5bf247c485
* Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable.
...
CI / test (push) Successful in 41s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 9m2s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 13m39s
Lint / test (push) Successful in 39s
* Security: enforce tar member limits while lazily parsing untrusted archives rather than after `TarFile.getmembers()` has already indexed the entire archive; count repeated `.` entries and cap remote compressed downloads as well.
* Security: apply aggregate byte and total filesystem-entry limits when freezing directory harvest bundles, reject symlinked bundle roots, and abort when files or discovered directories change during the copy, so direct directory inputs remain bounded and fail closed under mutation.
2026-07-13 10:15:43 +10:00
1148b34bce
More hardening
CI / test (push) Successful in 1m23s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m47s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m23s
Lint / test (push) Successful in 46s
2026-07-03 13:17:49 +10:00
d2a46394fe
More hardening
CI / test (push) Successful in 51s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m8s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m23s
Lint / test (push) Successful in 43s
2026-07-03 12:24:08 +10:00
40bff49815
Forbid the ansible globals
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m12s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 17m18s
Lint / test (push) Successful in 46s
2026-07-02 14:52:20 +10:00
65cbe18819
Don't reference built-in globals in Jinja2 into keys
Lint / test (push) Waiting to run
CI / test (push) Successful in 52s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m12s
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
2026-07-02 14:21:23 +10:00
47c2c8accc
Metadata: Tighten to prefer stat taken from the no-follow descriptor that was inspected, to avoid tiny TOCTOU. Ensure schema forbids .. in src_rel (even though caught in validate anyway - defense in depth)
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m11s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 17m36s
Lint / test (push) Successful in 51s
2026-07-01 15:52:04 +10:00
c6e171e0f0
Better detection of commented out Authorization strings (ignore policy)
CI / test (push) Successful in 51s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m5s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m28s
Lint / test (push) Successful in 45s
2026-07-01 15:41:38 +10:00
c468bc221e
Sanitise the 'validate' output error messages too just in case
CI / test (push) Successful in 53s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m32s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m31s
Lint / test (push) Successful in 46s
2026-07-01 11:33:26 +10:00
5ffad10665
Catch key/value sensitive strings in ignore, where there is no : or = delimiter
Lint / test (push) Waiting to run
CI / test (push) Successful in 55s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m49s
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
2026-07-01 11:04:33 +10:00
17f771cadd
Sanitise the diff and explain markdown content like we do with README
2026-07-01 11:03:38 +10:00
85345083a3
Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python
CI / test (push) Successful in 53s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m44s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m3s
Lint / test (push) Successful in 46s
2026-06-30 12:34:26 +10:00
e72044b610
Ensure markdown README gets sanitised
Lint / test (push) Waiting to run
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:10, python3.11) (push) Failing after 16s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m21s
2026-06-30 12:11:48 +10:00
43fca6b3da
Resist 'pw' as well
2026-06-30 12:11:17 +10:00
3781d602a1
Fix overenthusiastic match on pass
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m42s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m12s
Lint / test (push) Successful in 1m13s
2026-06-30 11:34:37 +10:00
737316d507
More phrases to catch as potentially sensitive
2026-06-30 11:10:57 +10:00
b546bb9bf2
Fix import of stat_triplet
CI / test (push) Successful in 49s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 9m3s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 12m13s
Lint / test (push) Successful in 46s
2026-06-29 14:51:32 +10:00
3c1e08bdde
More TOCTOU, update to tests for jinjaturtle
CI / test (push) Successful in 48s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m32s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m0s
Lint / test (push) Successful in 44s
2026-06-29 14:30:07 +10:00
b3d4adf7d4
Show a warning when manifesting from a harvest as reminder it should be trusted first
2026-06-29 12:25:35 +10:00
ddb18403c8
fail loudly on an empty/truncated frozen harvest bundle. Tighten as much as we can the remote harvesting
2026-06-29 08:56:06 +10:00
a2dc054882
Close TOCTOU gap by freezing directory harvest bundles into a private 0700 copy before the two consumers that actually read artifacts (manifest and diff) touch them.
2026-06-28 21:07:49 +10:00
1bfbfd90f6
Escape verbatim JSON and defend against jinja in it. Add option to salt role prefix to guard against malicious injection of var names
2026-06-28 20:34:06 +10:00
44d1a22db4
hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate.
