| .. |
|
harvest_collectors
|
Fix import of stat_triplet
|
2026-06-29 14:51:32 +10:00 |
|
schema
|
Support for detecting Docker images
|
2026-06-17 18:05:02 +10:00 |
|
__init__.py
|
Initial commit
|
2025-12-14 20:53:22 +11:00 |
|
__main__.py
|
Initial commit
|
2025-12-14 20:53:22 +11:00 |
|
accounts.py
|
hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate.
|
2026-06-28 18:17:45 +10:00 |
|
ansible.py
|
Close TOCTOU gap by freezing directory harvest bundles into a private 0700 copy before the two consumers that actually read artifacts (manifest and diff) touch them.
|
2026-06-28 21:07:49 +10:00 |
|
cache.py
|
Be strict about XDG_CACHE_DIR ownership etc
|
2026-06-22 17:22:27 +10:00 |
|
capture.py
|
hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate.
|
2026-06-28 18:17:45 +10:00 |
|
cli.py
|
hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate.
|
2026-06-28 18:17:45 +10:00 |
|
cm.py
|
Remove puppet and salt
|
2026-06-25 16:54:23 +10:00 |
|
debian.py
|
Remove puppet and salt
|
2026-06-25 16:54:23 +10:00 |
|
diff.py
|
Close TOCTOU gap by freezing directory harvest bundles into a private 0700 copy before the two consumers that actually read artifacts (manifest and diff) touch them.
|
2026-06-28 21:07:49 +10:00 |
|
explain.py
|
Ensure paths are not followed through parent links
|
2026-06-22 15:32:40 +10:00 |
|
fsutil.py
|
More TOCTOU, update to tests for jinjaturtle
|
2026-06-29 14:30:07 +10:00 |
|
harvest.py
|
More TOCTOU, update to tests for jinjaturtle
|
2026-06-29 14:30:07 +10:00 |
|
harvest_safety.py
|
validation of artifact dir
|
2026-06-22 17:23:25 +10:00 |
|
harvest_types.py
|
Support for detecting Docker images
|
2026-06-17 18:05:02 +10:00 |
|
ignore.py
|
More TOCTOU, update to tests for jinjaturtle
|
2026-06-29 14:30:07 +10:00 |
|
jinjaturtle.py
|
Escape verbatim JSON and defend against jinja in it. Add option to salt role prefix to guard against malicious injection of var names
|
2026-06-28 20:34:06 +10:00 |
|
manifest.py
|
Show a warning when manifesting from a harvest as reminder it should be trusted first
|
2026-06-29 12:25:35 +10:00 |
|
manifest_safety.py
|
fail loudly on an empty/truncated frozen harvest bundle. Tighten as much as we can the remote harvesting
|
2026-06-29 08:56:06 +10:00 |
|
package_hints.py
|
More refactoring, support hiera and multi site mode for Puppet
|
2026-06-17 10:54:46 +10:00 |
|
pathfilter.py
|
Better protection against symlink traversal in flatpak. Other hardening
|
2026-06-28 17:03:24 +10:00 |
|
platform.py
|
Refactor state structure and capture versions of packages
|
2025-12-29 16:10:27 +11:00 |
|
remote.py
|
fail loudly on an empty/truncated frozen harvest bundle. Tighten as much as we can the remote harvesting
|
2026-06-29 08:56:06 +10:00 |
|
render_safety.py
|
Remove 'enroll diff --enforce' option. Tighten yaml data re: handlers - use listen: instead of notify:
|
2026-06-28 16:01:11 +10:00 |
|
role_names.py
|
Support for detecting Docker images
|
2026-06-17 18:05:02 +10:00 |
|
rpm.py
|
Group all package roles into Debian/RPM 'sections'
|
2026-06-14 19:19:59 +10:00 |
|
sopsutil.py
|
More safety about writing output harvests/manifests to safe locations, including SOPS and diff.
|
2026-06-22 12:21:33 +10:00 |
|
state.py
|
Validate state.json is a normal file
|
2026-06-22 17:47:36 +10:00 |
|
system_paths.py
|
More refactoring, support hiera and multi site mode for Puppet
|
2026-06-17 10:54:46 +10:00 |
|
systemd.py
|
Capture more singletons in /etc and avoid apt duplication
|
2025-12-27 19:02:22 +11:00 |
|
validate.py
|
hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate.
|
2026-06-28 18:17:45 +10:00 |
|
version.py
|
More test coverage
|
2026-06-21 13:37:37 +10:00 |
|
yamlutil.py
|
Some more hardening to not process raw jinja inside salt/ansible cmd. But, I think this is the end of the road
|
2026-06-22 20:26:06 +10:00 |
