|
|
40bff49815
|
Forbid the ansible globals
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m12s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 17m18s
Lint / test (push) Successful in 46s
|
2026-07-02 14:52:20 +10:00 |
|
|
|
65cbe18819
|
Don't reference built-in globals in Jinja2 into keys
Lint / test (push) Waiting to run
CI / test (push) Successful in 52s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m12s
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
|
2026-07-02 14:21:23 +10:00 |
|
|
|
47c2c8accc
|
Metadata: Tighten to prefer stat taken from the no-follow descriptor that was inspected, to avoid tiny TOCTOU. Ensure schema forbids .. in src_rel (even though caught in validate anyway - defense in depth)
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m11s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 17m36s
Lint / test (push) Successful in 51s
|
2026-07-01 15:52:04 +10:00 |
|
|
|
c6e171e0f0
|
Better detection of commented out Authorization strings (ignore policy)
CI / test (push) Successful in 51s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m5s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m28s
Lint / test (push) Successful in 45s
|
2026-07-01 15:41:38 +10:00 |
|
|
|
c468bc221e
|
Sanitise the 'validate' output error messages too just in case
CI / test (push) Successful in 53s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m32s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m31s
Lint / test (push) Successful in 46s
|
2026-07-01 11:33:26 +10:00 |
|
|
|
5ffad10665
|
Catch key/value sensitive strings in ignore, where there is no : or = delimiter
Lint / test (push) Waiting to run
CI / test (push) Successful in 55s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m49s
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
|
2026-07-01 11:04:33 +10:00 |
|
|
|
17f771cadd
|
Sanitise the diff and explain markdown content like we do with README
|
2026-07-01 11:03:38 +10:00 |
|
|
|
a34813e788
|
Update README.md
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m11s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m42s
Lint / test (push) Successful in 45s
|
2026-06-30 15:48:31 +10:00 |
|
|
|
85345083a3
|
Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python
CI / test (push) Successful in 53s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 10m44s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m3s
Lint / test (push) Successful in 46s
|
2026-06-30 12:34:26 +10:00 |
|
|
|
e72044b610
|
Ensure markdown README gets sanitised
Lint / test (push) Waiting to run
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:10, python3.11) (push) Failing after 16s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m21s
|
2026-06-30 12:11:48 +10:00 |
|
|
|
43fca6b3da
|
Resist 'pw' as well
|
2026-06-30 12:11:17 +10:00 |
|
|
|
3b9cfea404
|
Build on almalinux 10?
|
2026-06-30 12:01:25 +10:00 |
|
|
|
f3e8387a10
|
Fix in right place
CI / test (push) Successful in 51s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 9m8s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 16m25s
Lint / test (push) Successful in 45s
|
2026-06-30 11:48:08 +10:00 |
|
|
|
a98d3372fb
|
Fix perms
Lint / test (push) Waiting to run
CI / test (push) Successful in 49s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m40s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m12s
|
2026-06-30 11:43:07 +10:00 |
|
|
|
3781d602a1
|
Fix overenthusiastic match on pass
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m42s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m12s
Lint / test (push) Successful in 1m13s
|
2026-06-30 11:34:37 +10:00 |
|
|
|
4146aa997b
|
Fix tests
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m36s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m2s
Lint / test (push) Successful in 1m15s
|
2026-06-30 11:11:38 +10:00 |
|
|
|
737316d507
|
More phrases to catch as potentially sensitive
|
2026-06-30 11:10:57 +10:00 |
|
|
|
6d55ac6cc5
|
jinjaturtle tests can run on rpm via git
CI / test (push) Successful in 1m21s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m40s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m38s
Lint / test (push) Successful in 47s
|
2026-06-30 09:26:34 +10:00 |
|
|
|
0fd722281e
|
Fix test of jinjaturtle without apt
CI / test (push) Successful in 48s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 8m38s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 17m4s
Lint / test (push) Successful in 45s
|
2026-06-29 20:45:21 +10:00 |
|
|
|
bb17e57f93
|
Revert "Try and install jinjaturtle via poetry / appimage"
This reverts commit 76aafcc08d.