2026-06-28 18:17:45 +10:00
f5b85d29d3
Better protection against symlink traversal in flatpak. Other hardening
2026-06-28 17:03:24 +10:00
903125976d
Remove 'enroll diff --enforce' option. Tighten yaml data re: handlers - use listen: instead of notify:
2026-06-28 16:01:11 +10:00
e9d7d74445
Remove puppet and salt
2026-06-25 16:54:23 +10:00
d96ad3dc02
Some more hardening to not process raw jinja inside salt/ansible cmd. But, I think this is the end of the road
Lint / test (push) Waiting to run
CI / test (push) Successful in 57s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Has been cancelled
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
2026-06-22 20:26:06 +10:00
c3c3608049
Validate state.json is a normal file
2026-06-22 17:47:36 +10:00
992b8060a5
validation of artifact dir
2026-06-22 17:23:25 +10:00
efb6d7cc15
Be strict about XDG_CACHE_DIR ownership etc
2026-06-22 17:22:27 +10:00
952687e15d
Ensure that --include-path records (but does not traverse) symlinks
Lint / test (push) Waiting to run
CI / test (push) Failing after 44s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Has been cancelled
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
2026-06-22 15:34:44 +10:00
07b07e60c5
Ensure paths are not followed through parent links
2026-06-22 15:32:40 +10:00
e10a3f62b0
Belts and braces: normalise paths before globbing
2026-06-22 15:06:46 +10:00
ad019f6b09
normalise control characters in generated manifest scalars
2026-06-22 14:45:12 +10:00
cec6023a40
Ensure that diff also runs through validate()
CI / test (push) Successful in 48s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m15s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 20m51s
Lint / test (push) Successful in 46s
2026-06-22 14:14:51 +10:00
a1d7a9e4e6
Add warning about --dangerous mode if sops is not in use
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 12m37s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 20m21s
Lint / test (push) Successful in 45s
2026-06-22 12:56:21 +10:00
d93de8a8a2
Fix for remote harvest tmp dir
2026-06-22 12:46:45 +10:00
21a3ef3447
More safety about writing output harvests/manifests to safe locations, including SOPS and diff.
2026-06-22 12:21:33 +10:00
d1e99db2df
Update the cli help info about enroll.ini location
2026-06-22 12:00:48 +10:00
e78f61c5ed
Avoid TOCTOU issues, stronger perms on manifest dir, don't allow harvesting to existing dir by default, scan whole file for potential secrets
CI / test (push) Successful in 48s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m19s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 20m40s
Lint / test (push) Successful in 48s
2026-06-22 11:41:11 +10:00
a0914e1369
Strict validation of PATH when running as root in case it could contain potentially unsafe binaries
2026-06-22 11:06:01 +10:00
205c419a7a
Sanity check on FQDN name to avoid accidental path traversal and similar woes
2026-06-22 10:59:17 +10:00
3e8ad600e2
Use shlex.quote on remote commands
2026-06-22 10:58:20 +10:00
0a0f067111
Add other common strings that could represent sensitive values to ignore unless in --dangerous mode
2026-06-22 10:57:54 +10:00
e2b61bcdf1
Ensure jinjifying an artifact passes through safe_artifact_file just in case
2026-06-22 10:57:08 +10:00
0384f8817b
Fail closed on SMTP STARTTLS credential failure before sending creds. Ensure diff's manifest dir works now that we don't remove the target location if it exists (temp dir)
2026-06-22 09:57:56 +10:00
5ffd4ee755
Perform harvest validation before trying to manifest from it
2026-06-22 09:56:55 +10:00
706604df74
Stricter validation of harvests to ensure that they meet the schema and don't contain unsafe artifacts (e.g symlinks pointing outside the artifact tree)
2026-06-22 09:55:38 +10:00
a85e8265f4
Don't allow .enroll.ini in CWD, rely on env var or XDG path
2026-06-22 09:52:33 +10:00
6ee8c60e64
Fix the almalinux tests - skip jinjaturtle and systemd in CI
CI / test (push) Successful in 46s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m26s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 20m24s
Lint / test (push) Successful in 45s
2026-06-21 17:49:51 +10:00
ce2652a3b3
Handle gracefully debian stuff when testing on rhel-like
CI / test (push) Has been cancelled
Lint / test (push) Has been cancelled
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 5m10s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 10m10s
2026-06-21 16:15:33 +10:00
