mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Activity Actions
enroll/tests
History
Miguel Jacq 5bf247c485
All checks were successful
CI / test (push) Successful in 41s
Details
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 9m2s
Details
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 13m39s
Details
Lint / test (push) Successful in 39s
Details
* Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable. 
* Security: enforce tar member limits while lazily parsing untrusted archives rather than after `TarFile.getmembers()` has already indexed the entire archive; count repeated `.` entries and cap remote compressed downloads as well.
 * Security: apply aggregate byte and total filesystem-entry limits when freezing directory harvest bundles, reject symlinked bundle roots, and abort when files or discovered directories change during the copy, so direct directory inputs remain bounded and fail closed under mutation.
2026-07-13 10:15:43 +10:00
..
conftest.py Update tests 2026-06-22 11:06:24 +10:00
state_helpers.py Update tests 2026-06-22 09:58:54 +10:00
test___main__.py 0.1.6 2025-12-28 15:32:40 +11:00
test_accounts.py Better protection against symlink traversal in flatpak. Other hardening 2026-06-28 17:03:24 +10:00
test_cache_security.py Be strict about XDG_CACHE_DIR ownership etc 2026-06-22 17:22:27 +10:00
test_cli.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
test_cli_config_and_sops.py Don't allow .enroll.ini in CWD, rely on env var or XDG path 2026-06-22 09:52:33 +10:00
test_cli_helpers.py More safety about writing output harvests/manifests to safe locations, including SOPS and diff. 2026-06-22 12:21:33 +10:00
test_cm.py Fix notification of individual services when related config changes, even when roles are grouped 2026-06-20 15:31:42 +10:00
test_debian.py Handle gracefully debian stuff when testing on rhel-like 2026-06-21 16:15:33 +10:00
test_diff_bundle.py Close TOCTOU gap by freezing directory harvest bundles into a private 0700 copy before the two consumers that actually read artifacts (manifest and diff) touch them. 2026-06-28 21:07:49 +10:00
test_diff_ignore_versions_exclude.py Remove 'enroll diff --enforce' option. Tighten yaml data re: handlers - use listen: instead of notify: 2026-06-28 16:01:11 +10:00
test_diff_notifications.py Update tests 2026-06-22 09:58:54 +10:00
test_diff_report_sanitize.py Sanitise the diff and explain markdown content like we do with README 2026-07-01 11:03:38 +10:00
test_diff_usr_local_custom.py Fix tests 2025-12-29 16:35:21 +11:00
test_explain.py More test coverage 2026-01-05 14:27:56 +11:00
test_explain_sanitize.py Sanitise the diff and explain markdown content like we do with README 2026-07-01 11:03:38 +10:00
test_fsutil.py More TOCTOU, update to tests for jinjaturtle 2026-06-29 14:30:07 +10:00
test_fsutil_extra.py More test coverage (71%) 2026-01-03 12:34:39 +11:00
test_harvest.py Fix import of stat_triplet 2026-06-29 14:51:32 +10:00
test_harvest_collectors.py Fix import of stat_triplet 2026-06-29 14:51:32 +10:00
test_harvest_collectors_package_manager.py Fix for remote harvest tmp dir 2026-06-22 12:46:45 +10:00
test_harvest_cron_logrotate.py More refactoring, support hiera and multi site mode for Puppet 2026-06-17 10:54:46 +10:00
test_harvest_helpers.py Metadata: Tighten to prefer stat taken from the no-follow descriptor that was inspected, to avoid tiny TOCTOU. Ensure schema forbids .. in src_rel (even though caught in validate anyway - defense in depth) 2026-07-01 15:52:04 +10:00
test_harvest_safety.py hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate. 2026-06-28 18:17:45 +10:00
test_harvest_symlinks.py More refactoring, support hiera and multi site mode for Puppet 2026-06-17 10:54:46 +10:00
test_ignore.py hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate. 2026-06-28 18:17:45 +10:00
test_ignore_dir.py More TOCTOU, update to tests for jinjaturtle 2026-06-29 14:30:07 +10:00
test_jinjaturtle.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
test_manifest.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
test_manifest_ansible.py Remove puppet and salt 2026-06-25 16:54:23 +10:00
test_manifest_safety.py * Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable. 2026-07-13 10:15:43 +10:00
test_manifest_symlinks.py Fix tests for deb build 2026-06-22 10:05:17 +10:00
test_markdown_sanitize.py Ensure markdown README gets sanitised 2026-06-30 12:11:48 +10:00
test_package_hints.py Fix for remote harvest tmp dir 2026-06-22 12:46:45 +10:00
test_pathfilter.py Better protection against symlink traversal in flatpak. Other hardening 2026-06-28 17:03:24 +10:00
test_platform.py more test coverage 2026-05-31 16:50:57 +10:00
test_platform_backends.py More test coverage (71%) 2026-01-03 12:34:39 +11:00
test_remote.py * Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable. 2026-07-13 10:15:43 +10:00
test_render_safety.py hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate. 2026-06-28 18:17:45 +10:00
test_rpm.py Group all package roles into Debian/RPM 'sections' 2026-06-14 19:19:59 +10:00
test_rpm_run.py More test coverage 2026-01-05 14:27:56 +11:00
test_secret_detection.py More hardening 2026-07-03 13:17:49 +10:00
test_sopsutil.py More coverage 2026-05-31 17:15:22 +10:00
test_state_safety.py Validate state.json is a normal file 2026-06-22 17:47:36 +10:00
test_systemd.py More coverage 2026-05-31 17:15:22 +10:00
test_validate.py hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate. 2026-06-28 18:17:45 +10:00
test_validate_sanitize.py Sanitise the 'validate' output error messages too just in case 2026-07-01 11:33:26 +10:00
test_version_extra.py More test coverage 2026-06-21 13:37:37 +10:00