software package profiles implemeted, job deletion optimized

2026-09-26 13:07:23 +02:00
parent 87a5041162
commit 7d314057e4
54 changed files with 3492 additions and 342 deletions
@@ -0,0 +1,64 @@
+# AssetManager Analyzer Profiles
+
+AssetManager 0.5.5.90 separates installer-specific knowledge from the analyzer engine.
+The Python engine performs generic operations such as PE inspection, MSI metadata parsing,
+marker scanning, safe SFX extraction, embedded-installer selection and profile evaluation.
+Product/vendor knowledge is stored in declarative JSON profiles.
+
+## Profile types
+
+Profiles use schema `assetmanager-analyzer-profile-v1` and profile API `1`.
+They can be installed from three sources:
+
+- `system`: shipped with AssetManager under `app/analyzer_profiles/system/`.
+- `community`: imported manually or installed from a configured community repository.
+- `local`: locally maintained profiles. Local profiles override profiles with the same ID.
+
+Imported profiles are stored in `/assetmanager-data/analyzer-profiles` and are included in AssetManager backups.
+Profiles are declarative data only and cannot contain executable Python code.
+
+## Exchange format
+
+Profiles are exported as `.amprofile` files. The file is a ZIP container with:
+
+- `manifest.json`: bundle schema, profile ID/version/API and SHA-256 of `profile.json`.
+- `profile.json`: the validated declarative profile definition.
+
+The import validates paths, size, profile schema/API and SHA-256 before installing the profile.
+
+## Community repository index
+
+A repository is an HTTPS-hosted JSON index. Configure it with:
+
+`ANALYZER_PROFILE_REPOSITORY_URL=https://example.org/assetmanager-profiles/index.json`
+
+Index format:
+
+```json
+{
+  "schema": "assetmanager-analyzer-profile-repository-v1",
+  "name": "AssetManager Community Profiles",
+  "profiles": [
+    {
+      "id": "vendor.example-app",
+      "name": "Example App",
+      "version": "1.0.0",
+      "url": "https://example.org/profiles/vendor.example-app.amprofile",
+      "sha256": "<sha256 of the amprofile file>"
+    }
+  ]
+}
+```
+
+The AssetManager administrator explicitly loads the catalog and chooses which profile to install.
+The bundle SHA-256 is verified when the repository provides one.
+
+## Contributing profiles
+
+A public profile repository can be maintained independently from the AssetManager application
+repository. Contributors only need to submit declarative `.amprofile` bundles and index metadata;
+no AssetManager source-code change is required for ordinary vendor/installer rules.
+
+Use stable profile IDs. Increase the profile version when rules change. Avoid filename-only matching
+when stronger static evidence is available. Silent parameters should only be marked high-confidence
+when they are documented or clearly proven by installer metadata/static analysis.
@@ -0,0 +1,13 @@
+{
+  "schema": "assetmanager-analyzer-profile-repository-v1",
+  "name": "AssetManager Community Profiles",
+  "profiles": [
+    {
+      "id": "vendor.example-app",
+      "name": "Example App",
+      "version": "1.0.0",
+      "url": "https://example.org/profiles/vendor.example-app.amprofile",
+      "sha256": "replace-with-bundle-sha256"
+    }
+  ]
+}