Update news

src/content/news/0-7-0.html

@@ -1,29 +1,25 @@
 ---
-title: "Enroll 0.7.0 beta: Ansible-only again, with stronger safety tooling"
+title: "Enroll 0.7.0: stronger safety tooling and new features"
 date: "2026-06-30"
-description: "Current Enroll 0.7.0 beta notes: the Puppet and Salt experiment has been removed; Enroll now documents Ansible-only output and stronger safety tooling."
-summary: "The current beta focuses Enroll back on Ansible-only output, removes stale Puppet/Salt documentation, and clarifies safety and provenance guidance."
-html_title: "Enroll 0.7.0 beta - Ansible-only current documentation"
-og_title: "Enroll 0.7.0 beta: Ansible-only current documentation"
-og_description: "The current Enroll beta removes the old Puppet/Salt experiment from the docs and focuses on Ansible output, validation, SOPS, and safety."
+description: "Enroll 0.7.0 has much more robust defenses against malicious harvested data and what gets manifested into Ansible."
+summary: "Enroll 0.7.0 focuses on making Enroll very robust against many forms of attack, introduces 'combined' roles for faster and simpler execution, and adds Docker/Flatpak/Snap detection."
+html_title: "Enroll 0.7.0 release notes"
+og_title: "Enroll 0.7.0 release notes"
+og_description: "0.7.0 focuses on making Enroll very robust against many forms of attack, introduces 'combined' roles for faster and simpler execution, and adds Docker/Flatpak/Snap detection."
 og_type: "article"
 ---
 <header class="py-5 bg-light border-bottom">
   <div class="container">
     <div class="kicker mb-3"><i class="bi bi-megaphone"></i> News</div>
-    <h1 class="display-6 fw-bold mb-2">Enroll 0.7.0 beta: Ansible-only again, with stronger safety tooling</h1>
-    <p class="lead mb-0">The current beta focuses Enroll back on one supported output path: harvest Linux hosts and render Ansible.</p>
+    <h1 class="display-6 fw-bold mb-2">Enroll 0.7.0: stronger safety tooling and other improvements</h1>
+    <p class="lead mb-0">The new release focuses on hardening Enroll's defenses against various types of attack/content injection, along with some other new features and improvements.</p>
   </div>
 </header>
 
 <main class="py-5">
   <div class="container">
     <article class="mx-auto" style="max-width: 900px;">
-      <p class="text-secondary">Earlier 0.7.0 development builds experimented with Puppet and Salt renderers. That experiment has been removed from the current codebase. The supported flow today is simpler and more honest: harvest a Linux host, validate the bundle, and generate Ansible roles and playbooks.</p>
-
-      <div class="alert alert-info"><strong>Documentation note:</strong> if you find an old command using <code>--target ansible</code>, <code>--target puppet</code>, or <code>--target salt</code>, it is stale. Current <code>enroll manifest</code> has no <code>--target</code> option.</div>
-
-      <h2 class="h3 fw-bold mt-5">What remains</h2>
+      <h2 class="h3 fw-bold mt-5">What Enroll is doing</h2>
       <ul class="text-secondary">
         <li><strong>Harvest bundles</strong> with <code>state.json</code> and captured artifacts.</li>
         <li><strong>Ansible manifesting</strong> in single-site mode or <code>--fqdn</code> multi-site mode.</li>
@@ -43,19 +39,22 @@ og_type: "article"
 <span class="prompt">$</span> ansible-playbook -i "localhost," -c local playbook.yml --check</code></pre></div>
 
       <h2 class="h3 fw-bold mt-5">Security and provenance changes</h2>
-      <p class="text-secondary">The current documentation is also more explicit about trust boundaries. Enroll validates structure and tries to avoid accidental secret capture, symlink traversal, unsafe artifact paths, unsafe root output paths, and root <code>PATH</code> foot-guns. It still cannot prove that a harvested desired state is semantically safe to apply.</p>
+      <p class="text-secondary">Version 0.7.0 is also more explicit about trust boundaries. Enroll validates structure and tries to avoid accidental secret capture, symlink traversal, unsafe artifact paths, unsafe root output paths, and root <code>PATH</code> foot-guns. It still cannot prove that a harvested desired state is semantically safe to apply.</p>
+      <p class="text-secondary">When manifesting from a harvest, you'll see a message like this:</p>
       <blockquote class="blockquote border-start ps-3 text-secondary">This harvest is structurally valid, but Enroll cannot prove it is semantically safe. Only apply manifests generated from harvests whose provenance you trust.</blockquote>
 
