MISPGalaxyCluster blocklist contradicts MISP standard.

[euphoria974]

Introduced in #1459, default galaxies can no longer include a "distribution" field.

As per the MISP standard, the "distribution" field cannot be null/missing, which makes this condition impossible to fulfill (see https://www.misp-standard.org/rfc/misp-standard-core.html#section-2.2.1.14).

Unsure what the fix should be as I'm unaware of the reason behind making the "distribution" field forbidden in the first place, please let me know what you think.

[BBlag]

We hit this concretely via PyMISP.get_event(uuid, pythonify=True): any event referencing a default cluster (in our case a misp-galaxy:threat-actor cluster) that has a distribution value set seems to fail deserialization with:

NewGalaxyClusterError: The field 'distribution' cannot be set on a default galaxy cluster

Traced it to #1459. Before that PR, blocked_fields = ["distribution" "sharing_group_id"] was, due to the missing comma, a single-element list containing the concatenated string, so the check never matched a real field name in practice. #1459 fixed the typo, making the check active for the first time. The underlying from_dict() seems to be reused both for constructing a cluster from user input and for deserializing whatever the server returns, and it now rejects the latter whenever a default cluster happens to carry a distribution value.

Re: the RFC citation above - worth double-checking. Section 2.2.1.14 describes Event.distribution, not GalaxyCluster.distribution. The galaxy_cluster definition in the JSON Schema (section 3 of the same document) doesn't list distribution, sharing_group_id, or default as properties at all. So I'm not sure the standard actually settles this either way for GalaxyCluster specifically. What's certain from our case is just that our server does send distribution on default clusters in practice - so real-world responses can trigger this regardless of what the spec says.

As a temporary workaround we've pinned to 2.5.34.1, the last version without the (now-fixed) typo in blocked_fields.

[Rafiot]

Alright, I'm having a look. This check has been there for 4+ years and broken since then so despite the comment that clearly states that is shouldn't be there, I have no idea why.

Checking with MISP core to see what is correct and probably (?) removing distribution from the list. It might also just be ignored on MISP side.