# Ubuntu STIG Preflight

`ubuntu-stig-preflight/1.0.0` is a read-only Ubuntu evidence collector for
readiness and preflight review. It supports Ubuntu `20.04`, `22.04`, and
`24.04`, rejects unsupported releases, never uploads data, and never accepts
credentials or subscription tokens.

## What It Collects

- Ubuntu release and kernel metadata
- Sanitized SSHD, PAM, `faillock`, `sudo`, `sysctl`, `auditd`, AppArmor, AIDE,
  and `chrony` posture when present. Account names, hostnames, endpoints, and
  customer-specific policy targets are omitted.
- Sanitized Ubuntu Pro attachment state and Ubuntu Security Guide availability
- Deterministic normalized evidence states: `collected`, `not_collected`, and
  `unknown`
- `bundle.json`, `manifest.json`, `checksums.sha256`, `redaction/coverage.json`,
  `redaction/inventory.json`, `normalized/evidence.json`, and
  `reports/preflight.json`

## What It Does Not Collect

- `/etc/shadow` contents
- private keys, raw tokens, or credential stores
- hostnames, usernames, account names, internal endpoints, or policy principals
- Kubernetes Secret objects or live-cluster data
- Ubuntu Pro attachment changes, package installation, remediation, or host
  mutation

## Install

```bash
tar -xzf ubuntu-stig-preflight-1.0.0.tar.gz
./ubuntu-stig-preflight/install.sh --prefix ./out/ubuntu-stig-preflight
```

## Run

```bash
./out/ubuntu-stig-preflight/run-collector.sh --output ./out/bundle
```

The collector defaults to the local host. For synthetic fixture tests, pass
`--synthetic-root PATH` to read from a no-network fixture tree instead of `/`.

## Verify Release

```bash
sha256sum -c SHA256SUMS
openssl pkeyutl -verify -pubin \
  -inkey release-signing.pub \
  -rawin -in SHA256SUMS \
  -sigfile SHA256SUMS.sig
```

## Bundle Notes

- `reports/preflight.json` is a readiness-only draft input for private review.
- Missing evidence remains explicit; absence is not relabeled as a control
  failure.
- `redaction/inventory.json` marks every collected artifact with its sensitivity
  and review requirement.