mig5/enroll
1
0
Fork 0
Code Issues Pull requests Projects Releases 4 Packages Activity Actions
enroll/enroll
History
Exact
Miguel Jacq 5bf247c485
All checks were successful
CI / test (push) Successful in 41s
Details
CI / test (almalinux, docker.io/library/almalinux:9, python3.11) (push) Successful in 9m2s
Details
CI / test (debian, docker.io/library/debian:13, python3) (push) Successful in 13m39s
Details
Lint / test (push) Successful in 39s
Details
* Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable. 
* Security: enforce tar member limits while lazily parsing untrusted archives rather than after `TarFile.getmembers()` has already indexed the entire archive; count repeated `.` entries and cap remote compressed downloads as well.
 * Security: apply aggregate byte and total filesystem-entry limits when freezing directory harvest bundles, reject symlinked bundle roots, and abort when files or discovered directories change during the copy, so direct directory inputs remain bounded and fail closed under mutation.
2026-07-13 10:15:43 +10:00
..
harvest_collectors Fix import of stat_triplet 2026-06-29 14:51:32 +10:00
schema Metadata: Tighten to prefer stat taken from the no-follow descriptor that was inspected, to avoid tiny TOCTOU. Ensure schema forbids .. in src_rel (even though caught in validate anyway - defense in depth) 2026-07-01 15:52:04 +10:00
__init__.py Initial commit 2025-12-14 20:53:22 +11:00
__main__.py Initial commit 2025-12-14 20:53:22 +11:00
accounts.py hardlinked source files are refused, remote schema URLs require an explicit flag, generated harvest artifacts use the hardened bundle writer, and task/handler/playbook YAML writes go through one safety gate. 2026-06-28 18:17:45 +10:00
ansible.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
cache.py Be strict about XDG_CACHE_DIR ownership etc 2026-06-22 17:22:27 +10:00
capture.py Metadata: Tighten to prefer stat taken from the no-follow descriptor that was inspected, to avoid tiny TOCTOU. Ensure schema forbids .. in src_rel (even though caught in validate anyway - defense in depth) 2026-07-01 15:52:04 +10:00
cli.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
cm.py Sanitise the diff and explain markdown content like we do with README 2026-07-01 11:03:38 +10:00
debian.py Remove puppet and salt 2026-06-25 16:54:23 +10:00
diff.py Sanitise the diff and explain markdown content like we do with README 2026-07-01 11:03:38 +10:00
explain.py Sanitise the diff and explain markdown content like we do with README 2026-07-01 11:03:38 +10:00
fsutil.py More TOCTOU, update to tests for jinjaturtle 2026-06-29 14:30:07 +10:00
harvest.py More TOCTOU, update to tests for jinjaturtle 2026-06-29 14:30:07 +10:00
harvest_safety.py validation of artifact dir 2026-06-22 17:23:25 +10:00
harvest_types.py Support for detecting Docker images 2026-06-17 18:05:02 +10:00
ignore.py More hardening 2026-07-03 13:17:49 +10:00
jinjaturtle.py More hardening 2026-07-03 12:24:08 +10:00
manifest.py Remove reference to --jinjaturtle auto/on/off (it's a boolean arg). Fix alma python 2026-06-30 12:34:26 +10:00
manifest_safety.py * Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable. 2026-07-13 10:15:43 +10:00
package_hints.py More refactoring, support hiera and multi site mode for Puppet 2026-06-17 10:54:46 +10:00
pathfilter.py Better protection against symlink traversal in flatpak. Other hardening 2026-06-28 17:03:24 +10:00
platform.py Refactor state structure and capture versions of packages 2025-12-29 16:10:27 +11:00
remote.py * Security: keep sudo-created remote harvest bundles root-owned while root packages and hashes them, expose only the archive to the authenticated SSH uid, and verify the root-computed digest after download. This removes the post-harvest tampering window created by recursively chowning the bundle before packaging without making the plaintext archive world-readable. 2026-07-13 10:15:43 +10:00
render_safety.py Remove 'enroll diff --enforce' option. Tighten yaml data re: handlers - use listen: instead of notify: 2026-06-28 16:01:11 +10:00
role_names.py Support for detecting Docker images 2026-06-17 18:05:02 +10:00
rpm.py Group all package roles into Debian/RPM 'sections' 2026-06-14 19:19:59 +10:00
sopsutil.py More safety about writing output harvests/manifests to safe locations, including SOPS and diff. 2026-06-22 12:21:33 +10:00
state.py Validate state.json is a normal file 2026-06-22 17:47:36 +10:00
system_paths.py More refactoring, support hiera and multi site mode for Puppet 2026-06-17 10:54:46 +10:00
systemd.py Capture more singletons in /etc and avoid apt duplication 2025-12-27 19:02:22 +11:00
validate.py Sanitise the 'validate' output error messages too just in case 2026-07-01 11:33:26 +10:00
version.py More test coverage 2026-06-21 13:37:37 +10:00
yamlutil.py Some more hardening to not process raw jinja inside salt/ansible cmd. But, I think this is the end of the road 2026-06-22 20:26:06 +10:00