fix: remove all systemd capability restrictions blocking package management
- Remove CapabilityBoundingSet and AmbientCapabilities (apt needs full root capabilities) - Remove ReadWritePaths (unnecessary without ProtectSystem=strict) - Fix E2E test: properly FAIL on status=failed package operations - Fix E2E test: require status=completed for install/update/remove lifecycle - Update dpkg packaging service file to match configs/ - Bump version to 0.3.5
This commit is contained in:
77
debian/changelog
vendored
77
debian/changelog
vendored
@ -1,58 +1,43 @@
|
||||
linux-patch-api (0.3.5-1) unstable; urgency=low
|
||||
|
||||
* Remove CapabilityBoundingSet and AmbientCapabilities - apt needs full root capabilities
|
||||
* Remove ProtectSystem=strict, NoNewPrivileges, RestrictSUIDSGID - block core functionality
|
||||
* Remove ReadWritePaths - unnecessary without ProtectSystem=strict
|
||||
* Fix E2E test: properly FAIL on status=failed package operations
|
||||
* Fix E2E test: require status=completed for install/update/remove lifecycle
|
||||
* Update service file Type=notify -> Type=simple
|
||||
* Add DEBIAN_FRONTEND=noninteractive environment variable
|
||||
|
||||
-- Echo <echo@moon-dragon.us> Sat, 03 May 2026 03:15:00 -0500
|
||||
|
||||
linux-patch-api (0.3.4-1) unstable; urgency=low
|
||||
|
||||
* Fix CI workflow: prevent recursive tag triggers (v* -> v*.*.*)
|
||||
* Fix CI workflow: upload u2204 deb to same release (no -u2204 suffix)
|
||||
* Remove sudo from apt commands (service runs as root)
|
||||
* Remove NoNewPrivileges and RestrictSUIDSGID from systemd service
|
||||
* Fix dpkg packaging: remove linux-patch-api user creation
|
||||
* Remove NoNewPrivileges and RestrictSUIDSGID from service file
|
||||
* Update service file Type=notify -> Type=simple
|
||||
* Add DEBIAN_FRONTEND=noninteractive environment variable
|
||||
|
||||
-- Echo <echo@moon-dragon.us> Fri, 02 May 2026 22:00:00 -0500
|
||||
|
||||
-- Echo <echo@moon-dragon.us> Sat, 03 May 2026 03:15:00 -0500
|
||||
linux-patch-api (0.3.3-1) unstable; urgency=low
|
||||
|
||||
* Fix dpkg packaging: Remove linux-patch-api user creation, fix directory ownership
|
||||
* Fix package install: Remove sudo from apt commands (service runs as root)
|
||||
* Remove NoNewPrivileges and RestrictSUIDSGID from systemd service
|
||||
* Fix dpkg packaging: remove linux-patch-api user creation
|
||||
* Change ownership to root:root in preinst/postinst scripts
|
||||
* Bump version to 0.3.3
|
||||
|
||||
-- Echo <echo@moon-dragon.us> Fri, 02 May 2026 21:45:00 -0500
|
||||
|
||||
-- Echo <echo@moon-dragon.us> Sat, 03 May 2026 02:30:00 -0500
|
||||
linux-patch-api (0.3.2-1) unstable; urgency=low
|
||||
|
||||
* Fix package install: Remove sudo from apt commands (service runs as root)
|
||||
* Fix reboot endpoint: Implement actual system reboot via shutdown/systemctl
|
||||
* Fix patches handler: Call reboot_system() instead of just logging
|
||||
* Remove NoNewPrivileges and RestrictSUIDSGID from systemd service
|
||||
* Add CAP_SYS_BOOT capability to systemd service for LXC reboot support
|
||||
* Fix dpkg packaging: Remove linux-patch-api user creation, fix directory ownership
|
||||
* Remove sudo from apt commands in source code
|
||||
* Remove NoNewPrivileges=true from service file
|
||||
* Remove RestrictSUIDSGID=true from service file
|
||||
* Add DEBIAN_FRONTEND=noninteractive to service file
|
||||
* Fix TLS 1.3 enforcement in mtls.rs
|
||||
* Add client_disconnect_timeout to main.rs
|
||||
* Optimize RwLock usage in jobs/manager.rs
|
||||
* Bump version to 0.3.2
|
||||
|
||||
-- Echo <echo@moon-dragon.us> Sat, 02 May 2026 21:25:00 -0500
|
||||
linux-patch-api (0.3.1-1) unstable; urgency=low
|
||||
|
||||
* Fix reboot endpoint: Implement actual system reboot via shutdown/systemctl
|
||||
* Fix patches handler: Call reboot_system() instead of just logging
|
||||
* Add CAP_SYS_BOOT capability to systemd service for LXC reboot support
|
||||
* Remove unused warn import
|
||||
|
||||
-- Echo <echo@moon-dragon.us> Sat, 02 May 2026 20:37:00 -0500
|
||||
linux-patch-api (0.3.0-1) unstable; urgency=low
|
||||
|
||||
* v0.3.0 beta release
|
||||
* Fix List Jobs connection reset: Add client_disconnect_timeout (5s)
|
||||
* Enforce TLS 1.3 only with builder_with_provider()
|
||||
* Fix RwLock contention: Release read lock before sorting in list_jobs()
|
||||
* Fix systemd service: Remove ProtectSystem=strict
|
||||
* Fix systemd service: Change Type=notify to Type=simple
|
||||
* Fix systemd service: Add DEBIAN_FRONTEND=noninteractive
|
||||
* Add Ubuntu 22.04 CI build job
|
||||
* Add apt-get -f install for broken runner deps
|
||||
|
||||
-- Echo <echo@moon-dragon.us> Sat, 02 May 2026 19:55:00 -0500
|
||||
linux-patch-api (1.0.0-1) stable; urgency=medium
|
||||
|
||||
* Initial production release
|
||||
* Secure mTLS-authenticated REST API for remote package management
|
||||
* 15 API endpoints for package install/remove, patch application, system management
|
||||
* Asynchronous job processing with WebSocket status streaming
|
||||
* IP whitelist enforcement and comprehensive audit logging
|
||||
* Systemd integration with security hardening
|
||||
* Supports Debian 11/12, Ubuntu 20.04/22.04/24.04
|
||||
|
||||
-- Echo <echo@moon-dragon.us> Thu, 09 Apr 2026 18:57:12 -0500
|
||||
-- Echo <echo@moon-dragon.us> Fri, 02 May 2026 21:30:00 -0500
|
||||
|
||||
Reference in New Issue
Block a user