5bf247c485
* Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable.
...
CI / test (push) Successful in 41s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 9m2s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 13m39s
Lint / test (push) Successful in 39s
* Security: enforce tar member limits while lazily parsing untrusted archives rather than after `TarFile.getmembers()` has already indexed the entire archive; count repeated `.` entries and cap remote compressed downloads as well.
* Security: apply aggregate byte and total filesystem-entry limits when freezing directory harvest bundles, reject symlinked bundle roots, and abort when files or discovered directories change during the copy, so direct directory inputs remain bounded and fail closed under mutation.
2026-07-13 10:15:43 +10:00
1148b34bce
More hardening
CI / test (push) Successful in 1m23s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m47s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m23s
Lint / test (push) Successful in 46s
2026-07-03 13:17:49 +10:00
d2a46394fe
More hardening
CI / test (push) Successful in 51s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m8s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m23s
Lint / test (push) Successful in 43s
2026-07-03 12:24:08 +10:00
47c2c8accc
Metadata: Tighten to prefer stat taken from the no-follow descriptor that was inspected, to avoid tiny TOCTOU. Ensure schema forbids .. in src_rel (even though caught in validate anyway - defense in depth)
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m11s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 17m36s
Lint / test (push) Successful in 51s
2026-07-01 15:52:04 +10:00
c6e171e0f0
Better detection of commented out Authorization strings (ignore policy)
CI / test (push) Successful in 51s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m5s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m28s
Lint / test (push) Successful in 45s
2026-07-01 15:41:38 +10:00
c468bc221e
Sanitise the 'validate' output error messages too just in case
CI / test (push) Successful in 53s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m32s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m31s
Lint / test (push) Successful in 46s
2026-07-01 11:33:26 +10:00
5ffad10665
Catch key/value sensitive strings in ignore, where there is no : or = delimiter
Lint / test (push) Waiting to run
CI / test (push) Successful in 55s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m49s
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
2026-07-01 11:04:33 +10:00
17f771cadd
Sanitise the diff and explain markdown content like we do with README
2026-07-01 11:03:38 +10:00
85345083a3
Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python
CI / test (push) Successful in 53s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m44s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m3s
Lint / test (push) Successful in 46s
2026-06-30 12:34:26 +10:00
e72044b610
Ensure markdown README gets sanitised
Lint / test (push) Waiting to run
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:10, python3.11) (push) Failing after 16s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m21s
2026-06-30 12:11:48 +10:00
43fca6b3da
Resist 'pw' as well
2026-06-30 12:11:17 +10:00
3781d602a1
Fix overenthusiastic match on pass
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m42s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m12s
Lint / test (push) Successful in 1m13s
2026-06-30 11:34:37 +10:00
4146aa997b
Fix tests
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m36s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m2s
Lint / test (push) Successful in 1m15s
2026-06-30 11:11:38 +10:00
b546bb9bf2
Fix import of stat_triplet
CI / test (push) Successful in 49s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 9m3s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 12m13s
Lint / test (push) Successful in 46s
2026-06-29 14:51:32 +10:00
3c1e08bdde
More TOCTOU, update to tests for jinjaturtle
CI / test (push) Successful in 48s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m32s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m0s
Lint / test (push) Successful in 44s
2026-06-29 14:30:07 +10:00
b3d4adf7d4
Show a warning when manifesting from a harvest as reminder it should be trusted first
2026-06-29 12:25:35 +10:00
ddb18403c8
fail loudly on an empty/truncated frozen harvest bundle. Tighten as much as we can the remote harvesting
2026-06-29 08:56:06 +10:00
a2dc054882
Close TOCTOU gap by freezing directory harvest bundles into a private 0700 copy before the two consumers that actually read artifacts (manifest and diff) touch them.
2026-06-28 21:07:49 +10:00
1bfbfd90f6
Escape verbatim JSON and defend against jinja in it. Add option to salt role prefix to guard against malicious injection of var names
2026-06-28 20:34:06 +10:00
44d1a22db4
hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate.
