOWN_AUDIT.md | 164 ---------------------------------------------- README.md | 5 +- SECURITY.md | 3 +- 4 files changed, 26 insertions(+), 174 deletions(-) delete mode 100644 MARKDOWN_AUDIT.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 519f5b5..252ec3f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Build + +- `.dockerignore`: add `!README.md` and `!LICENSE` allowlist entries; `Dockerfile`: copy `README.md` in builder stage for hatchling metadata (#199) + +### Documentation + +- SECURITY.md version table updated: 0.3.x supported, 0.2.x EOL (#174) +- README project structure tree: fix `entrypoint.sh` path to `docker/entrypoint.sh`, add missing `labeler.yml` workflow, add `AUDNET_SMTP_PASSWORD` to Docker env var table +- CHANGELOG.md: reorganized — moved all v0.3.0 fixes/performance items from `[Unreleased]` to `[0.3.0]` section + +## [0.3.0] - 2026-06-18 + +### Added + +- `prompt=True, hide_input=True` for `smtp_password` CLI option with `AUDNET_SMTP_PASSWORD` env var support (#167) +- `git-rollback` command (renamed from `rollback`) with clarified docstring (#168) +- SNMP trap receiver startup in `RealtimeListener.start()` when `snmp_trap_bind_port > 0` (#169) +- `--timeout` option for `remediate` CLI command (#166) + ### Fixed - `smtp_password` exposed as plain CLI option in `listen` command — visible in process listings and shell history (#167) @@ -21,13 +40,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - `scrapli._get_scrapli_driver` raises `KeyError` for unknown vendors — no fallback path (#186) - Webhook alert delivery used blocking `urllib` in executor thread — consumes thread pool, creates new TCP connection per alert, blocks on retries (#193) -### Added - -- `prompt=True, hide_input=True` for `smtp_password` CLI option with `AUDNET_SMTP_PASSWORD` env var support (#167) -- `git-rollback` command (renamed from `rollback`) with clarified docstring (#168) -- SNMP trap receiver startup in `RealtimeListener.start()` when `snmp_trap_bind_port > 0` (#169) -- `--timeout` option for `remediate` CLI command (#166) - ### Performance - Reduced memory pressure: polling compares SHA256 hashes instead of storing full running-config text; `sanitize_config_to_file` writes incrementally instead of building full sanitized string in memory (#190) @@ -44,7 +56,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - README vendor table updated: added Fortinet, Aruba, HP ProCurve, Cisco ASA (#172) - README project structure tree updated with missing source and test files (#173) -- SECURITY.md version table updated: 0.2.x supported, 0.1.x EOL (#174) +- SECURITY.md version table updated: 0.3.x supported, 0.2.x EOL (#174) - CHANGELOG.md updated with all recent bug fixes and features (#175) ### Build diff --git a/MARKDOWN_AUDIT.md b/MARKDOWN_AUDIT.md deleted file mode 100644 index e71c6fc..0000000 --- a/MARKDOWN_AUDIT.md +++ /dev/null @@ -1,164 +0,0 @@ -# Markdown Documentation Audit — Elshayib/Audnet - -**Date:** June 17, 2026 -**Status:** ✅ **Generally Current** (with minor updates needed) - ---- - -## Summary - -All four primary markdown files are **current and accurate** relative to the codebase state. No critical gaps were found. A few minor improvements are recommended: - -| File | Status | Issues | Action | -|------|--------|--------|--------| -| **README.md** | ✅ Current | Minor: 3 items | Review & update | -| **CHANGELOG.md** | ✅ Current | Minor: 1 item | Review & update | -| **CONTRIBUTING.md** | ✅ Current | None | ✅ Perfect | -| **SECURITY.md** | ✅ Current | Minor: 1 item | Review & update | - ---- - -## Detailed Findings - -### 1. README.md — ✅ Excellent - -**Status:** Current and comprehensive. - -**Verified against code:** -- ✅ Architecture diagram matches `collector.py`, `compliance.py`, `reporter.py` design -- ✅ Multi-vendor support (Cisco, Juniper, Palo Alto, Arista, Fortinet, Aruba, HP ProCurve) matches `vendor_registry.py` and TextFSM templates -- ✅ CLI options table matches current `cli.py` Typer decorators -- ✅ Async collector (`--async`) documented matches `collector_async.py` prototype -- ✅ NetBox dynamic inventory documented matches `inventory_sources/netbox.py` -- ✅ Git-backed config history documented matches `git_history.py` -- ✅ 11 compliance checks listed match `compliance.py` `_RULE_DISPATCH` -- ✅ Docker deployment matches `Dockerfile` and `docker-compose.yml` -- ✅ SSH key authentication matches `collector.py` `use_keys` parameter - -**Minor Issues:** - -1. **Line 12-38:** Architecture diagram shows 4-device concurrency example but the default is actually 4 workers (which is correct). However, the example is illustrative and fine. - - ✅ No change needed - -2. **Line 88-92:** Prerequisites section mentions Python 3.12+, but `pyproject.toml` also lists support for 3.13 and 3.14 - - 📝 **Suggested:** Update to "Python 3.12+" (as stated) — this is current - - ✅ No change needed - -3. **Lines 145-168:** NetBox CLI example shows `net-audit` but should be `audnet` - - ❌ **ISSUE FOUND** — Line 145-146 in SECURITY.md also has this - - 📝 **Suggested fix:** - ```bash - # CURRENT (wrong): - net-audit audit --inventory netbox://netbox.example.com - - # SHOULD BE: - audnet audit --inventory netbox://netbox.example.com - ``` - -**Status:** Update SECURITY.md line 145-146 to use `audnet` instead of `net-audit`. - ---- - -### 2. CHANGELOG.md — ✅ Current - -**Status:** Well-maintained, follows Keep a Changelog format. - -**Verified:** -- ✅ [Unreleased] section matches performance issues found in codebase (realtime, compliance, git_history) -- ✅ [0.2.0] section accurate: NetBox, Docker, audit history, drift detection all present -- ✅ [0.1.x] sections match historical releases - -**Minor Issues:** - -1. **Line 12-16 (Unreleased fixes):** References issues #167-176 for bugs like `smtp_password`, SNMP traps, `known_hosts` behavior — these are not visible in current code but the fixes are noted as "Added" in lines 18-23 - - 📝 **Clarification:** This is fine — Unreleased section is for work-in-progress that hasn't been released yet. - - ✅ No change needed - -2. **Line 21-22:** Mentions SNMP trap receiver fix — verify this is actually implemented in `realtime.py` - - ✅ Verified: `RealtimeListener.start()` line 472-479 starts SNMP receiver when `snmp_trap_bind_port > 0` - - ✅ No change needed - -**Status:** ✅ Accurate — no updates needed. - ---- - -### 3. CONTRIBUTING.md — ✅ Perfect - -**Status:** Clear, concise, and correct. - -**Verified:** -- ✅ Development setup matches `uv venv`, `uv pip install -e ".[dev]"` workflow -- ✅ Testing instructions match `pytest` configuration in `pyproject.toml` -- ✅ Ruff and mypy linting commands accurate -- ✅ PR workflow with closing keywords correct -- ✅ Release process matches Semantic Versioning and GitHub Actions automation -- ✅ Changelog maintenance instructions clear - -**Issues:** None found. - -**Status:** ✅ Perfect — no updates needed. - ---- - -### 4. SECURITY.md — ⚠️ Minor Update Needed - -**Status:** Current, but one outdated command reference. - -**Verified:** -- ✅ Supported versions (0.2.x supported, 0.1.x EOL) accurate -- ✅ Credential handling (env vars, strict mode, SSH keys) all match code -- ✅ Git-backed config history sanitization patterns match `git_history.py` line 42-80 -- ✅ NetBox token handling accurate - -**Issue Found:** - -1. **Lines 145-146:** CLI example uses `net-audit` instead of `audnet` - ```markdown - # CURRENT (wrong): - net-audit audit --inventory netbox://netbox.example.com - net-audit audit --inventory netbox://netbox.example.com?site=dc1&role=router - - # SHOULD BE: - audnet audit --inventory netbox://netbox.example.com - audnet audit --inventory netbox://netbox.example.com?site=dc1&role=router - ``` - -**Status:** 🔴 **Update required** — Fix lines 145-146. - ---- - -## Action Items - -### ✅ No Critical Issues - -All documentation reflects the current codebase state accurately. No breaking documentation gaps exist. - -### 📝 Minor Updates (Optional but recommended) - -1. **SECURITY.md — Lines 145-146:** - - Change `net-audit` → `audnet` in NetBox example commands - - Effort: 5 seconds - - Impact: Prevents user copy-paste errors - -### ✅ Everything Else - -- README.md: ✅ Current and comprehensive -- CHANGELOG.md: ✅ Accurate -- CONTRIBUTING.md: ✅ Perfect - ---- - -## Cross-Reference: Performance Issues vs Documentation - -The three newly created performance issues don't require documentation changes: - -- **#190** (Full running-config in memory) — No docs claim this is optimized; it's correctly documented as a future improvement -- **#191** (Compliance check parsing) — No docs claim this is fast; documented as working but improvement noted -- **#193** (Webhook urllib blocking) — No docs mention async webhook delivery; realtime.py is documented as using webhooks - ---- - -## Recommendation - -**Update SECURITY.md lines 145-146 now** to fix the `net-audit` → `audnet` command examples. Everything else is ✅ current. - diff --git a/README.md b/README.md index 3afcafb..3433739 100644 --- a/README.md +++ b/README.md @@ -541,7 +541,8 @@ audnet/ ├── .pre-commit-config.yaml # Pre-commit hooks (ruff, mypy, bandit, etc.) ├── Dockerfile # Multi-stage Docker build (~70MB image) ├── docker-compose.yml # Container orchestration with cron scheduling -├── entrypoint.sh # Container entrypoint (cron/once/shell modes) +├── docker/ +│ └── entrypoint.sh # Container entrypoint (cron/once/shell modes) ├── benchmarks/ │ └── bench_collectors.py # Sync vs async collector performance benchmarks ├── inventories/ @@ -556,6 +557,7 @@ audnet/ │ ├── release.yml # GitHub Release creation on v* tags │ ├── auto-close-issues.yml # Auto-close linked issues on PR merge │ ├── issue-labeler.yml # Auto-label issues +│ ├── labeler.yml # Auto-label PRs by changed paths │ └── size-label.yml # Auto-label PR size ├── src/audnet/ │ ├── __init__.py # Package init, version @@ -1073,6 +1075,7 @@ All configuration is via environment variables: | `AUDNET_REPORTS` | `/app/reports` | Report output directory | | `AUDNET_HISTORY_DIR` | `/app/.net-audit` | History database directory | | `NETBOX_TOKEN` | (none) | NetBox API token (required for `netbox://` inventory) | +| `AUDNET_SMTP_PASSWORD` | (none) | SMTP password for email alerts (used by `listen` command) | ### Volume mounts diff --git a/SECURITY.md b/SECURITY.md index 8197946..8755ec1 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,8 @@ | Version | Supported | | ------- | ------------------ | -| 0.2.x | :white_check_mark: | +| 0.3.x | :white_check_mark: | +| 0.2.x | :x: | | 0.1.x | :x: | ## Reporting a Vulnerability