From 7d546964020b158a35d74fac00ae2d1bbdeaac35 Mon Sep 17 00:00:00 2001 From: Miguel Jacq Date: Sun, 5 Jul 2026 10:58:33 +1000 Subject: [PATCH] 0.7.0 --- CHANGELOG.md | 2 +- debian/changelog | 19 +++++++++++++++++++ pyproject.toml | 2 +- rpm/enroll.spec | 17 ++++++++++++++++- 4 files changed, 37 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 17c5f23..ba39ec6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -# 0.7.0 (unreleased) +# 0.7.0 * BREAKING CHANGE: Remove the `enroll diff --enforce` option. Enroll no longer applies the old harvest state locally to repair drift; this avoids the risk of enforcing a potentially malicious or tampered harvest. To restore baseline state, regenerate a manifest from the trusted harvest and apply it yourself, or compare two `enroll diff` runs and act on the result. * BREAKING CHANGE: Group all package and systemd-unit roles into Debian Section/RPM Group roles by default, including managed config files and unit state. This mode is not used if `--fqdn` or `--no-common-roles` is set, in which case, the traditional behaviour of preserving one role per package/unit is used instead. diff --git a/debian/changelog b/debian/changelog index 4a3c7bd..0ed3fa9 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,22 @@ +enroll (0.7.0) unstable; urgency=medium + + * BREAKING CHANGE: Remove the `enroll diff --enforce` option. Enroll no longer applies the old harvest state locally to repair drift; this avoids the risk of enforcing a potentially malicious or tampered harvest. To restore baseline state, regenerate a manifest from the trusted harvest and apply it yourself, or compare two `enroll diff` runs and act on the result. + * BREAKING CHANGE: Group all package and systemd-unit roles into Debian Section/RPM Group roles by default, including managed config files and unit state. This mode is not used if `--fqdn` or `--no-common-roles` is set, in which case, the traditional behaviour of preserving one role per package/unit is used instead. + * BREAKING CHANGE: Only capture user-specific .bashrc style files when using `--dangerous` mode, in case they contain sensitive env vars. + * BREAKING CHANGE: Don't allow reading `.enroll.ini` in the CWD. Use only the ENROLL_CONFIG env var, an explicit `--config` path or else the XDG default location (or `~/.config/enroll/enroll.ini` if `XDG_CONFIG_HOME` is not set). + * Detect active sysctl parameters and write them to a `/etc/sysctl.d/99-enroll.conf` file + * Use `no_log` on systemd unit interrogations to suppress potential sensitive output when applying Ansible + * Support for detecting Docker and Podman images and enforcing their presence (by SHA256 hash). + * Add support for detecting Flatpaks and Snaps. + * Stricter validation of harvests to ensure that they meet the schema and don't contain unsafe artifacts (e.g symlinks pointing outside the artifact tree) + * Perform harvest validation before trying to manifest from it. + * Stricter validation on FQDN name in multisite mode. + * Strict check of `$PATH` when running harvest as root, in case it could lead to execution of unsafe binaries during harvest. Override with `--assume-safe-path` for non-interactive or CI purposes. + * Stricter validation of the destination dirs that harvest or manifest write to, to prevent writing to a different user-controlled area. Stricter permissions on the output dirs too. + * Lots of hardening across the whole codebase and integration with Jinjaturtle. + + -- Miguel Jacq Sun, 5 Jul 2026 11:00:00 +1000 + enroll (0.6.0) unstable; urgency=medium * Add support for capturing ipset and iptables configuration files diff --git a/pyproject.toml b/pyproject.toml index fa7d0d8..4c8cc6b 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api" [project] name = "enroll" -version = "0.7.0b7" +version = "0.7.0" description = "Enroll a server's running state retrospectively into Ansible" readme = "README.md" requires-python = ">=3.10" diff --git a/rpm/enroll.spec b/rpm/enroll.spec index 0e83c84..f6a0e8d 100644 --- a/rpm/enroll.spec +++ b/rpm/enroll.spec @@ -1,4 +1,4 @@ -%global upstream_version 0.6.0 +%global upstream_version 0.7.0 Name: enroll Version: %{upstream_version} @@ -43,6 +43,21 @@ Enroll a server's running state retrospectively into Ansible. %{_bindir}/enroll %changelog +* Sun Jul 05 2026 Miguel Jacq - %{version}-%{release} +- BREAKING CHANGE: Remove the `enroll diff --enforce` option. Enroll no longer applies the old harvest state locally to repair drift; this avoids the risk of enforcing a potentially malicious or tampered harvest. To restore baseline state, regenerate a manifest from the trusted harvest and apply it yourself, or compare two `enroll diff` runs and act on the result. +- BREAKING CHANGE: Group all package and systemd-unit roles into Debian Section/RPM Group roles by default, including managed config files and unit state. This mode is not used if `--fqdn` or `--no-common-roles` is set, in which case, the traditional behaviour of preserving one role per package/unit is used instead. +- BREAKING CHANGE: Only capture user-specific .bashrc style files when using `--dangerous` mode, in case they contain sensitive env vars. +- BREAKING CHANGE: Don't allow reading `.enroll.ini` in the CWD. Use only the ENROLL_CONFIG env var, an explicit `--config` path or else the XDG default location (or `~/.config/enroll/enroll.ini` if `XDG_CONFIG_HOME` is not set). +- Detect active sysctl parameters and write them to a `/etc/sysctl.d/99-enroll.conf` file +- Use `no_log` on systemd unit interrogations to suppress potential sensitive output when applying Ansible +- Support for detecting Docker and Podman images and enforcing their presence (by SHA256 hash). +- Add support for detecting Flatpaks and Snaps. +- Stricter validation of harvests to ensure that they meet the schema and don't contain unsafe artifacts (e.g symlinks pointing outside the artifact tree) +- Perform harvest validation before trying to manifest from it. +- Stricter validation on FQDN name in multisite mode. +- Strict check of `$PATH` when running harvest as root, in case it could lead to execution of unsafe binaries during harvest. Override with `--assume-safe-path` for non-interactive or CI purposes. +- Stricter validation of the destination dirs that harvest or manifest write to, to prevent writing to a different user-controlled area. Stricter permissions on the output dirs too. +- Lots of hardening across the whole codebase and integration with Jinjaturtle. * Thu May 14 2026 Miguel Jacq - %{version}-%{release} - Add support for capturing ipset and iptables configuration files - Add support for generating ipset and iptables configuration files from runtime, if the former weren't present ('firewall_runtime' role)