CML Lab Builder 3.3.0

Highlights: signed updates and a security audit, a resource check before Build (fits / tight / won't fit, stop or wipe running labs), and a design refresh aimed at WCAG 2.2 AA.

Update from 3.2.0: the app offers the small patch (Update now), or download the full bundle / .deb below. Each release asset is listed in SHA256SUMS.txt; SHA256SUMS.txt.sig and cml-lab-builder-patch-3.3.0.zip.sig are Ed25519 signatures by the release key (see SECURITY.md to verify by hand).

Security

• Security audit and hardening (details in the new SECURITY.md):
  • Signed updates: releases carry Ed25519 signatures of SHA256SUMS.txt and of the patch (*.sig); the
    public release key is built into the app. From this version on, unsigned or wrongly signed updates are refused
    (online and Install update from file). Up to 3.2.0 apps keep checking SHA256SUMS.txt as before.
  • Web UI guards: Host allowlist against DNS rebinding (421), CSRF protection (Origin / Sec-Fetch-Site
    checks plus a required X-CMLLab-Request header), CORS preflights refused, path traversal guard.
  • Per-launch access token in the desktop app (HttpOnly SameSite=Strict cookie after the first open), so
    other local users or programs cannot drive the UI. CMLLAB_ACCESS_TOKEN=0 turns it off. cmllab web --token.
  • cmllab web --host with a non-loopback address prints a loud warning and always requires a token.
  • Strict Content-Security-Policy (no inline script or event handlers any more), nosniff,
    X-Frame-Options: DENY, frame-ancestors 'none', Referrer-Policy: no-referrer, COOP/CORP. Links built from
    lab or library data only allow http(s).
  • Secrets: device passwords are now remembered too (OS keyring) when Remember passwords is ticked; without a
    keyring, secrets go to secrets.json (0600) instead of being dropped, and move into the keyring once there is
    one. A password found in settings.json is moved out at start; settings.json is written 0600.
  • Secrets are redacted from job output, errors, tracebacks and startup errors; the access log is off.
  • TLS: new TLS verification > On, with my own CA certificate (PEM path, checked in Settings); Off is
    labelled insecure and shows a warning in Settings and in the log.
  • Zip member checks also reject \ and NUL; ids used as file names are checked.
  • CI: security lint (ruff S rules) and pip-audit; the deb test checks file ownership and permissions.
• Known limitation: a report saved as HTML by the CLI and opened from disk keeps working, but its Print button
  needs the app (Ctrl+P works everywhere).

Added

• Resource check before Build: the Build box reads free memory, licensed nodes and running labs from CML and says
  Fits, Tight, Won't fit or Can't tell, with a memory bar and the running labs (nodes, RAM). Stop a lab, or
  stop & wipe one this app built, from there (with confirmation), then build, Build anyway or cancel. A running
  copy of the same lab counts as free. Library cards show fits now? tags (cached 30 s). New settings Check free
  CML memory before Build and Keep this much CML memory free (CMLLAB_RESOURCE_CHECK,
  CMLLAB_RESOURCE_HEADROOM_GB, default 4 GB). Errors (no admin rights for system stats, CML down) show Can't
  tell and never block a build. New API: GET /api/resources, GET /api/labs/{id}/precheck,
  POST /api/cml/labs/{id}/stop.
• New library lab 21-nxos-ospf-multiarea: NX-OS study path 1/3: OSPF multi-area on a super-spine Clos, with deep
  debug inspection (walkthrough, 12 steps). Six Nexus 9000v in a 5-stage Clos (SS1/SS2, one spine and one leaf per
  pod) plus four IOL hosts, 10 nodes, about 76 GB of CML RAM. Area 0 on the super-spine layer, one area per pod with
  the spines as ABRs, a DR/BDR segment, area range summarization, an NSSA with a translated external and a stub
  area. Each step explains what NX-OS does under the hood and lists the show, event-history and debug commands
  (debug logfile, debug-filter, undebug all) to inspect it. Library only: library/21-nxos-ospf-multiarea.cmllab
  (and labs/21-nxos-ospf-multiarea.encorlab). Expected outputs are synthesized from Cisco documentation.
• New library lab 22-nxos-bgp-over-ospf: NX-OS study path 2/3: iBGP over OSPF with super-spine route reflectors,
  with deep debug inspection (walkthrough, 12 steps, same 10-node / 76 GB topology). Boots from its own baseline:
  lab 21's day-0 plus lab 21's required steps. SS1/SS2 as route reflectors with peer templates, loopback peering,
  the BGP FSM with event-history and filtered debugs, next-hop tracking, best-path selection between reflected
  copies, the BGP-free-core problem, optional community/local-preference policy, eBGP and BFD design discussions
  (BFD is not supported on Nexus 9000v). packaging/nxos_study_baseline.py regenerates the study-path baselines; a
  test fails if one drifts.
• New library lab 23-nxos-evpn-vxlan: NX-OS study path 3/3: BGP EVPN VXLAN over iBGP and OSPF (L2VNI, L3VNI,
  anycast gateway), with deep debug inspection (walkthrough, 16 steps, same 10-node / 76 GB topology). Boots
  from its own baseline: lab 22's day-0 plus lab 22's required steps. L2VPN EVPN on the existing RR sessions,
  VLAN-to-VNI mapping, NVE with BGP ingress replication (multicast underlay explained), cross-pod bridging,
  L3VNI with anycast gateway and symmetric IRB, type-5 prefixes, optional ARP suppression and break/fix.
• New course nxos-study-path: NX-OS study path: OSPF → BGP → BGP EVPN VXLAN (labs 21, 22, 23 in order;
  library/nxos-study-path.cmlcourse, labs/nxos-study-path.encorcourse).

Changed

• Design refresh following common design-system practice: design tokens (8 px spacing grid, a type scale,
  semantic colors) for both themes; consistent buttons (36 px), inputs, tags, chips, cards, tables and callouts;
  inline SVG icons instead of emoji (CSP-safe, no CDN); header with a brand mark and a sun/moon theme toggle;
  loading spinners, empty and error states styled the same everywhere.
• Accessibility (WCAG 2.2 AA): contrast fixed in both themes (muted text, the walkthrough tag, primary buttons in
  dark mode, library topic names), a visible focus ring on every control, a Skip to content link, labelled progress
  bars, aria-expanded on the More menu, prefers-reduced-motion honored (also for scrolling), forced-colors mode
  support, a layout that reflows to phone width without horizontal scrolling. axe-core reports 0 violations on Labs, a
  walkthrough step, Library, Settings and the resource check, light and dark (3.2.0: 94).