chore(security): round 8 — recurring guards + supply-chain signing (build 629)

Tier 1.1 (verified live): FIM coverage end-to-end. Probe write to a
    WATCH_CODE file produced both a fim_watch_file_modified event in
    ~1s and a fim_file_modified event in ~8s. Confirms round 6/7
    additions (recovery scripts, package.sh, _recovery_log.jsonl)
    actually fire — not just look right in static review.

Tier 1.2: .append() / $(htmlString) audit. 62 jQuery DOM-injection
    sinks beyond .html() audited (40 + 3 + 3 + 1 + 5 + 10). Zero XSS
    bugs. Same project-wide _.escape convention as round 7 C3 found.
    Documented in HTML_INJECTION_AUDIT.md as the round-8 extension.

Tier 1.3: Sigstore keyless signing of .spl + per-release SBOM in
    release.yml. Uses the workflow's OIDC token (id-token: write) to
    mint short-lived ephemeral keys via Fulcio, records signatures
    in the public Rekor transparency log. Closes the previously-
    documented gap where .sha256 + .spl shared a single channel.
    Verifier command included in workflow comments.

Tier 1.4: Quarterly pip-audit CI workflow (Jan/Apr/Jul/Oct 1 at
    09:00 UTC). Fails on any vulnerability, surfacing via GitHub's
    existing notification settings. Origin: round 7 B4 was a one-off
    run; without recurrence we'd forget.

Tier 2.5: Per-release SBOM generation. scripts/generate_sbom.py
    extracts the .spl, hashes every bundled file, emits CycloneDX
    1.5 JSON. package.sh now calls it as step 6/6. Replaces the
    static sbom.cdx.json baseline with a per-release artifact that
    matches the .spl byte-for-byte.

Tier 2.6: Long-term archival guidance in indexes.conf — example
    coldToFrozenScript stanza + extended-online-retention
    alternative + Splunk doc pointers. No default changed; guidance
    only for compliance regimes (PCI/HIPAA/SOX) needing >3 years.

Operational: scheduled Q3 2026 Splunk version-pinning audit
    (run_once_at: 2026-07-18T07:00:00Z, routine
    trig_01QE78KzCtSTuwFv2LjrUQqC) — re-runs pip-audit, scans
    CVEs, checks 10.x compat, opens a PR with findings.

Doc cleanup: action=fim_file_modified is the actual wire-level
    name (prior CHANGELOG entries called it fim_code_modified).
    Fixed in this round's notes; prior entries left untouched as
    historical record.

Build 628 -> 629. Files: 9 (7 modified, 2 added).

Author: wildleo91

.github/workflows/pip-audit.yml

@@ -0,0 +1,61 @@
+name: pip-audit — dev dependency CVE scan
+
+# Quarterly CVE scan of `requirements-dev.txt` against the OSV
+# database + GitHub Advisory Database. Origin: round 7 B4
+# (one-off run, 2026-04-29) found pytest 8.1.1 vulnerable to
+# GHSA-6w46-j5rx-g56g. Round 8 (2026-04-29) wires this as a
+# recurring CI job so we don't forget to re-run.
+#
+# Cadence: 1st of every quarter (Jan 1, Apr 1, Jul 1, Oct 1) at
+# 09:00 UTC. Also runs on demand via workflow_dispatch.
+#
+# Failure mode: the workflow fails when pip-audit finds a vuln,
+# producing a red CI badge + email to the repo owner via GitHub's
+# existing notification settings. No PR is auto-created — the
+# remediation requires human judgment (bump pin? wait for upstream
+# fix? add a known-issue exception?).
+
+on:
+  schedule:
+    # Quarterly: Jan 1, Apr 1, Jul 1, Oct 1 at 09:00 UTC.
+    # Pinned to the 1st (not Sunday-of-week) so audits anchor on
+    # absolute dates that are easy to reason about against the
+    # CHANGELOG and version-pinning audit cadence.
+    - cron: '0 9 1 1,4,7,10 *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  pip-audit:
+    name: Audit requirements-dev.txt
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install pip-audit
+        run: |
+          python -m pip install --upgrade pip
+          pip install pip-audit==2.7.3
+
+      - name: Run pip-audit
+        # `--strict` exits non-zero on ANY finding (including those
+        # without a known fix). Use `--ignore-vuln <ID>` here to
+        # carve out a documented exception with a tracking note.
+        run: |
+          pip-audit --requirement requirements-dev.txt --strict
+
+      - name: Reminder on failure
+        if: failure()
+        run: |
+          echo "::error::pip-audit found at least one vulnerability."
+          echo "::error::Document the finding in docs/PIP_AUDIT_LOG.md and either"
+          echo "::error::bump the pin or add an --ignore-vuln <ID> exception with rationale."