2026-06-28 18:17:45 +10:00
f5b85d29d3
Better protection against symlink traversal in flatpak. Other hardening
2026-06-28 17:03:24 +10:00
903125976d
Remove 'enroll diff --enforce' option. Tighten yaml data re: handlers - use listen: instead of notify:
2026-06-28 16:01:11 +10:00
e9d7d74445
Remove puppet and salt
2026-06-25 16:54:23 +10:00
d96ad3dc02
Some more hardening to not process raw jinja inside salt/ansible cmd. But, I think this is the end of the road
Lint / test (push) Waiting to run
CI / test (push) Successful in 57s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Has been cancelled
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
2026-06-22 20:26:06 +10:00
c3c3608049
Validate state.json is a normal file
2026-06-22 17:47:36 +10:00
992b8060a5
validation of artifact dir
2026-06-22 17:23:25 +10:00
efb6d7cc15
Be strict about XDG_CACHE_DIR ownership etc
2026-06-22 17:22:27 +10:00
952687e15d
Ensure that --include-path records (but does not traverse) symlinks
Lint / test (push) Waiting to run
CI / test (push) Failing after 44s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Has been cancelled
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
2026-06-22 15:34:44 +10:00
07b07e60c5
Ensure paths are not followed through parent links
2026-06-22 15:32:40 +10:00
e10a3f62b0
Belts and braces: normalise paths before globbing
2026-06-22 15:06:46 +10:00
ad019f6b09
normalise control characters in generated manifest scalars
2026-06-22 14:45:12 +10:00
cec6023a40
Ensure that diff also runs through validate()
CI / test (push) Successful in 48s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m15s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 20m51s
Lint / test (push) Successful in 46s
2026-06-22 14:14:51 +10:00
d93de8a8a2
Fix for remote harvest tmp dir
2026-06-22 12:46:45 +10:00
21a3ef3447
More safety about writing output harvests/manifests to safe locations, including SOPS and diff.
2026-06-22 12:21:33 +10:00
e78f61c5ed
Avoid TOCTOU issues, stronger perms on manifest dir, don't allow harvesting to existing dir by default, scan whole file for potential secrets
CI / test (push) Successful in 48s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m19s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 20m40s
Lint / test (push) Successful in 48s
2026-06-22 11:41:11 +10:00
c7a6bfe979
Update tests
CI / test (push) Successful in 51s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m30s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 19m55s
Lint / test (push) Successful in 44s
2026-06-22 11:06:24 +10:00
0a0f067111
Add other common strings that could represent sensitive values to ignore unless in --dangerous mode
2026-06-22 10:57:54 +10:00
1e61ae2ff9
Fix tests for deb build
CI / test (push) Successful in 49s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m32s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 20m1s
Lint / test (push) Successful in 44s
2026-06-22 10:05:17 +10:00
67b92731f6
Update tests
Lint / test (push) Waiting to run
CI / test (push) Failing after 49s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Has been cancelled
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
2026-06-22 09:58:54 +10:00
a85e8265f4
Don't allow .enroll.ini in CWD, rely on env var or XDG path
2026-06-22 09:52:33 +10:00
6ee8c60e64
Fix the almalinux tests - skip jinjaturtle and systemd in CI
CI / test (push) Successful in 46s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m26s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 20m24s
Lint / test (push) Successful in 45s
2026-06-21 17:49:51 +10:00
ce2652a3b3
Handle gracefully debian stuff when testing on rhel-like
CI / test (push) Has been cancelled
Lint / test (push) Has been cancelled
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 5m10s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 10m10s
2026-06-21 16:15:33 +10:00
fc120f02a5
More test coverage
2026-06-21 13:37:37 +10:00
a0ac28f213
Support '--enforce' mode in 'enroll diff' with '--target' to use a specific config manager to run to enforce
CI / test (push) Successful in 27m26s
Lint / test (push) Successful in 45s
2026-06-21 12:38:10 +10:00
f335077e59
Fix salt rendering of yaml/json
2026-06-20 18:38:49 +10:00
8cbde1423a
erb support, and fix notify services in puppet/salt in fqdn mode
2026-06-20 18:22:08 +10:00
097022f782
Fix notification of individual services when related config changes, even when roles are grouped
CI / test (push) Successful in 19m18s
Lint / test (push) Successful in 42s
2026-06-20 15:31:42 +10:00
ceb86c513c
Improve test coverage of salt and puppet
Lint / test (push) Waiting to run
CI / test (push) Has been cancelled
2026-06-20 12:30:02 +10:00
899724097e
Standardise more into CMModule parent class for the 3 child renderers
Lint / test (push) Waiting to run
CI / test (push) Has been cancelled
2026-06-20 12:19:04 +10:00
7379587a28
Don't enforce /etc/enroll if no firewall rules to set in subdir
CI / test (push) Successful in 19m38s
Lint / test (push) Successful in 43s
2026-06-19 20:29:12 +10:00
