updated to include rhel9 cp39 builds & airgaps.

Author: cs-shadowbq

.github/workflows/test.yml

@@ -24,7 +24,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.13", "3.14"]
+        python-version: ["3.9", "3.11", "3.13", "3.14"]
 
     permissions:
       contents: read

Dockerfile

@@ -57,7 +57,7 @@ RUN mkdir -p /app/data /app/output /app/config /app/logs && \
     chmod -R g=u /app
 
 # Copy Python packages from builder
-COPY --from=builder --chown=1001:0 /opt/app-root/lib/python3.12/site-packages /opt/app-root/lib/python3.11/site-packages
+COPY --from=builder --chown=1001:0 /opt/app-root/lib/python3.12/site-packages /opt/app-root/lib/python3.12/site-packages
 
 # Copy console script from builder
 COPY --from=builder --chown=1001:0 /opt/app-root/bin/policy-audit /opt/app-root/bin/policy-audit

INSTALL.md

@@ -0,0 +1,130 @@
+# Installation
+
+## Standard Install (from GitHub release)
+
+Download the wheel from the
+[GitHub Releases](https://github.com/cs-shadowbq/falcon-policy-scoring/releases)
+page:
+
+```bash
+pip install falcon_policy_scoring-1.8.0-py3-none-any.whl
+```
+
+Or install directly from the repository:
+
+```bash
+pip install git+https://github.com/cs-shadowbq/falcon-policy-scoring.git@v1.8.0
+```
+
+## Development Install
+
+```bash
+git clone https://github.com/cs-shadowbq/falcon-policy-scoring.git
+cd falcon-policy-scoring
+pip install -e ".[dev,test]"
+```
+
+## Airgapped Install (RHEL 9 x86_64)
+
+For disconnected/air-gapped environments without internet access on the target host.
+
+### Download the Bundle
+
+From the [GitHub Releases](https://github.com/cs-shadowbq/falcon-policy-scoring/releases)
+page, download the appropriate airgap bundle:
+
+| Bundle | Target |
+|--------|--------|
+| `falcon-policy-scoring-*-airgap-rhel9-cp39-x86_64.tar.gz` | Python 3.9 (RHEL 9 default) |
+| `falcon-policy-scoring-*-airgap-rhel9-cp311-x86_64.tar.gz` | Python 3.11 |
+
+### Install on Target
+
+Transfer the tarball to the airgapped host:
+
+```bash
+tar xzf falcon-policy-scoring-*-airgap-rhel9-*.tar.gz
+cd falcon-policy-scoring-*-airgap-*/
+./install.sh
+```
+
+The installer auto-detects whether `pip` is available and falls back to manual
+wheel extraction if not.
+
+### Manual Install (no pip, no root)
+
+If you need full control over where packages land:
+
+```bash
+mkdir -p ~/pylibs
+for whl in wheels/*.whl; do unzip -q -o "$whl" -d ~/pylibs/; done
+export PYTHONPATH=~/pylibs:$PYTHONPATH
+python3 -m falcon_policy_scoring --help
+```
+
+Add the `PYTHONPATH` export to your `~/.bashrc` to make it persistent.
+
+### Building the Airgap Bundle Yourself
+
+On a machine with internet access:
+
+```bash
+# Build wheel + both Python 3.9 and 3.11 bundles
+make airgap
+
+# Or target a specific Python version
+make airgap AIRGAP_PYTHON=39
+
+# The script can also be run standalone
+./scripts/build-airgap.sh --python 39,311
+```
+
+Outputs land in `dist/`:
+
+```
+dist/
+├── falcon_policy_scoring-1.8.0-py3-none-any.whl
+├── falcon-policy-scoring-1.8.0.tar.gz
+├── falcon-policy-scoring-1.8.0-airgap-rhel9-cp39-x86_64.tar.gz
+└── falcon-policy-scoring-1.8.0-airgap-rhel9-cp311-x86_64.tar.gz
+```
+
+Each airgap bundle contains:
+
+- `wheels/` — all runtime dependency wheels pre-compiled for the target
+- `install.sh` — auto-installer (uses pip if available, falls back to unzip)
+- `sbom.cdx.json` — CycloneDX 1.5 SBOM listing all bundled components and versions
+- `README.md` — quick-start instructions
+
+## Creating a GitHub Release
+
+Build everything and push to GitHub in one step (requires `gh` CLI):
+
+```bash
+make release
+```
+
+This runs `dist` + `airgap` then uses `gh release create` to publish:
+
+- The `.whl` (universal wheel)
+- The `.tar.gz` (sdist)
+- Both airgap bundles
+
+### Prerequisites
+
+- [GitHub CLI](https://cli.github.com/) installed and authenticated (`gh auth login`)
+- Git tag matching the version in `pyproject.toml` (e.g., `git tag v1.8.0 && git push --tags`)
+
+### Manual Release Workflow
+
+```bash
+# 1. Bump version in pyproject.toml
+# 2. Commit and tag
+git add pyproject.toml
+git commit -m "Release v1.8.0"
+git tag v1.8.0
+git push && git push --tags
+
+# 3. Build and release
+make release
+```