.github/workflows/release.yml

@@ -11,14 +11,17 @@ jobs:
   release:
     name: Build and attach .spl
     runs-on: ubuntu-latest
-    # Per-job permissions (round 7, 2026-04-29). `contents: write` is
-    # the minimum to upload .spl + .sha256 assets to a published
-    # release via `gh release upload`. No other scopes needed —
-    # explicitly NOT requesting `actions:`, `packages:`, `id-token:`
-    # so a future workflow-level permissions widening can't silently
-    # enrich this job's token.
+    # Per-job permissions (round 7 + round 8, 2026-04-29).
+    # - `contents: write` — upload .spl + .sha256 + .sig + .crt as
+    #   release assets via `gh release upload`.
+    # - `id-token: write` — mint the short-lived OIDC token Sigstore
+    #   uses to prove this run came from THIS workflow at THIS commit
+    #   for THIS tag. Required for cosign keyless signing. Without it
+    #   cosign falls back to interactive browser flow (impossible
+    #   in CI) and the step fails closed.
     permissions:
       contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -33,10 +36,62 @@ jobs:
       - name: Build .spl package
         run: bash scripts/package.sh
 
-      - name: Attach .spl to release
+      # Round 8 (2026-04-29) — Sigstore keyless signing.
+      #
+      # Why this exists: the .spl + .sha256 ride the same channel
+      # (GitHub Releases). A Releases takeover for this repo would
+      # let an attacker swap both files and the SHA-256 sidecar
+      # would still verify against the malicious .spl. Sigstore signs
+      # with a short-lived key minted from the workflow's OIDC token,
+      # records the signature in the immutable Rekor transparency log,
+      # and produces a .sig + .crt pair that customers verify with
+      # `cosign verify-blob` against the `RelativisticJet/wl_manager`
+      # workflow identity — proving the artifact came from THIS
+      # repository's release pipeline, not a Releases-page swap.
+      #
+      # Verification by downstream admins:
+      #   cosign verify-blob \
+      #     --certificate wl_manager-<v>.spl.crt \
+      #     --signature wl_manager-<v>.spl.sig \
+      #     --certificate-identity-regexp 'https://github.com/RelativisticJet/wl_manager/.github/workflows/release.yml@refs/tags/.*' \
+      #     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+      #     wl_manager-<v>.spl
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+        with:
+          cosign-release: 'v2.4.1'
+
+      - name: Sign .spl with Sigstore (keyless)
+        run: |
+          for spl in dist/*.spl; do
+            echo "Signing $spl..."
+            cosign sign-blob --yes \
+              --output-signature "${spl}.sig" \
+              --output-certificate "${spl}.crt" \
+              "$spl"
+          done
+
+      # The SBOM is also signed so a downstream verifier can confirm
+      # both the artifact AND its bill of materials came from THIS
+      # workflow run (a Releases takeover would need to forge both).
+      - name: Sign per-release SBOM with Sigstore (keyless)
+        run: |
+          for sbom in dist/*.cdx.json; do
+            [ -f "$sbom" ] || continue
+            echo "Signing $sbom..."
+            cosign sign-blob --yes \
+              --output-signature "${sbom}.sig" \
+              --output-certificate "${sbom}.crt" \
+              "$sbom"
+          done
+
+      - name: Attach .spl + checksum + SBOM + signatures to release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release upload "${{ github.event.release.tag_name }}" \
             dist/*.spl \
-            dist/*.sha256
+            dist/*.sha256 \
+            dist/*.cdx.json \
+            dist/*.sig \
+            dist/*.crt

CHANGELOG.md

@@ -2,7 +2,80 @@
 
 All notable changes to this project will be documented in this file.
 
-## Unreleased — 2026-04-29 (build 628)
+## Unreleased — 2026-04-29 (build 629)
+
+### Round 8: residue + recurring guards + supply-chain hardening
+
+#### Verified
+
+- **FIM coverage live-tested**. Wrote a probe line to a `WATCH_CODE`
+  file (`default/savedsearches.conf`) inside the container; both the
+  ~2 s stat-based watcher (`wl_fim_watch.py`, action
+  `fim_watch_file_modified`) and the 15 s hash-sweep
+  (`wl_fim.py`, action `fim_file_modified`) emitted audit events
+  with the correct `monitored_path`. Confirms round 6/7 FIM
+  additions (recovery scripts, `scripts/package.sh`, append-only
+  `_recovery_log.jsonl`) fire end-to-end, not just look right
+  in static review.
+- **Documentation cleanup**: prior commit messages and parts of
+  CLAUDE.md called the modify-event `fim_code_modified`. The
+  actual wire-level `action=` field is `fim_file_modified`. The
+  inconsistency surfaced during the live FIM probe — a search for
+  `fim_code_modified` returned no rows. The code is unchanged;
+  only the prose was wrong. Future searches should use
+  `fim_file_modified` (regular file changes) and
+  `fim_watch_file_modified` (stat-watcher events).
+
+#### Added
+
+- **Sigstore keyless signing of the .spl + per-release SBOM** in
+  `.github/workflows/release.yml`. Uses the workflow's OIDC token
+  to mint short-lived ephemeral signing keys via Fulcio, records
+  the signature in the public Rekor transparency log, and
+  produces `<artifact>.sig` + `<artifact>.crt` for each .spl and
+  each .cdx.json. Closes the previously-documented gap in
+  `docs/SBOM.md` where the .sha256 + .spl shared a single channel
+  (GitHub Releases) and a Releases takeover defeated both.
+  Verifier command included in workflow comments.
+- **Quarterly `pip-audit` CI workflow**
+  (`.github/workflows/pip-audit.yml`) — fires Jan 1 / Apr 1 / Jul
+  1 / Oct 1 at 09:00 UTC and on `workflow_dispatch`. Fails the
+  workflow on any vulnerability, surfacing via GitHub's existing
+  notification settings. Origin: round 7 B4 was a one-off run;
+  without recurrence we'd forget to re-audit.
+- **Per-release SBOM generation** (`scripts/generate_sbom.py`) —
+  extracts the .spl tarball, hashes every bundled file, and emits
+  a CycloneDX 1.5 JSON document with one `application:wl_manager`
+  envelope and per-file `component` entries. `scripts/package.sh`
+  now calls it as step 6/6, producing `<artifact>.cdx.json`
+  alongside `<artifact>.spl.sha256`. Replaces the static
+  `sbom.cdx.json` baseline (round 7 C1) with a per-release
+  artifact that matches the .spl byte-for-byte.
+- **`wl_audit` long-term archival guidance** in
+  `default/indexes.conf` — documents two options for going past
+  the default 3-year retention (extend online vs. archive on
+  freeze via `coldToFrozenScript`), with example config blocks
+  and pointers to Splunk's official docs. No default changed —
+  guidance only.
+- **`.append()` / `$(htmlString)` audit extension** appended to
+  `docs/HTML_INJECTION_AUDIT.md`. 62 jQuery DOM-injection sinks
+  beyond `.html()` audited (40 append + 3 prepend + 3 before + 1
+  after + 5 replaceWith + 10 factory). Result: zero XSS bugs —
+  every string-arg site already escapes user-controlled
+  substrings. Same project-wide convention as round 7 C3 found.
+
+#### Operational
+
+- **Q3 2026 Splunk version-pinning audit scheduled**
+  (`run_once_at: 2026-07-18T07:00:00Z` = 09:00 Europe/Warsaw).
+  Remote routine `trig_01QE78KzCtSTuwFv2LjrUQqC` will re-run
+  pip-audit, probe Splunk's supported-versions list, scan for new
+  9.3.x CVEs, assess 10.x compat against the 7 risk areas listed
+  in CLAUDE.md, run the pure-Python test suite, and open a PR
+  with findings. One-shot rather than recurring because each
+  audit's findings shape the next prompt.
+
+## Released — 2026-04-29 (build 628)
 
