OpenSCM v1.0.0

Added

• REST API v1 at /api/v1: the same endpoints, tokens and roles as /api/v1beta1, with answers fixed where the beta was awkward (docs/design/1.0.0-api-v1.md):
  • Scores are rounded to 2 decimals, and "not scanned" is null instead of -1.
  • Every timestamp is ISO 8601 UTC ending in Z, in a field whose name ends in _at (last_seen is now last_seen_at, the audit log's at is created_at).
  • evidence is a JSON array, not JSON inside a string.
  • Every live result has checked_at, when the server last received it. Running a policy answers with queued_at and the systems it reached, so a CI job can wait for results newer than its run.
  • Policies give both kinds of count, whatever the compliance mode: systems (compliant/failing) and tests (results passed/failed), plus scoring_mode. Tests give systems the same way.
  • Audit details is always an object; older plain-text entries come as {"message": "…"}.
  • Every list has a resume_cursor: pass it as cursor later to get only what was added since.
  • The live policy report drops the submitter fields, which only apply to saved reports, and adds generated_at. Each of its systems carries system_id, and its test descriptions say rationale (it was misspelt rational).
  • A test's description, rationale and remediation are null when empty, in /tests and in reports alike; the beta gave null or "" depending on how the test was saved.
  • Saved policy reports name the policy's id, and each result's system_id and test_id. Reports saved before this release have no ids on record, so those are null.
• The API tokens page's example call now uses /api/v1/me.

Deprecated

• /api/v1beta1 answers as before, with a Deprecation: true header and a Link to the migration notes. It will be removed in 1.1.0.

Changed

• cargo audit reports clean: the two "unmaintained" notices (basic-toml, proc-macro-error2) are recorded as reviewed in .cargo/audit.toml. Both are build-time only, pulled in by age's translation macros.
• Database schema v51, the first step of REST API v1 (docs/design/1.0.0-api-v1.md):
  • Policies now store both kinds of pass/fail count, whatever the compliance mode: test results passed and failed, and systems compliant and failing. The existing counts the pages show are unchanged.
  • A saved policy report records which policy it is of. Reports saved before this upgrade get the policy's id when exactly one policy in the organization has that name.
• Audit log entries now always store details as a JSON object, or nothing. Sign-in failures, lockouts, password changes, auto groups, group deletes, enrollment tokens and agent enrollment, and backups used to write plain text; for example bad_password is now {"reason": "bad_password"}, and a backup is {"trigger", "file", "size_bytes", "verified", "pruned"}. Values are escaped properly, so a name with a quote in it no longer produces broken JSON. Entries already in the log are unchanged. The audit log page shows the JSON as stored.
• CI hardening from a SonarCloud scan: third-party GitHub Actions are pinned to full commit SHAs (the tag is kept in a comment), the nfpm and cargo-zigbuild downloads refuse anything but HTTPS with TLS 1.2 or newer, and every release build runs with --locked so it uses exactly the committed Cargo.lock.
• The server binary no longer embeds 45 AdminLTE plugins that no page uses (code editors, calendars, maps, rich-text editors and so on), nor the unminified, unused-variant and old-font-format files of the plugins it keeps; only the files the pages load remain. Embedded static files drop from 100 MB to 49 MB, and the code-scan findings in vendored code go with them.
• An agent that upgrades itself gives the new binary the same file mode as the one it replaces, instead of always 0755.
• A scheduled or "Back up now" backup no longer ties up the server while it compresses and encrypts: that work, and the verify that follows, now runs on a separate thread, so pages and agent check-ins keep being answered. Restore and the remaining file reads and writes in the agent and server startup moved off the async threads the same way.
• Accessibility: every form field now has a label a screen reader can announce (visible labels are linked to their fields, so clicking one focuses the field; fields without a visible label get a hidden one), and the close button on alerts is no longer hidden from screen readers. Page scripts use Number.parseInt/parseFloat/isNaN; the scheduled-time helper now checks dates with getTime(). Nothing changes visually.
• Accessibility: result tables on the report pages and the container detail page have column headers for screen readers, popup titles have default text until the page fills them in, and the Description/Rationale/Remediation captions in the test detail popup are headings rather than unattached form labels (they render slightly smaller).
• postTo and confirmSubmit (the helpers behind POST action links and confirmed forms) no longer return a value; each link or form stops its own navigation with return false. Templates that call them must use confirmSubmit(this); return false; rather than return confirmSubmit(this), or the form submits without asking; a template test fails the build if the old form comes back. No change in behaviour.

Fixed

• The "why?" breakdown on a container's detail page always said "No detail available.": it expected a different evidence format from the one agents send. It now shows the same per-condition table as the system and policy report pages, with every value escaped.
• Exporting a policy whose version contains a line break (possible through import or the API) crashed the request. Download and email attachment filenames now keep only letters, digits, -, _ and . from policy versions and system names.

---