mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Activity Actions

0.8.2
All checks were successful
CI / test (push) Successful in 46s
Details
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m8s
Details
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 15m30s
Details
Lint / test (push) Successful in 42s
Details

Browse source
This commit is contained in:
Miguel Jacq 2026-08-03 15:59:43 +10:00
parent 5932d22801
commit 4559aa6c70
Signed by: mig5
GPG key ID: 03906B4110AAD3B8
3 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
CHANGELOG.md
View file

@ -1,6 +1,7 @@
# 0.8.2 # 0.8.2
* Bump dependencies * Bump dependencies
* Make remote harvest zipapp stdlib-only
# 0.8.1 # 0.8.1

6
debian/changelog vendored
View file

@ -1,3 +1,9 @@
enroll (0.8.2) unstable; urgency=medium
* Make remote harvest zipapp stdlib-only
-- Miguel Jacq <mig@mig5.net> Mon, 03 Aug 2026 16:00:00 +1000
enroll (0.8.1) unstable; urgency=medium enroll (0.8.1) unstable; urgency=medium
* Security: fix a TOCTOU in remote harvest. * Security: fix a TOCTOU in remote harvest.

4
rpm/enroll.spec
View file

@ -1,4 +1,4 @@
%global upstream_version 0.8.1 %global upstream_version 0.8.2
Name: enroll Name: enroll
Version: %{upstream_version} Version: %{upstream_version}
@ -44,6 +44,8 @@ Enroll a server's running state retrospectively into Ansible.
%changelog %changelog
* Mon Aug 03 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release} * Mon Aug 03 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Make remote harvest zipapp stdlib-only
* Mon Aug 03 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Security: fix a TOCTOU in remote harvest. - Security: fix a TOCTOU in remote harvest.
* Mon Jul 13 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release} * Mon Jul 13 2026 Miguel Jacq <mig@mig5.net> - %{version}-%{release}
- Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable. - Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable.