Added "parrot" command, removed CodeQL action file in favor of built-…

…in advanced security bot

.github/workflows/go.yml

@@ -0,0 +1,63 @@
+# This workflow will build a golang project
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
+
+name: "Merlin Server Build & Test"
+
+on:
+  push:
+  pull_request:
+
+jobs:
+
+  build:
+    name: 'Build Job'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        id: checkout
+        uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: '1.21'
+
+      - name: 'Build Merlin Server'
+        id: build
+        run: 'make distro'
+
+      - name: 'Test Merlin Server'
+        id: test
+        run: 'go test ./...'
+
+      - name: GoVulnCheck
+        id: govulncheck
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: '1.21'
+          go-package: './...'
+
+      - name: Gosec Security Scanner
+        id: gosec
+        uses: securego/gosec@master
+        with:
+          args: '-fmt sarif -out gosec.sarif ./...'
+
+      - name: Upload Gosec SARIF file
+        id: gosec_upload_sarif
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: gosec.sarif
+
+      - name: Go Report Card - Install
+        id: goreportcard_install
+        working-directory: /tmp
+        run: |
+          git clone https://github.com/gojp/goreportcard.git
+          cd goreportcard
+          make install
+          go install ./cmd/goreportcard-cli
+
+      - name: Go Report Card - Run
+        id: goreportcard_run
+        run: 'goreportcard-cli -v' # This renames the files in the ./rpc directory to *.grc.bak causing builds to fail

.github/workflows/release.yml

@@ -0,0 +1,105 @@
+name: "Merlin Server Release"
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+defaults:
+  run:
+    working-directory: ~/
+
+jobs:
+  release:
+    name: 'Release Job'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Merlin
+        id: checkout_merlin
+        uses: actions/checkout@v4
+
+      - name: Checkout Merlin-Agent
+        id: checkout_merlin_agent
+        uses: actions/checkout@v4
+        with:
+          repository: 'Ne0nd0g/merlin-agent'
+          path: 'merlin-agent'
+
+      - name: Checkout Merlin-Agent-DLL
+        id: checkout_merlin_agent_dll
+        uses: actions/checkout@v4
+        with:
+          repository: 'Ne0nd0g/merlin-agent-dll'
+          path: 'merlin-agent-dll'
+
+      - name: Checkout Merlin CLI
+        id: checkout_merlin_cli
+        uses: actions/checkout@v4
+        with:
+          repository: 'Ne0nd0g/merlin-cli'
+          path: 'merlin-cli'
+
+      - name: Set up Go
+        id: setup_go
+        uses: actions/setup-go@v4
+        with:
+          go-version: '1.21'
+
+        # Need 7zip installed to package up the release
+      - name: Install 7zip
+        id: install_7zip
+        run: apt-get install p7zip-full
+
+        # Need MingGW installed to build the Agent DLL
+      - name: Install MingGW
+        id: install_mingw
+        run: apt-get install -y -q mingw-w64
+
+      - name: Build Merlin Agents
+        id: build_agents
+        working-directory: merlin-agent
+        run: |
+          pwd
+          make distro
+
+      - name: Build Merlin Agent DLL
+        id: build_agent_dll
+        working-directory: merlin-agent-dll
+        run: make default
+
+      - name: Move Agents
+        id: move_agents
+        run: |
+          mkdir -p data/bin
+          cp ~/merlin-agent/merlinAgent-* ~/merlin/data/bin
+          cp ~/merlin-agent-dll/merlinAgent.dll ~/merlin/data/bin
+
+      - name: Build Merlin CLI
+        id: build_cli
+        working-directory: merlin-cli
+        run: make all
+
+      - name: Build Merlin Server
+        id: build_server
+        working-directory: merlin
+        run: make distro
+
+      - name: Package Release
+        id: package_release
+        working-directory: merlin
+        run: |
+          F="README.MD LICENSE data/modules docs data/README.MD data/agents/README.MD data/log/README.MD data/x509 data/src data/bin"
+          7za a -pmerlin -mhe -mx=9 merlinServer-Linux-x64.7z $F merlinCLI-Linux-x64 merlinServer-Linux-x64
+
+      - name: Create Draft Release
+        id: create_draft_release
+        uses: ncipollo/release-action@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag: ${{ github.ref_name }}
+          name: ${{ github.ref_name }}
+          draft: true
+          prerelease: false
+          artifactErrorsFailBuild: true
+          artifacts: '*.7z'

Makefile

@@ -21,30 +21,32 @@ default:
 
 # Compile Server - Windows x64
 windows:
-	export GOOS=windows;export GOARCH=amd64;go build ${LDFLAGS} -o ${DIR}/merlinServer-Windows-x64.exe main.go
+	export GOOS=windows && export GOARCH=amd64 && go build ${LDFLAGS} -o ${DIR}/merlinServer-Windows-x64.exe main.go
 
 # The SEED must be the exact same that was used when compiling the agent
 # Garble version 0.5.2 or later must be installed and accessible in the PATH environment variable
 windows-garble:
-	export GOGARBLE=${GOGARBLE};export GOOS=windows GOARCH=amd64;garble -tiny -literals -seed ${SEED} build ${LDFLAGS} -o ${DIR}/merlinServer-Windows-x64.exe main.go
+	export GOGARBLE=${GOGARBLE} && export GOOS=windows GOARCH=amd64 &&garble -tiny -literals -seed ${SEED} build ${LDFLAGS} -o ${DIR}/merlinServer-Windows-x64.exe main.go
 
 # Compile Server - Linux x64
 linux:
-	export GOOS=linux;export GOARCH=amd64;go build ${LDFLAGS} -o ${DIR}/merlinServer-Linux-x64 main.go
+	export GOOS=linux && export GOARCH=amd64 && go build ${LDFLAGS} -o ${DIR}/merlinServer-Linux-x64 main.go
 
 # The SEED must be the exact same that was used when compiling the agent
 # Garble version 0.5.2 or later must be installed and accessible in the PATH environment variable
 linux-garble:
-	export GOGARBLE=${GOGARBLE};export GOOS=linux GOARCH=amd64;garble -tiny -literals -seed ${SEED} build ${LDFLAGS} -o ${DIR}/merlinServer-Linux-x64 main.go
+	export GOGARBLE=${GOGARBLE} && export GOOS=linux GOARCH=amd64 && garble -tiny -literals -seed ${SEED} build ${LDFLAGS} -o ${DIR}/merlinServer-Linux-x64 main.go
 
 # Compile Server - Darwin x64
 darwin:
-	export GOOS=darwin;export GOARCH=amd64;go build ${LDFLAGS} -o ${DIR}/merlinServer-Darwin-x64 main.go
+	export GOOS=darwin && export GOARCH=amd64 && go build ${LDFLAGS} -o ${DIR}/merlinServer-Darwin-x64 main.go
 
 # The SEED must be the exact same that was used when compiling the agent
 # Garble version 0.5.2 or later must be installed and accessible in the PATH environment variable
 darwin-garble:
-	export GOGARBLE=${GOGARBLE};export GOOS=darwin GOARCH=amd64;garble -tiny -literals -seed ${SEED} build ${LDFLAGS} -o ${DIR}/merlinServer-Darwin-x64.exe main.go
+	export GOGARBLE=${GOGARBLE} && export GOOS=darwin GOARCH=amd64 && garble -tiny -literals -seed ${SEED} build ${LDFLAGS} -o ${DIR}/merlinServer-Darwin-x64.exe main.go
+
+distro: windows linux darwin
 
 clean:
 	rm -rf ${DIR}*

go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/cretz/gopaque v0.1.0
 	github.com/go-jose/go-jose/v3 v3.0.0
 	github.com/google/uuid v1.4.0
-	github.com/quic-go/quic-go v0.39.3
+	github.com/quic-go/quic-go v0.40.0
 	go.dedis.ch/kyber/v3 v3.1.0
 	golang.org/x/net v0.17.0
 	golang.org/x/sync v0.4.0

go.sum

@@ -38,6 +38,8 @@ github.com/quic-go/qtls-go1-20 v0.4.1 h1:D33340mCNDAIKBqXuAvexTNMUByrYmFYVfKfDN5
 github.com/quic-go/qtls-go1-20 v0.4.1/go.mod h1:X9Nh97ZL80Z+bX/gUXMbipO6OxdiDi58b/fMC9mAL+k=
 github.com/quic-go/quic-go v0.39.3 h1:o3YB6t2SR+HU/pgwF29kJ6g4jJIJEwEZ8CKia1h1TKg=
 github.com/quic-go/quic-go v0.39.3/go.mod h1:T09QsDQWjLiQ74ZmacDfqZmhY/NLnw5BC40MANNNZ1Q=
+github.com/quic-go/quic-go v0.40.0 h1:GYd1iznlKm7dpHD7pOVpUvItgMPo/jrMgDWZhMCecqw=
+github.com/quic-go/quic-go v0.40.0/go.mod h1:PeN7kuVJ4xZbxSv/4OX6S1USOX8MJvydwpTx31vx60c=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=

pkg/merlin.go

@@ -21,7 +21,7 @@ along with Merlin.  If not, see <http://www.gnu.org/licenses/>.
 package merlin
 
 // Version is a constant variable containing the version number for the Merlin package
-const Version = "1.6.0"
+const Version = "2.0.0"
 
 // Build is a hash off the git commit and is stamped it at compile time
 var Build = "nonRelease"