5 releases 26 tags

RSS feed

• 0.9.0 6c90107d56

  Compare

  0.9.0 Stable

  mig5 released this 2026-09-27 02:10:13 -05:00 | 6 commits to main since this release

  0.9.0

  Breaking changes

  • Replace manifest --fqdn with explicit --host and --extend. Standalone output still requires a new directory; multi-host extension requires metadata generated by this version.
  • Make live firewall and sysctl capture opt-in with --harvest-firewall and --harvest-sysctl on local/remote harvest and single-shot. Persistent configuration is still harvested normally. Existing bundles retain their recorded runtime snapshots.

  Changes for multi-host projects

  • Share roles when their task and handler implementations match. Keep identical artifacts in the role; promote a differing artifact into per-host inventory for all affected hosts, including later extensions. Preserve complete per-host settings and independent play order. Distinct task or handler implementations retain separate roles named after the host.
  • Generate one inventory-driven restart handler per grouped service role, so hosts with different active service lists can share the role. A notified handler restarts all active services listed for that role on that host.
  • Run APT and DNF repository configuration once, before package prerequisites, while keeping their roles selected for multi-host sharing and artifact validation.
  • Keep package, account and service activation phases out of the generated play's configuration pass. A generated role's default entry point still performs the complete role when imported independently.
  • Add hosts without retaining earlier harvests. Preserve edited host variables; refuse duplicate hosts, edited roles needed for sharing, namespace collisions and conflicting collection requirements.
  • Lock and stage extensions, detect concurrent changes, then publish with an atomic Linux directory exchange. Reject unsafe filesystem entries and unsupported atomic publication without changing existing projects.
  • Keep versioned project metadata and per-host capture notes. Support --host/--extend on manifest and single-shot; encrypted projects must be unpacked before extension.

  Security and correctness

  • Associate service packages using installed direct dependencies and shared source identity on both Debian/Ubuntu and RPM/DNF/Yum systems. Capture related configuration in the service role; use deterministic ambiguity handling and record attribution evidence. Avoid recursive dependency grouping and retain the namespace fallback when attribution is unresolved.

  • Keep independently harvested same-named services and packages in separate artifact namespaces (for example console_setup and package_console_setup), instead of aborting when package ownership inference does not associate them. Retain rejection of ambiguous normalized names within each resource type.

  • Screen Flatpak remote metadata and opted-in runtime output for secrets; prevent FIFO reads from blocking before validation.

  • Scope service handlers per role/unit, filter changed loop results, and activate symlink and systemd unit/drop-in changes.

  • Install package/account prerequisites before configuration and defer service activation until all configuration is deployed. Keep multi-host prerequisite and activation imports on the selected host-specific role. Capture unpackaged unit fragments and report executable prerequisites.

  • Preserve group GIDs and refuse conflicting identity mappings; retain additive supplementary memberships.

  • Compare DNF/firewall artifacts, directories, symlinks, images and application inventories. Observe all installed packages, including automatic dependencies.

  • Honor generated-runtime destination exclusions; fail Snap replay instead of silently dropping requested attributes.

  • Add optional firewall boot restoration with ipset-before-iptables ordering and per-run reconciliation. firewall_runtime_persist defaults to false to avoid competing with existing persistence.

  • Reject role-name collisions, reserve enroll_runtime, stage manifest publication, and refuse incompatible retained templates.

  • Always emit standalone Ansible configuration and collection requirements; synchronize modern and legacy package metadata.

  Downloads

  • enroll-0.9.0-py3-none-any.whl
    5 downloads · 2026-09-27 02:08:52 -05:00 · 197 KiB
  • enroll-0.9.0-py3-none-any.whl.asc
    7 downloads · 2026-09-27 02:08:51 -05:00 · 833 B
  • enroll-0.9.0.tar.gz
    5 downloads · 2026-09-27 02:08:51 -05:00 · 186 KiB
  • enroll-0.9.0.tar.gz.asc
    8 downloads · 2026-09-27 02:08:50 -05:00 · 833 B
  • Enroll.AppImage
    12 downloads · 2026-09-27 02:09:06 -05:00 · 27 MiB
  • Enroll.AppImage.asc
    6 downloads · 2026-09-27 02:09:39 -05:00 · 833 B