Overhaul validation and publication

This is the review record for the local overhaul, based on application commit 8d575ca. At the original local handoff, no commits, pushes, remote releases, website deployments, DNS changes, or production-server changes had been made. The maintainer has since authorized publishing main, running the hosted checks, and deploying the Pages preview. The measurements below record the local validation; current hosted results are available in GitHub Actions. The plan is in plan-overhaul.md; ongoing commands and release gates are in doc/maintenance.md and site/README.md.

Implemented scope

• Shared qmake source/resource configuration; production UI scenario code moved to tests; persistence, classification, archive handling, and checklist parsing/writing split behind their existing interfaces.
• Bounded, TLS-verified downloads; static stable-release and exact STIG catalog contracts; verified catalog cache and temporary quarterly-archive reuse within each import batch; explicit failure reporting and manual import fallback.
• Latest-stable checks use https://squinky86.github.io/STIGQter/metadata/v1/releases.json. This is the corrected endpoint in the existing STIGQter repository. Stable metadata is generated from verified published packages; the 2.0.0 release record appears below. Older published versions never trigger a downgrade prompt.
• Worker/thread/SQL cleanup; XCCDF imports moved off the GUI thread with transactional updates and selection preservation; remapping transactions; atomic project/checklist writes; indexed checklist upgrades.
• Two application workflows (CI and draft release), shared build scripts, explicit Ubuntu 26.04 runners, pinned static Qt 6.12 Windows sources, and Pages build/deployment/monitoring alongside them in the same repository.
• Static historical website, immutable metadata/catalog generation, current public DISA content inventory, repaired legacy PHP contracts, rollback snapshots, and operator handoff.

Application name, absence of a Qt organization name, default/portable data locations, schema version 10, UI forms/object names, embedded control catalogs, and version 2.0.0 are unchanged. No maintainer assessment database was used. Source validation used shadow builds, and the root application was also rebuilt for local review. Generated Makefiles/objects/resources/binaries remain ignored and were not manually edited or staged. Review artifacts are ignored under .build/.

Linux and application evidence

Environment: Ubuntu 26.04.1, GCC 15.2, Qt 6.10.2, libzip 1.11.4, libxlsxwriter 1.2.4. The requested Qt 6.12 upgrade applies to the static Windows toolchain; Linux uses Ubuntu's Qt development packages.

The original integration suite passed 19 tests, zero failures in 162.7 seconds. The expanded suite runs with unique application identity, isolated settings/data/cache and disposable fixture/output directories, using Qt's offscreen platform here. It does not download the live quarterly archive. Text and JUnit results are in .build/results/tests.txt and .build/results/tests.xml.

The expanded tests exercise the existing assessment/report workflow plus HTTP status/redirect/loop/disconnect/timeout/size failures, untrusted TLS, stable-version validation, exact catalog matching/cache recovery/checksums and repeated member extraction after the original archive becomes unavailable, corrupt ZIPs, worker failure/connection cleanup, XCCDF parsing and rollback, remapping rollback, schema 9→10 project migration, future-schema rejection, failed/active-database snapshot writes, CKL serialization and CKLB round trips, nested export failures, and upgrade field/marking preservation. Bulk-export tests also verify files are created in both formats/modes; normalized forward-slash containment fixes an existing Windows separator mismatch that could silently skip exports. The tests found and fixed CKLB not_a_finding being re-imported as Not Reviewed. Upgrade indexing preserves the previous first-match behavior while avoiding repeated nested database queries.

Timing is diagnostic only: the suite has more cases than the baseline and other builds ran concurrently. Do not interpret whole-suite times as a controlled performance benchmark.

Final application/test builds passed. The final expanded run passed 30 tests, zero failures/skips in 252.059 seconds while the clean Windows build and package build ran concurrently. The ASD upgrade fixture preserves status, comments, findings, override/justification, and marking; its timing is recorded in the test log.

The Ubuntu .deb builds successfully from a clean POSIX staging copy, with tracked Git file modes restored. Local debhelper tools were extracted without privilege and LOCAL_UNPRIVILEGED_PACKAGE=1 skipped only the installed build-dependency check; CI installs those dependencies normally. apt-get --simulate install resolves the package without removals. The extracted binary resolves all shared libraries, starts offscreen for five seconds, and creates a valid SQLite database in an isolated data directory. PRAGMA quick_check passes. This smoke run terminates the temporary process after startup; it is not a graceful-shutdown or system-install test.

Review artifacts are under .build/dist/: the Ubuntu 26.04 amd64 .deb, clean source archive, Windows portable .exe/.zip, and SHA-256 lists. Package inspection, install simulation, startup evidence, PE checks, and Qt Test logs are under .build/results/.

