mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Activity Actions

4 releases 25 tags

RSS feed
  • 0.7.0 da0d8851d3

    0.7.0
    All checks were successful
    CI / test (push) Successful in 56s
    Details
    CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 11m59s
    Details
    CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 17m26s
    Details
    Lint / test (push) Successful in 53s
    Details
    Stable

    mig5 released this 2026-07-09 20:38:37 -05:00 | 9 commits to main since this release

    • BREAKING CHANGE: Remove the enroll diff --enforce option. Enroll no longer applies the old harvest state locally to repair drift; this avoids the risk of enforcing a potentially malicious or tampered harvest. To restore baseline state, regenerate a manifest from the trusted harvest and apply it yourself, or compare two enroll diff runs and act on the result.
    • BREAKING CHANGE: Group all package and systemd-unit roles into Debian Section/RPM Group roles by default, including managed config files and unit state. This mode is not used if --fqdn or --no-common-roles is set, in which case, the traditional behaviour of preserving one role per package/unit is used instead.
    • BREAKING CHANGE: Only capture user-specific .bashrc style files when using --dangerous mode, in case they contain sensitive env vars.
    • BREAKING CHANGE: Don't allow reading .enroll.ini in the CWD. Use only the ENROLL_CONFIG env var, an explicit --config path or else the XDG default location (or ~/.config/enroll/enroll.ini if XDG_CONFIG_HOME is not set).
    • Detect active sysctl parameters and write them to a /etc/sysctl.d/99-enroll.conf file
    • Use no_log on systemd unit interrogations to suppress potential sensitive output when applying Ansible
    • Support for detecting Docker and Podman images and enforcing their presence (by SHA256 hash).
    • Add support for detecting Flatpaks and Snaps.
    • Stricter validation of harvests to ensure that they meet the schema and don't contain unsafe artifacts (e.g symlinks pointing outside the artifact tree)
    • Perform harvest validation before trying to manifest from it.
    • Stricter validation on FQDN name in multisite mode.
    • Strict check of $PATH when running harvest as root, in case it could lead to execution of unsafe binaries during harvest. Override with --assume-safe-path for non-interactive or CI purposes.
    • Stricter validation of the destination dirs that harvest or manifest write to, to prevent writing to a different user-controlled area. Stricter permissions on the output dirs too.
    Downloads