- Earlier 0.7.0 development builds experimented with Puppet and Salt renderers. That experiment has been removed from the current codebase. The supported flow today is simpler and more honest: harvest a Linux host, validate the bundle, and generate Ansible roles and playbooks.
-
- Documentation note: if you find an old command using --target ansible, --target puppet, or --target salt, it is stale. Current enroll manifest has no --target option.
-
- What remains
+ What Enroll is doing
- Harvest bundles with
state.json and captured artifacts.
- Ansible manifesting in single-site mode or
--fqdn multi-site mode.
@@ -43,19 +39,22 @@ og_type: "article"
$ ansible-playbook -i "localhost," -c local playbook.yml --check
Security and provenance changes
- The current documentation is also more explicit about trust boundaries. Enroll validates structure and tries to avoid accidental secret capture, symlink traversal, unsafe artifact paths, unsafe root output paths, and root PATH foot-guns. It still cannot prove that a harvested desired state is semantically safe to apply.
+ Version 0.7.0 is also more explicit about trust boundaries. Enroll validates structure and tries to avoid accidental secret capture, symlink traversal, unsafe artifact paths, unsafe root output paths, and root PATH foot-guns. It still cannot prove that a harvested desired state is semantically safe to apply.
+ When manifesting from a harvest, you'll see a message like this:
This harvest is structurally valid, but Enroll cannot prove it is semantically safe. Only apply manifests generated from harvests whose provenance you trust.
- Other notable current behavior
+ Other notable changes
+ - In 'single site' mode, Enroll now combines packages/configs into 'common' roles where the 'Section' name of that software is common. This makes Ansible faster to run, and is easier to digest cognitively (you might now get 20 roles instead of 200!). This behaviour can be disabled with
--no-common-roles or when using the --fqdn mode.
+ - Enroll now tries to detect Docker images on your system. This requires the docker galaxy role in Ansible. It will enforce that the specific SHA256 of that image is present (not floating tagsZ), when running Ansible.
+ - Enroll now tries to detect system and user-level Flatpaks, as well as Snaps.
- Safe-mode content scanning tolerates value-less credential words in comments, but populated credential assignments are still treated as sensitive even if commented out.
- Automatic per-user shell dotfile harvesting is only enabled in
--dangerous mode.
- Plain directory harvests are frozen into a private temp tree before manifesting, reducing TOCTOU exposure between validation and rendering.
- Remote harvests reject unknown SSH host keys by default.
- Root runs refuse unsafe non-interactive
PATH setups unless --assume-safe-path is supplied.
+ - Enroll will not want to harvest or manifest to a directory that is writable by others. It will try to make the harvest or manifest readable only by the user that is executing the command. This is in an effort to resist tampering attacks.
-
- The News and Troubleshooting sections are retained on the website, but they now document the current tool rather than the removed Puppet/Salt experiment.
diff --git a/src/content/troubleshooting.html b/src/content/troubleshooting.html
index c1538b2..2d6155e 100644
--- a/src/content/troubleshooting.html
+++ b/src/content/troubleshooting.html
@@ -3,7 +3,7 @@ title: "Troubleshooting"
html_title: "Enroll troubleshooting - current Ansible CLI"
description: "Common Enroll errors and fixes for the current Ansible-only CLI."
og_title: "Enroll troubleshooting"
-og_description: "Fix stale --target examples, unsafe root PATH, missing Ansible collections, JinjaTurtle, remote SSH auth, validation, and SOPS extraction."
+og_description: "Fix unsafe root PATH, missing Ansible collections, JinjaTurtle, remote SSH auth, validation, and SOPS extraction."
og_type: "article"
---