enroll

Author	SHA1	Message	Date
Miguel Jacq	44d1a22db4	hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate.	2026-06-28 18:17:45 +10:00
Miguel Jacq	07b07e60c5	Ensure paths are not followed through parent links	2026-06-22 15:32:40 +10:00
Miguel Jacq	d93de8a8a2	Fix for remote harvest tmp dir	2026-06-22 12:46:45 +10:00
Miguel Jacq	21a3ef3447	More safety about writing output harvests/manifests to safe locations, including SOPS and diff.	2026-06-22 12:21:33 +10:00
Miguel Jacq	e78f61c5ed	Avoid TOCTOU issues, stronger perms on manifest dir, don't allow harvesting to existing dir by default, scan whole file for potential secrets All checks were successful CI / test (push) Successful in 48s Details CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m19s Details CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 20m40s Details Lint / test (push) Successful in 48s Details	2026-06-22 11:41:11 +10:00