mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Activity Actions
enroll/enroll
History
Miguel Jacq 5932d22801
Make remote harvest zipapp stdlib-only 
Lazy-load manifest, explain, and validation dependencies so the remote
harvest zipapp does not require jsonschema, PyYAML, Paramiko, or other
site-packages on the target host.

Run the remote zipapp with Python isolated mode and site-packages
disabled, while preserving existing CLI monkeypatch hooks.
2026-08-03 15:58:14 +10:00
..
harvest_collectors Fix import of stat_triplet 2026-06-29 14:51:32 +10:00
schema Metadata: Tighten to prefer stat taken from the no-follow descriptor that was inspected, to avoid tiny TOCTOU. Ensure schema forbids .. in src_rel (even though caught in validate anyway - defense in depth) 2026-07-01 15:52:04 +10:00
__init__.py Initial commit 2025-12-14 20:53:22 +11:00
__main__.py Initial commit 2025-12-14 20:53:22 +11:00
accounts.py hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate. 2026-06-28 18:17:45 +10:00
ansible.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
cache.py Be strict about XDG_CACHE_DIR ownership etc 2026-06-22 17:22:27 +10:00
capture.py Metadata: Tighten to prefer stat taken from the no-follow descriptor that was inspected, to avoid tiny TOCTOU. Ensure schema forbids .. in src_rel (even though caught in validate anyway - defense in depth) 2026-07-01 15:52:04 +10:00
cli.py Make remote harvest zipapp stdlib-only 2026-08-03 15:58:14 +10:00
cm.py Sanitise the diff and explain markdown content like we do with README 2026-07-01 11:03:38 +10:00
debian.py Remove puppet and salt 2026-06-25 16:54:23 +10:00
diff.py Sanitise the diff and explain markdown content like we do with README 2026-07-01 11:03:38 +10:00
explain.py Sanitise the diff and explain markdown content like we do with README 2026-07-01 11:03:38 +10:00
fsutil.py More TOCTOU, update to tests for jinjaturtle 2026-06-29 14:30:07 +10:00
harvest.py More TOCTOU, update to tests for jinjaturtle 2026-06-29 14:30:07 +10:00
harvest_safety.py validation of artifact dir 2026-06-22 17:23:25 +10:00
harvest_types.py Support for detecting Docker images 2026-06-17 18:05:02 +10:00
ignore.py More hardening 2026-07-03 13:17:49 +10:00
jinjaturtle.py More hardening 2026-07-03 12:24:08 +10:00
manifest.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
manifest_safety.py * Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable. 2026-07-13 10:15:43 +10:00
package_hints.py More refactoring, support hiera and multi site mode for Puppet 2026-06-17 10:54:46 +10:00
pathfilter.py Better protection against symlink traversal in flatpak. Other hardening 2026-06-28 17:03:24 +10:00
platform.py Refactor state structure and capture versions of packages 2025-12-29 16:10:27 +11:00
remote.py Make remote harvest zipapp stdlib-only 2026-08-03 15:58:14 +10:00
render_safety.py Remove 'enroll diff --enforce' option. Tighten yaml data re: handlers - use listen: instead of notify: 2026-06-28 16:01:11 +10:00
role_names.py Support for detecting Docker images 2026-06-17 18:05:02 +10:00
rpm.py Group all package roles into Debian/RPM 'sections' 2026-06-14 19:19:59 +10:00
sopsutil.py More safety about writing output harvests/manifests to safe locations, including SOPS and diff. 2026-06-22 12:21:33 +10:00
state.py Validate state.json is a normal file 2026-06-22 17:47:36 +10:00
system_paths.py More refactoring, support hiera and multi site mode for Puppet 2026-06-17 10:54:46 +10:00
systemd.py Capture more singletons in /etc and avoid apt duplication 2025-12-27 19:02:22 +11:00
validate.py Sanitise the 'validate' output error messages too just in case 2026-07-01 11:33:26 +10:00
version.py More test coverage 2026-06-21 13:37:37 +10:00
yamlutil.py Some more hardening to not process raw jinja inside salt/ansible cmd. But, I think this is the end of the road 2026-06-22 20:26:06 +10:00