# CMMC Evidence Prep

`cmmc-evidence-prep/1.0.0` is a read-only Ubuntu/Linux evidence preparation
collector for readiness review. It supports Ubuntu `20.04`, `22.04`, and
`24.04`, rejects unsupported releases, and organizes evidence around CMMC Level
2 control-family preparation without claiming an assessment result.

## What It Collects

- Host release metadata without the hostname
- Sanitized account counts plus audit, configuration, maintenance, and
  assessment posture. Usernames, banners, internal endpoints, and policy
  principals are omitted.
- Deterministic evidence states: `collected`, `not_collected`, and `unknown`
- `bundle.json`, `manifest.json`, `checksums.sha256`, `redaction/coverage.json`,
  `redaction/inventory.json`, `normalized/evidence.json`, and
  `reports/preflight.json`

## What It Does Not Collect

- raw secrets, private keys, or `/etc/shadow`
- hostnames, usernames, account names, internal endpoints, or policy principals
- live-service calls, uploads, or remediation changes
- third-party assessment submissions

## Install

```bash
tar -xzf cmmc-evidence-prep-1.0.0.tar.gz
./cmmc-evidence-prep/install.sh --prefix ./out/cmmc-evidence-prep
```

## Run

```bash
./out/cmmc-evidence-prep/run-collector.sh --output ./out/bundle
```

For synthetic no-network tests, pass `--synthetic-root PATH`.

## Verify Release

```bash
sha256sum -c SHA256SUMS
openssl pkeyutl -verify -pubin \
  -inkey release-signing.pub \
  -rawin -in SHA256SUMS \
  -sigfile SHA256SUMS.sig
```