Makefile

@@ -1,4 +1,4 @@
-.PHONY: docs clean docs-serve install test test-coverage test-coverage-serve workflows run help requirements docker-build docker-test docker-push k8s-deploy k8s-delete run-daemon
+.PHONY: docs clean docs-serve install test test-coverage test-coverage-serve workflows run help requirements docker-build docker-test docker-push k8s-deploy k8s-delete run-daemon dist dist-clean airgap release
 
 help:
 	@echo "Available Make Targets:"
@@ -22,6 +22,12 @@ help:
 	@echo "  install                  Install all dependencies"
 	@echo "  requirements             Generate requirements.txt files from pyproject.toml"
 	@echo ""
+	@echo "Distribution Targets:"
+	@echo "  dist                     Build wheel and sdist"
+	@echo "  dist-clean               Clean dist/ and build artifacts"
+	@echo "  airgap                   Build airgap bundles (RHEL 9 x86_64)"
+	@echo "  release                  Create GitHub release with all artifacts (via gh CLI)"
+	@echo ""
 	@echo "Daemon Mode Targets:"
 	@echo "  run-daemon               Run daemon locally"
 	@echo "  docker-build             Build Docker image [TAG=version]"
@@ -33,8 +39,13 @@ help:
 	@echo "Environment Variables:"
 	@echo "  REGISTRY=registry.com    Docker registry (required for push)"
 	@echo "  TAG=version              Docker image tag (default: latest)"
+	@echo "  AIRGAP_PYTHON=39,311     Python versions for airgap bundles (default: 39,311)"
 	@echo ""
 	@echo "Examples:"
+	@echo "  make dist                          Build wheel"
+	@echo "  make airgap                        Build airgap bundles for Python 3.9 + 3.11"
+	@echo "  make airgap AIRGAP_PYTHON=39       Build only Python 3.9 bundle"
+	@echo "  make release                       Push dist + airgap to GitHub release"
 	@echo "  make docker-build TAG=v1.0.0"
 	@echo "  export REGISTRY=docker.io/myuser && make docker-push"
 	@echo "  REGISTRY=ghcr.io/org TAG=dev make docker-push"
@@ -53,7 +64,7 @@ docs:
 	sphinx-apidoc -o docs/source src/falcon_policy_scoring
 	cd docs && make html
 
-clean:
+clean: dist-clean clean-test
 	@rm -rf data/*.json data/*.db data/*.sqlite && echo 'Cleaned database files in data/'
 	@rm -rf logs/*.log && echo 'Cleaned log files in logs/'
 	@rm -f results.json && echo 'Cleaned results.json'
@@ -165,9 +176,77 @@ requirements:
 #   REGISTRY=ghcr.io/myorg TAG=dev make docker-push
 