 ### Round 7 C items: SBOM + backup/restore + .html() audit
 

appserver/static/whitelist_manager.js

@@ -11,7 +11,7 @@
 // disk cache. Splunk serves /static/@<server-hash>/... with Cache-Control:
 // public, max-age=31536000; without urlArgs, bumped build numbers don't force
 // a re-fetch and clients run stale JS until they hard-refresh.
-require.config({ urlArgs: "_b=628" });
+require.config({ urlArgs: "_b=629" });
 require([
     "jquery",
     "underscore",

default/app.conf

@@ -5,7 +5,7 @@
 
 [install]
 is_configured = false
-build = 628
+build = 629
 
 [launcher]
 author       = Security Engineering

default/indexes.conf

@@ -10,3 +10,48 @@ thawedPath = $SPLUNK_DB/wl_audit/thaweddb
 
 # Retain audit data for 3 years (adjust to your retention policy)
 frozenTimePeriodInSecs = 94608000
+
+# ─────────────────────────────────────────────────────────────────────
+# Long-term archival (round 8 guidance, 2026-04-29)
+# ─────────────────────────────────────────────────────────────────────
+#
+# Without a `coldToFrozenScript` or `coldToFrozenDir` setting,
+# Splunk DELETES buckets when they pass `frozenTimePeriodInSecs`.
+# That's fine for the default 3-year retention, but compliance
+# regimes (PCI DSS 12 months online + 12 months archive, HIPAA 6
+# years, SOX 7 years, GDPR per local regulator) often require
+# longer evidentiary retention than is practical to keep online.
+#
+# Two options for going past 3 years:
+#
+# Option A — extend online retention. Simpler but uses more disk:
+#
+#     [wl_audit]
+#     # 7 years online
+#     frozenTimePeriodInSecs = 220752000
+#     # ~10 GB/year forecast; sized for round 7 B5 worst case
+#     # (whitelist_view at 4 workers × 100 analysts × 50 CSVs)
+#     maxTotalDataSizeMB = 100000
+#
+# Option B — archive frozen buckets to cold storage. Recommended
+# for any retention beyond 3 years:
+#
+#     [wl_audit]
+#     # 1 year online (then frozen)
+#     frozenTimePeriodInSecs = 31536000
+#     # Splunk runs this script on each bucket BEFORE freezing.
+#     # Customer-supplied — copies the bucket to S3 / NAS / Glacier
+#     # / Azure Blob and exits 0 to allow Splunk to delete the
+#     # online copy. Splunk passes the bucket path as $1.
+#     coldToFrozenScript = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/etc/apps/wl_manager/bin/wl_freeze_archive.py"
+#
+# A reference `wl_freeze_archive.py` is NOT shipped because the
+# archive target (S3 bucket, Azure container, NFS share) is
+# customer-specific. Splunk's official docs cover the script
+# contract:
+#   https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Automatearchiving
+#
+# Whichever option you pick, document the choice in your runbook
+# alongside the scheduled "verify the archive is restorable"
+# rehearsal — an archive nobody has ever restored from is a
+# theoretical retention guarantee, not a real one.

docs/HTML_INJECTION_AUDIT.md

@@ -79,27 +79,56 @@ Even though no bug was found, two preventive measures landed:
    sites can migrate opportunistically; they don't have to migrate
    all at once.
 
