From 3253f6e16cd4cdc3f1c49ce1996448c837095feb Mon Sep 17 00:00:00 2001
From: Miguel Jacq <mig@mig5.net>
Date: Tue, 14 Jul 2026 17:36:59 +1000
Subject: [PATCH] Add 0.8.0 news

---
 src/content/news/0-8-0.html | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 src/content/news/0-8-0.html

diff --git a/src/content/news/0-8-0.html b/src/content/news/0-8-0.html
new file mode 100644
index 0000000..c4805c8
--- /dev/null
+++ b/src/content/news/0-8-0.html
@@ -0,0 +1,30 @@
+---
+title: "Enroll 0.8.0: more hardening"
+date: "2026-07-14"
+description: "Enroll 0.8.0 adds more hardening to prevent obscure issues."
+summary: "Enroll 0.8.0 builds on the 0.7.0 release by adding several more hardening measures in an effort to keep it as safe as possible to use."
+html_title: "Enroll 0.8.0 release notes"
+og_title: "Enroll 0.8.0 release notes"
+og_description: "Enroll 0.8.0 builds on the 0.7.0 release by adding several more hardening measures in an effort to keep it as safe as possible to use."
+og_type: "article"
+---
+<header class="py-5 bg-light border-bottom">
+  <div class="container">
+    <div class="kicker mb-3"><i class="bi bi-megaphone"></i> News</div>
+    <h1 class="display-6 fw-bold mb-2">Enroll 0.8.0: more hardening</h1>
+    <p class="lead mb-0">0.8.0 builds on the 0.7.0 release by adding several more hardening measures in an effort to keep it as safe as possible to use.</p>
+  </div>
+</header>
+
+<main class="py-5">
+  <div class="container">
+    <article class="mx-auto" style="max-width: 900px;">
+      <h2 class="h3 fw-bold mt-5">Changelog</h2>
+      <ul class="text-secondary">
+        <li>Keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes a tiny post-harvest tampering window created by recursively chowning the bundle before packaging, yet without making the plaintext archive world-readable.</li>
+        <li>Enforce tar member limits while lazily parsing untrusted archives rather than after `TarFile.getmembers()` has already indexed the entire archive; count repeated `.` entries and cap remote compressed downloads as well.</li>
+        <li>Apply aggregate byte and total filesystem-entry limits when freezing directory harvest bundles, reject symlinked bundle roots, and abort when files or discovered directories change during the copy, so direct directory inputs remain bounded and fail closed under mutation.</li>
+      </ul>
+    </article>
+  </div>
+</main>