mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Activity Actions

0.8.2
All checks were successful
CI / test (push) Successful in 46s
Details
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m8s
Details
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 15m30s
Details
Lint / test (push) Successful in 42s
Details

Browse source
This commit is contained in:
Miguel Jacq 2026-08-03 15:59:43 +10:00
parent 5932d22801
commit 4559aa6c70
Signed by: mig5
GPG key ID: 03906B4110AAD3B8
3 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
rpm/enroll.spec
View file

@ -1,4 +1,4 @@
%global upstream_version 0.8.1
%global upstream_version 0.8.2
Name: enroll
Version: %{upstream_version}
@ -44,6 +44,8 @@ Enroll a server's running state retrospectively into Ansible.
%changelog
* Mon Aug 03 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Make remote harvest zipapp stdlib-only
* Mon Aug 03 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Security: fix a TOCTOU in remote harvest.
* Mon Jul 13 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable.