5bf247c485
* Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable.
...
CI / test (push) Successful in 41s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 9m2s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 13m39s
Lint / test (push) Successful in 39s
* Security: enforce tar member limits while lazily parsing untrusted archives rather than after `TarFile.getmembers()` has already indexed the entire archive; count repeated `.` entries and cap remote compressed downloads as well.
* Security: apply aggregate byte and total filesystem-entry limits when freezing directory harvest bundles, reject symlinked bundle roots, and abort when files or discovered directories change during the copy, so direct directory inputs remain bounded and fail closed under mutation.
2026-07-13 10:15:43 +10:00
da0d8851d3
Tweaks
CI / test (push) Successful in 56s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m59s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 17m26s
Lint / test (push) Successful in 53s
2026-07-05 11:30:45 +10:00
9d24ea99e9
Fix for bookworm build
Lint / test (push) Waiting to run
CI / test (push) Successful in 52s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m15s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m11s
2026-07-05 11:21:05 +10:00
7d54696402
0.7.0
Lint / test (push) Waiting to run
CI / test (push) Successful in 54s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m34s
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
2026-07-05 10:58:33 +10:00
e9d7d74445
Remove puppet and salt
2026-06-25 16:54:23 +10:00
5930758398
Fix pyproject to make debian build happy
2026-06-22 15:39:17 +10:00
00f960d01e
Upgrade to Poetry 2
2026-06-22 15:03:32 +10:00
582679a523
0.7.0b7
CI / test (push) Successful in 20m0s
Lint / test (push) Has been cancelled
2026-06-21 09:03:52 +10:00
eeb37be567
0.7.0b6
CI / test (push) Successful in 19m38s
Lint / test (push) Successful in 44s
2026-06-20 18:39:28 +10:00
4fd0facaf8
0.7.0b5
CI / test (push) Successful in 19m16s
Lint / test (push) Successful in 44s
2026-06-20 15:33:47 +10:00
5845ff58e4
Update pyproject comment
2026-06-20 15:33:24 +10:00
eb286b1db0
0.7.0b4
CI / test (push) Successful in 19m23s
Lint / test (push) Successful in 43s
2026-06-20 12:30:39 +10:00
7379587a28
Don't enforce /etc/enroll if no firewall rules to set in subdir
CI / test (push) Successful in 19m38s
Lint / test (push) Successful in 43s
2026-06-19 20:29:12 +10:00
5644062040
0.7.0b2
2026-06-19 19:12:26 +10:00
02feff014f
Version 0.7.0b1
CI / test (push) Successful in 18m28s
Lint / test (push) Successful in 46s
2026-06-18 09:13:03 +10:00
79e73584e9
Set version to beta for pypi
Lint / test (push) Waiting to run
CI / test (push) Has been cancelled
2026-06-18 09:09:47 +10:00
b25dd1e314
* Add support for capturing ipset and iptables configuration files
...
CI / test (push) Successful in 8m23s
Lint / test (push) Successful in 33s
* Add support for generating ipset and iptables configuration files from runtime, if the former weren't present (`firewall_runtime` role)
* Dependency updates
2026-05-14 15:16:36 +10:00
3fcfefe644
0.5.0
CI / test (push) Successful in 8m28s
Lint / test (push) Successful in 1m5s
2026-05-12 12:24:00 +10:00
d403dcb918
0.4.4
CI / test (push) Successful in 8m14s
Lint / test (push) Successful in 32s
Trivy / test (push) Successful in 24s
2026-02-17 10:58:38 +11:00
1856e3a79d
Add support for AddressFamily and ConnectTimeout in the .ssh/config when using --remote-ssh-config.
2026-01-16 10:58:39 +11:00
f5eaac9f75
Support --remote-ssh-config [path-to-ssh-config] as an argument in case extra params are required beyond --remote-port or --remote-user.
...
CI / test (push) Successful in 8m18s
Lint / test (push) Successful in 33s
Trivy / test (push) Successful in 25s
Note: `--remote-host` must still be set, but it can be an 'alias' represented by the 'Host' value in the ssh config.
2026-01-13 21:56:28 +11:00
5754ef1aad
Add interactive output when 'enroll diff --enforce' is invoking Ansible.
CI / test (push) Successful in 8m18s
Lint / test (push) Successful in 32s
Trivy / test (push) Successful in 24s
2026-01-11 10:01:16 +11:00
d172d848c4
Relax python3-jsonschema version for Fedora support
CI / test (push) Successful in 8m16s
Lint / test (push) Successful in 34s
Trivy / test (push) Successful in 24s
2026-01-10 11:44:51 +11:00
025f00f924
Fix tests
Lint / test (push) Waiting to run
Trivy / test (push) Waiting to run
CI / test (push) Has been cancelled
2026-01-05 21:25:46 +11:00
66d032d981
Introduce 'enroll validate' to check a harvest meets the schema spec and isn't lacking artifacts or contains orphaned ones
CI / test (push) Failing after 1m47s
Lint / test (push) Successful in 31s
Trivy / test (push) Successful in 23s
2026-01-05 21:17:50 +11:00
45e0d9bb16
0.3.0
CI / test (push) Successful in 8m25s
Lint / test (push) Successful in 31s
Trivy / test (push) Successful in 23s
2026-01-05 17:13:43 +11:00
04234e296f
0.2.3
CI / test (push) Successful in 6m55s
Lint / test (push) Successful in 30s
Trivy / test (push) Successful in 23s
2026-01-04 21:05:49 +11:00
824010b2ab
Several bug fixes and prep for 0.2.2
...