|
2026-06-29 15:05:26 +10:00 |
|
|
|
b546bb9bf2
|
Fix import of stat_triplet
CI / test (push) Successful in 49s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 9m3s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 12m13s
Lint / test (push) Successful in 46s
|
2026-06-29 14:51:32 +10:00 |
|
|
|
3c1e08bdde
|
More TOCTOU, update to tests for jinjaturtle
CI / test (push) Successful in 48s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 2m32s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m0s
Lint / test (push) Successful in 44s
|
2026-06-29 14:30:07 +10:00 |
|
|
|
56ae883948
|
Don't skip jinjaturtle on RPM
|
2026-06-29 14:16:28 +10:00 |
|
|
|
76aafcc08d
|
Try and install jinjaturtle via poetry / appimage
CI / test (push) Successful in 50s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 8m40s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 11m53s
Lint / test (push) Successful in 47s
|
2026-06-29 14:05:52 +10:00 |
|
|
|
78b52eae71
|
Fix tests
CI / test (push) Successful in 49s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 8m18s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 11m13s
Lint / test (push) Successful in 44s
|
2026-06-29 13:19:04 +10:00 |
|
|
|
1c20dddf52
|
Update docs
|
2026-06-29 13:18:25 +10:00 |
|
|
|
7519adc705
|
Update docs
Lint / test (push) Waiting to run
CI / test (push) Successful in 58s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 3m16s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 3m46s
|
2026-06-29 13:13:33 +10:00 |
|
|
|
b3d4adf7d4
|
Show a warning when manifesting from a harvest as reminder it should be trusted first
|
2026-06-29 12:25:35 +10:00 |
|
|
|
ddb18403c8
|
fail loudly on an empty/truncated frozen harvest bundle. Tighten as much as we can the remote harvesting
|
2026-06-29 08:56:06 +10:00 |
|
|
|
a2dc054882
|
Close TOCTOU gap by freezing directory harvest bundles into a private 0700 copy before the two consumers that actually read artifacts (manifest and diff) touch them.
|
2026-06-28 21:07:49 +10:00 |
|
|
|
1bfbfd90f6
|
Escape verbatim JSON and defend against jinja in it. Add option to salt role prefix to guard against malicious injection of var names
|
2026-06-28 20:34:06 +10:00 |
|
|
|
44d1a22db4
|
hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate.
|
2026-06-28 18:17:45 +10:00 |
|
|
|
f56f076765
|
Update CHANGELOG
|
2026-06-28 17:43:28 +10:00 |
|
|
|
f5b85d29d3
|
Better protection against symlink traversal in flatpak. Other hardening
|
2026-06-28 17:03:24 +10:00 |
|
|
|
903125976d
|
Remove 'enroll diff --enforce' option. Tighten yaml data re: handlers - use listen: instead of notify:
|
2026-06-28 16:01:11 +10:00 |
|
|
|
e9d7d74445
|
Remove puppet and salt
|
2026-06-25 16:54:23 +10:00 |
|
|
|
88e9dba39a
|
Revert "Byebye Enroll"
This reverts commit 958f8e3aa7.
|
2026-06-25 16:14:19 +10:00 |
|
|
|
680d286a20
|
Revert "So long, etc"
This reverts commit d99ba66951.
|
2026-06-25 16:14:08 +10:00 |
|
|
|
8a9fe82461
|
Revert "Fix typos"
This reverts commit 1d42b2bfb9.
|
2026-06-25 16:13:50 +10:00 |
|
|
|
1d42b2bfb9
|
Fix typos
CI / test (push) Successful in 52s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 3m47s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 4m16s
Lint / test (push) Successful in 53s
|
2026-06-22 20:51:52 +10:00 |
|
|
|
d99ba66951
|
So long, etc
CI / test (push) Successful in 53s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 3m52s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 4m23s
Lint / test (push) Has been cancelled
|
2026-06-22 20:40:51 +10:00 |
|
|
|
958f8e3aa7
|
Byebye Enroll
Lint / test (push) Waiting to run
CI / test (push) Successful in 54s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Failing after 3m46s
CI / test (debian, docker.io/library/debian:13, python3) (push) Failing after 4m25s
|
2026-06-22 20:29:47 +10:00 |
|
|
|
d96ad3dc02
|
Some more hardening to not process raw jinja inside salt/ansible cmd. But, I think this is the end of the road
Lint / test (push) Waiting to run
CI / test (push) Successful in 57s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Has been cancelled
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
|
2026-06-22 20:26:06 +10:00 |
|
|
|
c3c3608049
|
Validate state.json is a normal file
|
2026-06-22 17:47:36 +10:00 |
|
|
|
5757bf4275
|
Update DEVELOPMENT.md
CI / test (push) Successful in 51s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 12m41s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 22m25s
Lint / test (push) Successful in 1m19s
|
2026-06-22 17:23:31 +10:00 |
|
|
|
992b8060a5
|
validation of artifact dir
|
2026-06-22 17:23:25 +10:00 |
|
|
|
efb6d7cc15
|
Be strict about XDG_CACHE_DIR ownership etc
|
2026-06-22 17:22:27 +10:00 |
|
|
|
4277e029d0
|
fix changelog
CI / test (push) Successful in 52s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m50s
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 21m39s
Lint / test (push) Successful in 47s
|
2026-06-22 15:39:22 +10:00 |
|
|
|
5930758398
|
Fix pyproject to make debian build happy
|
2026-06-22 15:39:17 +10:00 |
|
|
|
952687e15d
|
Ensure that --include-path records (but does not traverse) symlinks
Lint / test (push) Waiting to run
CI / test (push) Failing after 44s
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Has been cancelled
CI / test (debian, docker.io/library/debian:13, python3) (push) Has been cancelled
|
2026-06-22 15:34:44 +10:00 |
|
