Miguel Jacq mig5 · he/him
0 followers · 0 following
Repositories
9
 Projects Packages Public activity Starred repositories
mig5 pushed tag 0.5.6 to mig5/jinjaturtle 2026-06-23 03:04:35 -05:00
mig5 pushed to main at mig5/jinjaturtle 2026-06-23 03:03:41 -05:00
a9d56b66c5 Fixes for releasing
mig5 pushed to main at mig5/jinjaturtle 2026-06-23 02:15:14 -05:00
c5375b180f 0.5.6
mig5 pushed to main at mig5/jinjaturtle 2026-06-23 00:57:32 -05:00
383a529016 fix test
mig5 pushed to main at mig5/jinjaturtle 2026-06-23 00:43:18 -05:00
a5f8e7c481 Attempt to fix python bin
mig5 pushed to main at mig5/jinjaturtle 2026-06-22 23:30:55 -05:00
15770c8e3d Upgrade to poetry2 and update dependencies
a5ca5f2974 Try to prevent what could lead to execution of embedded jinja in original files when converting
Compare 2 commits »
mig5 pushed to main at mig5/enroll 2026-06-22 05:52:02 -05:00
1d42b2bfb9 Fix typos
mig5 pushed to main at mig5/enroll 2026-06-22 05:41:16 -05:00
d99ba66951 So long, etc
mig5 pushed to main at mig5/enroll 2026-06-22 05:29:58 -05:00
958f8e3aa7 Byebye Enroll
mig5 pushed to main at mig5/enroll.sh 2026-06-22 05:26:57 -05:00
ff1ac0e01c Fixes for a never-to-be-released, um, release
mig5 pushed to main at mig5/enroll 2026-06-22 05:26:20 -05:00
d96ad3dc02 Some more hardening to not process raw jinja inside salt/ansible cmd. But, I think this is the end of the road
c3c3608049 Validate state.json is a normal file
Compare 2 commits »
mig5 pushed to main at mig5/enroll 2026-06-22 02:23:46 -05:00
5757bf4275 Update DEVELOPMENT.md
992b8060a5 validation of artifact dir
efb6d7cc15 Be strict about XDG_CACHE_DIR ownership etc
Compare 3 commits »
mig5 pushed to main at mig5/enroll 2026-06-22 00:39:33 -05:00
4277e029d0 fix changelog
5930758398 Fix pyproject to make debian build happy
Compare 2 commits »
mig5 pushed to main at mig5/enroll 2026-06-22 00:35:09 -05:00
952687e15d Ensure that --include-path records (but does not traverse) symlinks
07b07e60c5 Ensure paths are not followed through parent links
e10a3f62b0 Belts and braces: normalise paths before globbing
c4448226c0 Ensure tests run through the poetry env's pytest
00f960d01e Upgrade to Poetry 2
Compare 5 commits »
mig5 pushed to main at mig5/enroll 2026-06-21 23:51:21 -05:00
70525e52d8 Doc updates
ad019f6b09 normalise control characters in generated manifest scalars
Compare 2 commits »
mig5 pushed to main at mig5/enroll 2026-06-21 23:15:05 -05:00
cec6023a40 Ensure that diff also runs through validate()
1312b7eac2 Add SECURITY.md
Compare 2 commits »
mig5 pushed to main at mig5/enroll 2026-06-21 21:57:28 -05:00
a1d7a9e4e6 Add warning about --dangerous mode if sops is not in use
bf1c72c542 CHANGELOG updates
d93de8a8a2 Fix for remote harvest tmp dir
21a3ef3447 More safety about writing output harvests/manifests to safe locations, including SOPS and diff.
3feba9a9f2 More information about use of --dangerous mode
Compare 7 commits »
mig5 pushed to main at mig5/enroll 2026-06-21 20:41:41 -05:00
e78f61c5ed Avoid TOCTOU issues, stronger perms on manifest dir, don't allow harvesting to existing dir by default, scan whole file for potential secrets
mig5 pushed to main at mig5/enroll 2026-06-21 20:06:44 -05:00
c7a6bfe979 Update tests
a0914e1369 Strict validation of PATH when running as root in case it could contain potentially unsafe binaries
205c419a7a Sanity check on FQDN name to avoid accidental path traversal and similar woes
3e8ad600e2 Use shlex.quote on remote commands
0a0f067111 Add other common strings that could represent sensitive values to ignore unless in --dangerous mode
Compare 7 commits »
mig5 pushed to main at mig5/enroll 2026-06-21 19:05:29 -05:00
1e61ae2ff9 Fix tests for deb build