CI / test (push) Failing after 1m40s
Lint / test (push) Successful in 31s
Trivy / test (push) Successful in 24s
- Fix stat() of parent directory so that we set directory perms correct on --include paths.
- Set pty for remote calls when sudo is required, to help systems with limits on sudo without pty
2026-01-03 11:39:57 +11:00
29b52d451d
0.2.1
CI / test (push) Failing after 2m37s
Lint / test (push) Successful in 30s
Trivy / test (push) Successful in 23s
2026-01-02 21:29:16 +11:00
e44e4aaf3a
0.2.0
CI / test (push) Successful in 4m52s
Lint / test (push) Successful in 27s
Trivy / test (push) Successful in 17s
2025-12-29 17:39:39 +11:00
8c19473e18
Fix an attribution bug for certain files ending up in the wrong package/role.
CI / test (push) Successful in 5m2s
Lint / test (push) Successful in 29s
Trivy / test (push) Successful in 21s
2025-12-28 18:37:14 +11:00
921801caa6
0.1.6
CI / test (push) Successful in 5m24s
Lint / test (push) Successful in 30s
Trivy / test (push) Successful in 16s
2025-12-28 15:32:40 +11:00
3fc5aec5fc
0.1.5
CI / test (push) Successful in 5m4s
Lint / test (push) Successful in 28s
Trivy / test (push) Successful in 17s
2025-12-28 09:56:52 +11:00
40aad9e798
0.1.4
CI / test (push) Successful in 5m0s
Lint / test (push) Successful in 28s
Trivy / test (push) Successful in 18s
2025-12-27 19:04:00 +11:00
4d2250f974
Add fedora rpm building
CI / test (push) Successful in 4m45s
Lint / test (push) Successful in 28s
Trivy / test (push) Successful in 17s
2025-12-27 16:56:30 +11:00
cf819f755a
0.1.3
CI / test (push) Successful in 5m35s
Lint / test (push) Successful in 28s
Trivy / test (push) Successful in 20s
2025-12-20 18:26:04 +11:00
4660a0703e
Include files from /usr/local/bin and /usr/local/etc in harvest (assuming they aren't binaries or symlinks) and store in usr_local_custom role, similar to etc_custom.
CI / test (push) Successful in 5m43s
Lint / test (push) Successful in 30s
Trivy / test (push) Successful in 19s
2025-12-18 17:11:04 +11:00
b5d2b99174
Add diff mode
CI / test (push) Successful in 5m14s
Lint / test (push) Successful in 30s
Trivy / test (push) Successful in 23s
2025-12-18 14:59:51 +11:00
33b1176800
Add --sops mode to encrypt harvest and manifest data at rest (especially useful if using --dangerous)
CI / test (push) Successful in 5m35s
Lint / test (push) Failing after 29s
Trivy / test (push) Successful in 18s
2025-12-17 18:51:40 +11:00
6a36a9d2d5
Remote mode and dangerous flag, other tweaks
...
* Add remote mode for harvesting a remote machine via a local workstation (no need to install enroll remotely)
Optionally use `--no-sudo` if you don't want the remote user to have passwordless sudo when conducting the
harvest, albeit you'll end up with less useful data (same as if running `enroll harvest` on a machine without
sudo)
* Add `--dangerous` flag to capture even sensitive data (use at your own risk!)
* Do a better job at capturing other config files in `/etc/<package>/` even if that package doesn't normally
ship or manage those files.
2025-12-17 17:02:16 +11:00
f255ba566c
biiiiig refactor to support jinjaturtle and multi site mode
2025-12-16 20:14:20 +11:00
e4be7f5975
Rename secrets to ignore as it does more than secrets
CI / test (push) Successful in 5m35s
Lint / test (push) Successful in 27s
Trivy / test (push) Successful in 17s
2025-12-15 17:03:28 +11:00
18ca83c255
remove ansible from dev dependencies
2025-12-15 13:37:41 +11:00
2f5a65b737
Bump version
CI / test (push) Failing after 1m18s
Lint / test (push) Successful in 28s
Trivy / test (push) Successful in 18s
2025-12-15 13:34:20 +11:00
82dc870213
Debian packaging
2025-12-15 13:33:56 +11:00
839d2b9381
Add logo, add AppImage
CI / test (push) Failing after 1m46s
Lint / test (push) Successful in 34s
Trivy / test (push) Successful in 26s
2025-12-15 11:48:09 +11:00
227be6dd51
Many tweaks
2025-12-15 11:04:54 +11:00
5398ad123c
Initial commit
2025-12-14 20:53:22 +11:00
