mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Activity Actions

0.8.2
All checks were successful
CI / test (push) Successful in 47s
Details
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m14s
Details
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m23s
Details
Lint / test (push) Successful in 44s
Details

Browse source
This commit is contained in:
Miguel Jacq 2026-08-03 17:17:39 +10:00
parent 4559aa6c70
commit 32bf09887a
Signed by: mig5
GPG key ID: 03906B4110AAD3B8
2 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
rpm/enroll.spec
View file

@ -45,7 +45,6 @@ Enroll a server's running state retrospectively into Ansible.
%changelog
* Mon Aug 03 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Make remote harvest zipapp stdlib-only
* Mon Aug 03 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Security: fix a TOCTOU in remote harvest.
* Mon Jul 13 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable.
@ -71,7 +70,7 @@ Enroll a server's running state retrospectively into Ansible.
- Add support for generating ipset and iptables configuration files from runtime, if the former weren't present ('firewall_runtime' role)
* Tue May 12 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Add ssh config support where JinjaTurtle is used
* Tue Feb 16 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
* Mon Feb 16 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Add capability to handle passphrases on encrypted SSH private keys. Prompting can be forced with `--ask-key-passphrase` or automated (e.g for CI) with `--ssh-key-passphrase env SOMEVAR`
* Fri Jan 16 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Add support for AddressFamily and ConnectTimeout in the .ssh/config when using `--remote-ssh-config`.