From 5319ac916169c667a6486ac821b645d7fbe3e52b Mon Sep 17 00:00:00 2001 From: Miguel Jacq Date: Tue, 30 Jun 2026 16:36:26 +1000 Subject: [PATCH] Update news --- src/content/news/0-7-0.html | 33 ++++++++++++++++---------------- src/content/troubleshooting.html | 11 +---------- 2 files changed, 17 insertions(+), 27 deletions(-) diff --git a/src/content/news/0-7-0.html b/src/content/news/0-7-0.html index 2f9ea69..d4d37fc 100644 --- a/src/content/news/0-7-0.html +++ b/src/content/news/0-7-0.html @@ -1,29 +1,25 @@ --- -title: "Enroll 0.7.0 beta: Ansible-only again, with stronger safety tooling" +title: "Enroll 0.7.0: stronger safety tooling and new features" date: "2026-06-30" -description: "Current Enroll 0.7.0 beta notes: the Puppet and Salt experiment has been removed; Enroll now documents Ansible-only output and stronger safety tooling." -summary: "The current beta focuses Enroll back on Ansible-only output, removes stale Puppet/Salt documentation, and clarifies safety and provenance guidance." -html_title: "Enroll 0.7.0 beta - Ansible-only current documentation" -og_title: "Enroll 0.7.0 beta: Ansible-only current documentation" -og_description: "The current Enroll beta removes the old Puppet/Salt experiment from the docs and focuses on Ansible output, validation, SOPS, and safety." +description: "Enroll 0.7.0 has much more robust defenses against malicious harvested data and what gets manifested into Ansible." +summary: "Enroll 0.7.0 focuses on making Enroll very robust against many forms of attack, introduces 'combined' roles for faster and simpler execution, and adds Docker/Flatpak/Snap detection." +html_title: "Enroll 0.7.0 release notes" +og_title: "Enroll 0.7.0 release notes" +og_description: "0.7.0 focuses on making Enroll very robust against many forms of attack, introduces 'combined' roles for faster and simpler execution, and adds Docker/Flatpak/Snap detection." og_type: "article" ---
News
-

Enroll 0.7.0 beta: Ansible-only again, with stronger safety tooling

-

The current beta focuses Enroll back on one supported output path: harvest Linux hosts and render Ansible.

+

Enroll 0.7.0: stronger safety tooling and other improvements

+

The new release focuses on hardening Enroll's defenses against various types of attack/content injection, along with some other new features and improvements.

-

Earlier 0.7.0 development builds experimented with Puppet and Salt renderers. That experiment has been removed from the current codebase. The supported flow today is simpler and more honest: harvest a Linux host, validate the bundle, and generate Ansible roles and playbooks.

- -
Documentation note: if you find an old command using --target ansible, --target puppet, or --target salt, it is stale. Current enroll manifest has no --target option.
- -

What remains

+

What Enroll is doing

  • Harvest bundles with state.json and captured artifacts.
  • Ansible manifesting in single-site mode or --fqdn multi-site mode.
    • @@ -43,19 +39,22 @@ og_type: "article" $ ansible-playbook -i "localhost," -c local playbook.yml --check

Security and provenance changes

-

The current documentation is also more explicit about trust boundaries. Enroll validates structure and tries to avoid accidental secret capture, symlink traversal, unsafe artifact paths, unsafe root output paths, and root PATH foot-guns. It still cannot prove that a harvested desired state is semantically safe to apply.

+

Version 0.7.0 is also more explicit about trust boundaries. Enroll validates structure and tries to avoid accidental secret capture, symlink traversal, unsafe artifact paths, unsafe root output paths, and root PATH foot-guns. It still cannot prove that a harvested desired state is semantically safe to apply.

+

When manifesting from a harvest, you'll see a message like this:

This harvest is structurally valid, but Enroll cannot prove it is semantically safe. Only apply manifests generated from harvests whose provenance you trust.
-

Other notable current behavior

+

Other notable changes

- -

The News and Troubleshooting sections are retained on the website, but they now document the current tool rather than the removed Puppet/Salt experiment.

diff --git a/src/content/troubleshooting.html b/src/content/troubleshooting.html index c1538b2..2d6155e 100644 --- a/src/content/troubleshooting.html +++ b/src/content/troubleshooting.html @@ -3,7 +3,7 @@ title: "Troubleshooting" html_title: "Enroll troubleshooting - current Ansible CLI" description: "Common Enroll errors and fixes for the current Ansible-only CLI." og_title: "Enroll troubleshooting" -og_description: "Fix stale --target examples, unsafe root PATH, missing Ansible collections, JinjaTurtle, remote SSH auth, validation, and SOPS extraction." +og_description: "Fix unsafe root PATH, missing Ansible collections, JinjaTurtle, remote SSH auth, validation, and SOPS extraction." og_type: "article" ---
@@ -33,15 +33,6 @@ og_type: "article"
-
-

Error: unrecognized arguments: --target

-

You are following old documentation from a temporary version that experimented with Puppet and Salt renderers. Current Enroll only generates Ansible output, so there is no --target flag.

-
-
Old command
$ enroll manifest --harvest ./harvest --target ansible --out ./ansible
-
Current command
$ enroll manifest --harvest ./harvest --out ./ansible
-
-
-

Root run refuses to continue because PATH is unsafe

When running as root, Enroll refuses non-interactive execution if PATH contains ., an empty entry, a relative entry, a non-root-owned directory, or group/world-writable directories/parents that could let an untrusted binary be executed.