+## Extension audit — round 8 (2026-04-29)
+
+Round 8 extended the same methodology to the remaining jQuery
+DOM-injection sinks: `.append(string)`, `.prepend(string)`,
+`.before(string)`, `.after(string)`, `.replaceWith(string)`, and
+the `$(htmlString)` factory form. Same XSS surface as `.html()` —
+all parse HTML when given a string starting with `<`.
+
+**Sweep**: 62 sites total (40 + 3 + 3 + 1 + 5 + 10). Result: **zero
+XSS bugs found**.
+
+| Sink | Sites | Object args (safe) | String args | Bugs |
+|------|------:|-------------------:|------------:|-----:|
+| `.append()` | 40 | 32 | 8 | 0 |
+| `.prepend()` | 3 | 1 | 2 | 0 |
+| `.before()` | 3 | 1 | 2 | 0 |
+| `.after()` | 1 | 0 | 1 | 0 |
+| `.replaceWith()` | 5 | 3 | 2 | 0 |
+| `$('<...')` factory | 10 | 10 | 0 | 0 |
+
+The string-arg sites that take user data follow the same project
+convention round 7 C3 documented: every user-controlled substring
+is `_.escape`-wrapped before concatenation. Notable patterns:
+
+- `wl_modals.js`, `wl_save.js`, `wl_csv_io.js`, `wl_presence.js`,
+  `wl_datepicker.js`, `wl_table.js` — all modal/popup builders
+  pass already-constructed jQuery objects (`$modal`, `$bubble`,
+  `$datePicker`), so the HTML-parsing path is bypassed entirely.
+- `control_panel.js:1878, 2886` — `replaceWith(renderLimitHistory(...))` /
+  `replaceWith(renderAdminLimitHistory(...))` pass strings, but the
+  builder functions escape every user-controlled field (admin name,
+  timestamp, change values).
+- `wl_versions.js:96, 117, 127` — `<option>` tags appended to
+  the revert dropdown; `_.escape` per filename and display string.
+- `wl_approval_ui.js:430, 572, 574` — approval-bar and addition-
+  preview HTML; `_.escape` on every header, cell, action_type,
+  analyst, reason, request_id.
+
 ## What this audit does NOT cover
 
-- jQuery `.append(string)` / `.prepend(string)` / `.before(string)`
-  / `.after(string)` — when called with a string argument, these
-  also parse HTML and have the same XSS surface as `.html()`. Not
-  audited in this round; future work.
-- `$(htmlString)` — the jQuery factory parses HTML when the
-  argument starts with `<`. Not audited.
 - DOM `innerHTML` / `outerHTML` — pure DOM API, search-and-audit
   separately. Quick grep of the codebase: zero hits in production
   code.
 - `eval`, `Function(string)`, `setTimeout(string, ...)` — these
   would be a different class of bug. Quick grep: zero hits in
   production code.
 
-A follow-up round can extend the same methodology to `.append()`
-et al. The rationale for stopping at `.html()` here is that it
-has the highest concentration of user-data-into-DOM call sites and
-the audit returned a clean result; the cost-to-coverage of going
-deeper drops sharply once we have confidence the discipline is
-consistent.
+The methodology has now covered every realistic XSS sink in
+jQuery + DOM that this codebase actually uses. Going deeper hits
+diminishing returns.
 
 ## Re-audit triggers