-      <h2 class="h3 fw-bold mt-5">Other notable current behavior</h2>
+      <h2 class="h3 fw-bold mt-5">Other notable changes</h2>
       <ul class="text-secondary">
+	<li>In 'single site' mode, Enroll now combines packages/configs into 'common' roles where the 'Section' name of that software is common. This makes Ansible faster to run, and is easier to digest cognitively (you might now get 20 roles instead of 200!). This behaviour can be disabled with <code>--no-common-roles</code> or when using the <code>--fqdn</code> mode.</li>
+	<li>Enroll now tries to detect Docker images on your system. This requires the docker galaxy role in Ansible. It will enforce that the specific SHA256 of that image is present (not floating tagsZ), when running Ansible.</li>
+	<li>Enroll now tries to detect system and user-level Flatpaks, as well as Snaps.</li>
         <li>Safe-mode content scanning tolerates value-less credential words in comments, but populated credential assignments are still treated as sensitive even if commented out.</li>
         <li>Automatic per-user shell dotfile harvesting is only enabled in <code>--dangerous</code> mode.</li>
         <li>Plain directory harvests are frozen into a private temp tree before manifesting, reducing TOCTOU exposure between validation and rendering.</li>
         <li>Remote harvests reject unknown SSH host keys by default.</li>
         <li>Root runs refuse unsafe non-interactive <code>PATH</code> setups unless <code>--assume-safe-path</code> is supplied.</li>
+	<li>Enroll will not want to harvest or manifest to a directory that is writable by others. It will try to make the harvest or manifest readable only by the user that is executing the command. This is in an effort to resist tampering attacks.</li>
       </ul>
-
-      <p class="text-secondary mt-5 mb-0">The News and Troubleshooting sections are retained on the website, but they now document the current tool rather than the removed Puppet/Salt experiment.</p>
     </article>
   </div>
 </main>

src/content/troubleshooting.html

@@ -3,7 +3,7 @@ title: "Troubleshooting"
 html_title: "Enroll troubleshooting - current Ansible CLI"
 description: "Common Enroll errors and fixes for the current Ansible-only CLI."
 og_title: "Enroll troubleshooting"
-og_description: "Fix stale --target examples, unsafe root PATH, missing Ansible collections, JinjaTurtle, remote SSH auth, validation, and SOPS extraction."
+og_description: "Fix unsafe root PATH, missing Ansible collections, JinjaTurtle, remote SSH auth, validation, and SOPS extraction."
 og_type: "article"
 ---
 <header class="py-5 bg-light border-bottom">
@@ -33,15 +33,6 @@ og_type: "article"
       </aside>
 
       <div class="col-lg-9">
-        <section id="no-target" class="scroll-mt-nav mb-5">
-          <h2 class="section-title fw-bold">Error: <code>unrecognized arguments: --target</code></h2>
-          <p class="text-secondary">You are following old documentation from a temporary version that experimented with Puppet and Salt renderers. Current Enroll only generates Ansible output, so there is no <code>--target</code> flag.</p>
-          <div class="row g-3">
-            <div class="col-md-6"><div class="callout p-4 h-100"><div class="fw-semibold mb-2">Old command</div><div class="terminal"><pre class="mb-0"><code><span class="prompt">$</span> enroll manifest --harvest ./harvest --target ansible --out ./ansible</code></pre></div></div></div>
-            <div class="col-md-6"><div class="callout p-4 h-100"><div class="fw-semibold mb-2">Current command</div><div class="terminal"><pre class="mb-0"><code><span class="prompt">$</span> enroll manifest --harvest ./harvest --out ./ansible</code></pre></div></div></div>
-          </div>
-        </section>
-
         <section id="root-path" class="scroll-mt-nav mb-5">
           <h2 class="section-title fw-bold">Root run refuses to continue because <code>PATH</code> is unsafe</h2>
           <p class="text-secondary">When running as root, Enroll refuses non-interactive execution if <code>PATH</code> contains <code>.</code>, an empty entry, a relative entry, a non-root-owned directory, or group/world-writable directories/parents that could let an untrusted binary be executed.</p>