Windows toolchain validation

The initial source build produced matching host and target Qt 6.12.0 and a linked Windows application using the manifest-pinned dependencies. PE inspection passes the Windows-system-DLL allowlist and required ASLR, DEP, and high-entropy-VA flags (0x0160). Control Flow Guard is not emitted by this MinGW toolchain and is informational in the checker. Static plugin registration includes Windows integration, SQLite, OpenSSL and Schannel.

Two toolchain compatibility corrections are included: a scoped libzip DWORD_MAX definition for the selected MinGW headers, and direct host-qmake invocation with target_qt.conf because Qt's generated cross wrapper splits quoted compiler assignments. The reviewed system-library allowlist includes Qt 6.12's Direct3D 12 and Windows color management imports. Non-system runtime DLLs remain forbidden.

Both local attempts to compile the complete toolchain from clean sources reached the target plugins but exceeded this environment's per-user temporary-filesystem quota while writing precompiled headers. The second attempt used the final script's host-build cleanup and still needed the local storage workaround. The target build then completed and installed after relocating only its temporary precompiled headers to disk; source/configuration/compiler flags were unchanged. The application build directory was cleared for a fresh application compilation against that completed toolchain. This local evidence is successful source compilation with a documented resume. The subsequent hosted cold run completed uninterrupted on the normal runner workspace; see the publication evidence below.

The fresh Windows application build and portable EXE/ZIP packaging pass. A repeat run reuses the toolchain in 4.15 seconds. After removing Qt source/build scratch directories and the application build directory, a fresh application build using only the installed toolchain cache passes in 63.12 seconds; its EXE SHA-256 matches the previous build. This validates the installed cache rather than depending on leftover Qt build files.

The cache check exposed strip rewriting the PE timestamp. Packaging now uses --preserve-dates, retaining the linker's zero timestamp; the PE checker enforces that property. The prepared toolchain was reused for this packaging-only correction, which does not change its source/configuration/compiler flags. Repeat packaging and the fresh cache build produce the same executable bytes. ZIP container timestamps are not claimed reproducible.

Temporary Qt precompiled headers and source/build scratch directories were removed after installation. The installed local toolchain and verified source downloads remain under /tmp/stigqter-overhaul/; these temporary paths are evidence from this session, not permanent release infrastructure. The uninterrupted hosted cold build has now passed. Native Windows execution remains required before publishing a stable desktop release.

Website and content evidence

Website changes were prepared in /mnt/win/projects/websites/stigqter.com; this directory was not a Git repository at the start. The source has since moved into site/ in the STIGQter repository at the maintainer’s request. Original changed/removed PHP and shell files were backed up under /tmp/stigqter-overhaul/website-before/. The built _site directory, private .cache, backups, and local server configuration are excluded from source commits.

• Five Python/PHP integration tests pass, covering invalid/corrupt/ambiguous/reduced catalogs without manifest replacement, stable-release validation, and real local HTTP legacy contracts including exact nested ZIP retrieval and 404/503 failures.
• PHP syntax checks pass for the three compatibility endpoints and shared metadata helper. Python compilation and shell/workflow syntax checks pass.
• The internal link crawl passes across 20,175 HTML pages. The static builder preserves those pages, strips historical analytics/advertising scripts from the publication artifact, and excludes PHP, server settings, caches, backups, and assessment data. The built public inputs total 20,194 files / 77,528,628 bytes, well below the configured 250 MiB budget.
• The October 2026 public quarterly ZIP was downloaded and hashed: 375,827,141 bytes, SHA-256 ea581eb2d5c4a210440852b67ea4dd9564fffdf57c8c94aec971047fe0c01d1d, 399 exact STIG identities. The preceding verified July manifest/catalog is retained for rollback; immutable catalogs remain published across manifest updates.
• The replacement HTML generator processed all 399 October guides into a separate local preview. The historical published-content snapshot was preserved; it is not represented as an October regeneration.
• The NIST generator's pinned source reproduces the bundled XML byte for byte: 324 controls and 872 enhancements. The embedded file was not changed.

Hosted publication evidence

Published on 3 November 2026 (America/Chicago), after the maintainer authorized pushing main and the Pages preview:

• Application commit b6224ac is on main, which is now the default branch. The old master branch is retained. A duplicate push-triggered CI run was cancelled before the full manual run to avoid two simultaneous cold toolchain builds.
• Full hosted CI exercises all four jobs on Ubuntu 26.04. Linux build/test/package and CodeQL pass. The ordinary integration run passes all 30 tests in 63.985 seconds; the instrumented run passes all 30 in 69.097 seconds. Downloaded Ubuntu package/source artifacts pass their SHA-256 checks.
• The static Windows Qt 6.12.0 job passes from an empty cache in 46 minutes 1 second, including dependency/host/target builds, application compilation, portable packaging, and cache upload. The downloaded EXE/ZIP pass their SHA-256 checks; hosted PE validation confirms only Windows system imports, ASLR/DEP/high-entropy VA, and a zero build timestamp. The installed toolchain cache is saved successfully under main (61,315,474 compressed bytes). No manual build resume or local storage workaround was needed on the hosted runner.
• Coverage generation and both publishers pass. LCOV contains 66 source files and 5,914 covered lines out of 7,176. Sonar analysis reports execution success, and Coveralls accepts the report from that same test execution.
• The initial website deployment used a separate repository by mistake. The maintainer corrected that layout on 4 November; the replacement uses the existing STIGQter repository’s Pages workflow and preserves the local site source. The old repository is not required.
• Anonymous GETs return HTTP 200 for the homepage, logo, historical rule pages, and both metadata manifests. The immutable catalog's SHA-256 matches its manifest and contains 399 entries. The hosted monitor reports Healthy: stable 1.2.7, 399 STIGs, metadata age 0 days and checks release/download targets.

Pages uses its project URL with HTTPS and no custom domain yet. No stable desktop release/tag, DNS cutover, or production legacy-host deployment was performed. The draft-release workflow was syntax-checked but deliberately not dispatched without a release candidate tag. Native platform acceptance remains a release gate.

Website repository correction — 4 November 2026

The site is now maintained under site/ in this repository. Its Pages workflow builds the historical public library and renders the user guide, README, release notes, security policy, and maintenance documentation from their Markdown sources. The link crawl handles the /STIGQter/ project prefix and the custom-domain root. Desktop release/content checks target https://squinky86.github.io/STIGQter/metadata/v1/.

The separate-repository deployment described in the original publication was an incorrect interpretation of the intended layout. The local source was preserved before the maintainer proposed deleting that repository. No separate checkout or repository is needed to build or maintain the replacement site. Domain/DNS gates below still apply. Desktop publication is recorded in the following release section.

Local consolidation checks pass: eight website tests, the full link crawl over 20,184 HTML pages, and generated documentation previews at 390×844 and 1440×1000. The public artifact contains 20,207 files and remains about 74 MiB. PHP, caches, backups, server configuration, and assessment files remain excluded. The Pages workflow uses Ubuntu 26.04 and runs the live site/metadata monitor after deployment. The application and test targets rebuild successfully, and the isolated desktop suite passes all 30 tests with no failures or skips in 181.805 seconds. The successful standalone test run followed an interrupted combined build/test invocation.

STIGQter 2.0.0 release — 7 November 2026

Release 2.0.0 is published from annotated tag 2.0.0, commit 7c74a6d8067a684b588b87d6ee9a900b3177b6b4. The tag-triggered release workflow passed tag/VERSION validation, Linux build/tests/package installation and removal, static Windows builds and PE checks, native Windows validation, and draft creation with all six attachments. The main CI run for that commit also passed, including CodeQL. The coverage job using stable action tags passed Sonar and Coveralls publication.

The tagged native Windows run passed 31 tests, zero failures/skips on Windows Server 2025 with static Qt 6.12.0. This includes checklist import/export, reports, classification, SQLite, untrusted TLS rejection, and a live check of the default GitHub Pages release URL. The shipped EXE then passed visible-window startup, database initialization, startup version checking, and clean shutdown with both portable and normal user databases, with only Windows system directories on PATH. Windows testing exposed retained temporary-file handles and an insufficient test import timeout; the fixtures now use temporary directories and the full four-guide import has a bounded four-minute allowance. Native window detection accepts Qt's application-name suffix.

The release EXE is x64 PE32+, imports only Windows system DLLs (including delayed imports), enables ASLR/DEP/high-entropy VA, and retains a zero PE build timestamp after stripping. The ZIP contains the exact same executable plus LICENSE, README, CHANGES, and the pinned dependency source manifest.

All six public assets were downloaded anonymously and matched GitHub's SHA-256 digests, the checked checksum files, and the tagged workflow artifacts. The source archive's VERSION, update worker/URL, dependency manifest, and CI configuration match the tag. Stable metadata was generated from the published release API response after these checks. The site generates its download links from that same manifest, and nine site tests pass, including version/link consistency and rejection of unrelated package URLs.

Remaining platform and domain acceptance

• Complete maintainer desktop acceptance on the intended Windows client versions and interactive Linux systems. The native automated evidence above is from Windows Server 2025; the Windows package is portable and does not include an NSIS installer.
• Configure branch protection if desired, including the native Windows runtime job alongside Linux build/tests/package, static Windows Qt, and CodeQL.
• Inventory and back up live website configuration, DNS, TLS, and cron state; assign primary and backup operators; validate supported legacy clients against the compatibility bridge before any domain cutover or retirement.
• Retain previous releases, complete metadata/catalog snapshots, and bridge archives for rollback. Legacy endpoint retirement remains a separate support decision.

View this page’s Markdown source