Repository: freedomofpress/securedrop

Issue:
Update OSSEC to v3.0
## Description

OSSEC 3.0 was released on July 17th 2018[0], containing a large amount of bug fixes (including 2 security fixes) as well as new major functionality. Of note, it supports whitelisting syscheck md5 hashes in a sqlite database, potentially reducing notification noise.

## User Research Evidence

Users like up-to-date packages

## User Stories

As a SecureDrop administrator, I would like to have all packages updated and would like to minimize alerts/noise.

[0] https://github.com/ossec/ossec-hids/releases


Discussion:

Resolving patch:
diff --git a/install_files/ansible-base/roles/build-ossec-deb-pkg/library/ossec_urls.py b/install_files/ansible-base/roles/build-ossec-deb-pkg/library/ossec_urls.py
--- a/install_files/ansible-base/roles/build-ossec-deb-pkg/library/ossec_urls.py
+++ b/install_files/ansible-base/roles/build-ossec-deb-pkg/library/ossec_urls.py
@@ -14,7 +14,7 @@
   ossec_version:
     description:
       - version number of release to download
-    default: "2.8.2"
+    default: "3.0.0"
     required: no
 notes:
   - The OSSEC version to download is hardcoded to avoid surprises.
@@ -23,15 +23,15 @@
 '''
 EXAMPLES = '''
 - ossec_urls:
-    ossec_version: "2.8.2"
+    ossec_version: "3.0.0"
 '''
 
-import re  # noqa: E402
+import re  # noqa: F401
 
 
 HAS_REQUESTS = True
 try:
-    import requests
+    import requests  # noqa: F401
 except ImportError:
     HAS_REQUESTS = False
 
@@ -39,60 +39,38 @@
 class OSSECURLs():
 
     def __init__(self, ossec_version):
+        self.REPO_URL = "https://github.com/ossec/ossec-hids"
         self.ossec_version = ossec_version
-
-        checksums = self.parse_checksums()
-
         self.ansible_facts = dict(
             ossec_version=self.ossec_version,
             ossec_tarball_filename=self.ossec_tarball_filename,
             ossec_tarball_url=self.ossec_tarball_url,
-            ossec_checksum_filename=self.ossec_checksum_filename,
-            ossec_checksum_url=self.ossec_checksum_url,
+            ossec_signature_filename=self.ossec_signature_filename,
+            ossec_signature_url=self.ossec_signature_url,
             )
 
-        self.ansible_facts.update(checksums)
-
     @property
     def ossec_tarball_filename(self):
         return "ossec-hids-{}.tar.gz".format(self.ossec_version)
 
     @property
     def ossec_tarball_url(self):
-        return "https://github.com/ossec/ossec-hids/archive/{}.tar.gz".format(
-                self.ossec_version)
+        return self.REPO_URL + "/archive/{}.tar.gz".format(self.ossec_version)
 
     @property
-    def ossec_checksum_url(self):
-        return "https://github.com/ossec/ossec-hids/releases/download/{}/{}".format(  # noqa: E501
-                self.ossec_version, self.ossec_checksum_filename)
+    def ossec_signature_url(self):
+        return self.REPO_URL + "/releases/download/{}/{}".format(
+                self.ossec_version, self.ossec_signature_filename)
 
     @property
-    def ossec_checksum_filename(self):
-        return "{}-checksum.txt".format(self.ossec_tarball_filename)
-
-    def parse_checksums(self):
-        r = requests.get(self.ossec_checksum_url)
-        checksum_regex = re.compile(r'''
-                                    ^MD5\(
-                                    '''
-                                    + re.escape(self.ossec_tarball_filename) +
-                                    r'''\)=\s+(?P<ossec_md5_checksum>[0-9a-f]{32})\s+
-                                    SHA1\(
-                                    '''
-                                    + re.escape(self.ossec_tarball_filename) +
-                                    r'''\)=\s+(?P<ossec_sha1_checksum>[0-9a-f]{40})$
-                                    ''', re.VERBOSE | re.MULTILINE
-                                    )
-        checksum_list = r.content.rstrip()
-        results = re.match(checksum_regex, checksum_list).groupdict()
-        return results
+    def ossec_signature_filename(self):
+        return "ossec-hids-{}.tar.gz.asc".format(self.ossec_version)
 
 
 def main():
     module = AnsibleModule(  # noqa: F405
         argument_spec=dict(
-            ossec_version=dict(default="2.8.2"),
+            ossec_version=dict(default="3.0.0"),
         ),
         supports_check_mode=False
     )


Test patch:
diff --git a/molecule/builder/tests/vars.yml b/molecule/builder/tests/vars.yml
--- a/molecule/builder/tests/vars.yml
+++ b/molecule/builder/tests/vars.yml
@@ -1,6 +1,6 @@
 ---
 securedrop_version: "0.10.0~rc1"
-ossec_version: "2.8.2"
+ossec_version: "3.0.0"
 keyring_version: "0.1.2"
 config_version: "0.1.1"
 grsec_version: "4.4.144"