From 97011f287f12ef23c0cda81b4923720d60bca26d Mon Sep 17 00:00:00 2001 From: Miguel Jacq Date: Sun, 5 Jul 2026 11:00:58 +1000 Subject: [PATCH] Updates --- src/content/news/0-7-0.html | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/content/news/0-7-0.html b/src/content/news/0-7-0.html index d4d37fc..3dfdb26 100644 --- a/src/content/news/0-7-0.html +++ b/src/content/news/0-7-0.html @@ -52,8 +52,10 @@ og_type: "article"
  • Automatic per-user shell dotfile harvesting is only enabled in --dangerous mode.
  • Plain directory harvests are frozen into a private temp tree before manifesting, reducing TOCTOU exposure between validation and rendering.
  • Remote harvests reject unknown SSH host keys by default.
    • +
  • Enroll now implicitly 'validates' a harvest before trying to manifest it to Ansible code.
  • Root runs refuse unsafe non-interactive PATH setups unless --assume-safe-path is supplied.
  • Enroll will not want to harvest or manifest to a directory that is writable by others. It will try to make the harvest or manifest readable only by the user that is executing the command. This is in an effort to resist tampering attacks.
    • +
  • Enroll's --enforce argument to enroll diff has been removed. Non-interactive application of manifests is considered too dangerous by the maintainer, despite all the additional hardening of the harvesting described above. If you really want to enforce the previous harvest, you can still code up an enroll manifest [...] && ansible-playbook [....] yourself when detecting that enroll diff sees changes between two harvests.