 TAG ?= latest
+AIRGAP_PYTHON ?= 39,311
 
 # Extract version from pyproject.toml
-VERSION := $(shell python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])" 2>/dev/null || echo "0.0.0")
+VERSION := $(shell python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])" 2>/dev/null || python3 -c "import tomli as tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])" 2>/dev/null || echo "0.0.0")
+
+# --- Distribution targets ---
+
+dist: dist-clean
+	@echo "Building wheel and sdist for v$(VERSION)..."
+	python3 -m pip install --quiet build
+	python3 -m build
+	@echo ""
+	@echo "Verifying wheel installs correctly..."
+	@python3 -m pip install --quiet --force-reinstall dist/*.whl
+	@policy-audit --version
+	@echo ""
+	@echo "Artifacts:"
+	@ls -lh dist/
+
+dist-clean:
+	@rm -rf dist/ build/ src/*.egg-info
+	@echo "Cleaned dist/, build/, *.egg-info"
+
+airgap: dist
+	@echo ""
+	@echo "Building airgap bundles for Python $(AIRGAP_PYTHON)..."
+	@chmod +x scripts/build-airgap.sh
+	scripts/build-airgap.sh --python $(AIRGAP_PYTHON)
+
+release: dist airgap
+	@echo ""
+	@echo "=== Creating GitHub Release v$(VERSION) ==="
+	@if ! command -v gh &>/dev/null || ! gh auth status &>/dev/null; then \
+		echo ""; \
+		echo "gh CLI is not available or not authenticated."; \
+		echo "To publish this release manually:"; \
+		echo ""; \
+		echo "1. Tag the release:"; \
+		echo ""; \
+		echo "   git tag v$(VERSION)"; \
+		echo "   git push origin v$(VERSION)"; \
+		echo ""; \
+		echo "2. Go to: https://github.com/cs-shadowbq/falcon-policy-scoring/releases/new"; \
+		echo ""; \
+		echo "3. Select tag: v$(VERSION)"; \
+		echo "   Title: falcon-policy-scoring v$(VERSION)"; \
+		echo "   Description: Click 'Generate release notes' for changelog"; \
+		echo ""; \
+		echo "4. Attach these files from dist/:"; \
+		echo ""; \
+		ls dist/*.whl dist/*.tar.gz dist/SHA256SUMS 2>/dev/null | sort -u | sed 's/^/   /'; \
+		echo ""; \
+		echo "5. Verify checksums match dist/SHA256SUMS after upload."; \
+		echo ""; \
+	else \
+		echo ""; \
+		echo "Release artifacts:"; \
+		ls dist/*.whl dist/*.tar.gz dist/*-airgap-*.tar.gz dist/SHA256SUMS 2>/dev/null; \
+		echo ""; \
+		echo "Creating release..."; \
+		gh release create "v$(VERSION)" \
+			--title "falcon-policy-scoring v$(VERSION)" \
+			--generate-notes \
+			--notes-start-tag "$$(git tag --sort=-v:refname | sed -n '2p')" \
+			dist/*.whl \
+			dist/*.tar.gz \
+			dist/*-airgap-*.tar.gz \
+			dist/SHA256SUMS; \
+		echo ""; \
+		echo "Release published: https://github.com/cs-shadowbq/falcon-policy-scoring/releases/tag/v$(VERSION)"; \
+	fi
 
 run-daemon:
 	python bin/policy-audit daemon --config config/config.yaml --output-dir ./output --verbose

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "falcon-policy-scoring"
-version = "1.8.0"
+version = "1.8.1"
 description = "CrowdStrike Falcon policy analysis and grading tool"
 readme = "README.md"
 license = { file = "LICENSE.md" }
@@ -14,7 +14,7 @@ maintainers = [
     { name = "Scott MacGregor", email = "scott.macgregor@crowdstrike.com" },
 ]
 dependencies = [
-    "crowdstrike-falconpy>=1.5.4",
+    "crowdstrike-falconpy>=1.6.3",
     "tinydb>=4.8.0",
     "schedule>=1.2.2",
     "pyyaml>=6.0.3",
@@ -27,14 +27,18 @@ dependencies = [
 dev = ["packaging>=25.0", "rich>=14.2.0"]
 dynamodb = ["boto3>=1.34.0"]
 test = [
-    "pytest>=9.0.2",
-    "pytest-cov>=7.0.0",
+    "pytest>=9.0.2; python_version >= '3.10'",
+    "pytest>=8.0.0; python_version < '3.10'",
+    "pytest-cov>=7.0.0; python_version >= '3.10'",
+    "pytest-cov>=5.0.0; python_version < '3.10'",
     "pytest-vcr>=1.0.2",
     "freezegun>=1.5.5",
-    "vcrpy>=8.1.1",
-    "jsonschema>=4.26.0",
+    "vcrpy>=8.1.1; python_version >= '3.10'",
+    "vcrpy>=6.0.0; python_version < '3.10'",
+    "jsonschema>=4.20.0",
     "boto3>=1.34.0",
-    "moto[dynamodb]>=5.0.0",
+    "moto[dynamodb]>=5.0.0; python_version >= '3.10'",
+    "moto[dynamodb]>=4.2.0; python_version < '3.10'",
 ]
 docs = ["sphinx>=8.2.3", "sphinx-autodoc-typehints>=3.2.0"]