feat(exercise-world): package Nacre and seed MISP

[pparage]

Summary

• add 05_world_layer/ with byte-identical Nacre galaxy/cluster snapshots, CC-BY-4.0 attribution, provenance and generated lookup indexes
• add deterministic relational validation for UUIDs, names, planet, headquarters and origins
• register the world layer in the catalog manifest
• bump MISP standalone from v2.5.37 to v2.5.44, the current approved upstream release candidate for this change
• fail the MISP image build unless its bundled SEWF galaxy and cluster SHA-256 values match the separately vendored snapshots
• verify the loaded galaxy UUID, collection UUID and 60-entity count before importing events
• tag both existing sample events with canonical Nacre country/company/threat-actor galaxy tags

Why the exact hash check matters

MISP and non-MISP consumers must use the same entity revision. UUID/count checks alone would not detect metadata or entity substitutions that preserve the count, so the Docker build ties MISP's bundled files to the vendored snapshot hashes.

Validation

• python3 -m unittest 05_world_layer/tests/test_nacre_world.py -v — 7 tests pass
• python3 05_world_layer/tools/generate_indexes.py --check
• bash -n on all MISP provisioning scripts
• syntax compilation for new Python files
• jq empty on manifests, world data, indexes and MISP event fixtures
• docker compose ... config --quiet
• docker build --check -f Dockerfile . — no warnings
• vendored hashes verified as:
  • cluster: 55afe65a817c167a46dbd26850515aefb2bf72b9318f651d6adb172e498a44b4
  • galaxy: f1fe9a26eae4148542e0d89126cdf4231c803b2c3fd255137b42e2c5f969807a

A full MISP image build/deployment is intentionally left for integration testing because it builds MISP and dependencies from source.

Refs #210
Related: range42/project_management#106

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7c6a932394

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Refresh persisted galaxy files before verification

When upgrading an existing Compose deployment, the misp-files named volume mounted over /var/www/MISP/app/files in docker-compose.yml:71-73 retains the previous v2.5.37 contents and masks the v2.5.44 files checked during the image build. Consequently, provision-content.sh:64-65 imports the old bundled galaxies and this newly mandatory verifier exits before sample-event provisioning because Nacre is absent. Copy or synchronize the new bundled galaxy data into the persistent volume before updating and verifying it.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Update existing sample events instead of skipping them

For deployments where these sample-event UUIDs were imported before this upgrade, provision-sample-events.sh:65-67 detects each existing event and skips it, so none of the newly added Nacre tags are applied. The seeding change therefore only works on fresh databases; the provisioner needs to patch or replace existing fixtures when their contents change.

Useful? React with 👍 / 👎.

[pparage]

Addressed both Codex review findings in d7e4a62:

• the runtime image now retains an immutable /opt/misp-galaxy snapshot and refreshes the persistent misp-files galaxy tree before MISP bootstrap/startup, so an old named volume cannot mask the v2.5.44 definitions
• sample-event provisioning now reconciles existing managed UUIDs through POST /events/edit/<uuid> instead of skipping them
• added regression tests that simulate an old persisted world file and an existing event fixture

Validation: 9 unit tests, generated-index check, shell/Python syntax, JSON validation, Compose config, Docker build check, and whitespace check all pass.