mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Activity Actions
enroll/tests
History
Miguel Jacq 1e9806d2dc
Some checks failed
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Waiting to run
Details
CI / test (debian, docker.io/library/debian:13, python3) (push) Waiting to run
Details
Lint / test (push) Waiting to run
Details
CI / test (push) Has been cancelled
Details
Fix a TOCTOU in remote harvest zipapp 
Promote uploaded zipapps into a private root-owned directory before
verification and execution. Copy and hash through the same pinned file
descriptor, reject unsafe file types and metadata, publish atomically,
and ensure sudo executes only the verified root-owned copy.
2026-08-03 15:29:17 +10:00
..
conftest.py Update tests 2026-06-22 11:06:24 +10:00
state_helpers.py Update tests 2026-06-22 09:58:54 +10:00
test___main__.py 0.1.6 2025-12-28 15:32:40 +11:00
test_accounts.py Better protection against symlink traversal in flatpak. Other hardening 2026-06-28 17:03:24 +10:00
test_cache_security.py Be strict about XDG_CACHE_DIR ownership etc 2026-06-22 17:22:27 +10:00
test_cli.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
test_cli_config_and_sops.py Don't allow .enroll.ini in CWD, rely on env var or XDG path 2026-06-22 09:52:33 +10:00
test_cli_helpers.py More safety about writing output harvests/manifests to safe locations, including SOPS and diff. 2026-06-22 12:21:33 +10:00
test_cm.py Fix notification of individual services when related config changes, even when roles are grouped 2026-06-20 15:31:42 +10:00
test_debian.py Handle gracefully debian stuff when testing on rhel-like 2026-06-21 16:15:33 +10:00
test_diff_bundle.py Close TOCTOU gap by freezing directory harvest bundles into a private 0700 copy before the two consumers that actually read artifacts (manifest and diff) touch them. 2026-06-28 21:07:49 +10:00
test_diff_ignore_versions_exclude.py Remove 'enroll diff --enforce' option. Tighten yaml data re: handlers - use listen: instead of notify: 2026-06-28 16:01:11 +10:00
test_diff_notifications.py Update tests 2026-06-22 09:58:54 +10:00
test_diff_report_sanitize.py Sanitise the diff and explain markdown content like we do with README 2026-07-01 11:03:38 +10:00
test_diff_usr_local_custom.py Fix tests 2025-12-29 16:35:21 +11:00
test_explain.py More test coverage 2026-01-05 14:27:56 +11:00
test_explain_sanitize.py Sanitise the diff and explain markdown content like we do with README 2026-07-01 11:03:38 +10:00
test_fsutil.py More TOCTOU, update to tests for jinjaturtle 2026-06-29 14:30:07 +10:00
test_fsutil_extra.py More test coverage (71%) 2026-01-03 12:34:39 +11:00
test_harvest.py Fix import of stat_triplet 2026-06-29 14:51:32 +10:00
test_harvest_collectors.py Fix import of stat_triplet 2026-06-29 14:51:32 +10:00
test_harvest_collectors_package_manager.py Fix for remote harvest tmp dir 2026-06-22 12:46:45 +10:00
test_harvest_cron_logrotate.py More refactoring, support hiera and multi site mode for Puppet 2026-06-17 10:54:46 +10:00
test_harvest_helpers.py Metadata: Tighten to prefer stat taken from the no-follow descriptor that was inspected, to avoid tiny TOCTOU. Ensure schema forbids .. in src_rel (even though caught in validate anyway - defense in depth) 2026-07-01 15:52:04 +10:00
test_harvest_safety.py hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate. 2026-06-28 18:17:45 +10:00
test_harvest_symlinks.py More refactoring, support hiera and multi site mode for Puppet 2026-06-17 10:54:46 +10:00
test_ignore.py hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate. 2026-06-28 18:17:45 +10:00
test_ignore_dir.py More TOCTOU, update to tests for jinjaturtle 2026-06-29 14:30:07 +10:00
test_jinjaturtle.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
test_manifest.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
test_manifest_ansible.py Remove puppet and salt 2026-06-25 16:54:23 +10:00
test_manifest_safety.py * Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable. 2026-07-13 10:15:43 +10:00
test_manifest_symlinks.py Fix tests for deb build 2026-06-22 10:05:17 +10:00
test_markdown_sanitize.py Ensure markdown README gets sanitised 2026-06-30 12:11:48 +10:00
test_package_hints.py Fix for remote harvest tmp dir 2026-06-22 12:46:45 +10:00
test_pathfilter.py Better protection against symlink traversal in flatpak. Other hardening 2026-06-28 17:03:24 +10:00
test_platform.py more test coverage 2026-05-31 16:50:57 +10:00
test_platform_backends.py More test coverage (71%) 2026-01-03 12:34:39 +11:00
test_remote.py Fix a TOCTOU in remote harvest zipapp 2026-08-03 15:29:17 +10:00
test_remote_pyz_promotion.py Fix a TOCTOU in remote harvest zipapp 2026-08-03 15:29:17 +10:00
test_render_safety.py hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate. 2026-06-28 18:17:45 +10:00
test_rpm.py Group all package roles into Debian/RPM 'sections' 2026-06-14 19:19:59 +10:00
test_rpm_run.py More test coverage 2026-01-05 14:27:56 +11:00
test_secret_detection.py More hardening 2026-07-03 13:17:49 +10:00
test_sopsutil.py More coverage 2026-05-31 17:15:22 +10:00
test_state_safety.py Validate state.json is a normal file 2026-06-22 17:47:36 +10:00
test_systemd.py More coverage 2026-05-31 17:15:22 +10:00
test_validate.py hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate. 2026-06-28 18:17:45 +10:00
test_validate_sanitize.py Sanitise the 'validate' output error messages too just in case 2026-07-01 11:33:26 +10:00
test_version_extra.py More test coverage 2026-06-21 13:37:37 +10:00