cc67edab12
fix: resolve CI failures (fmt, clippy, tests)
...
- Fix rustfmt formatting in cache.rs, patches.rs, system.rs, routes.rs, main.rs
- Add Default impl for PackageCacheState (clippy new_without_default)
- Change apply_with_cache_retry generic bound from Fn to FnMut
- Add mut to refresh_fn parameter for FnMut compatibility
- Replace bool comparison with ! operator (clippy bool_comparison)
- Update todo.md with completed status
2026-05-27 15:04:25 -05:00
135c91d256
fix: add package cache refresh before apply and on health check
...
- New src/packages/cache.rs module with PackageCacheState, stale detection,
state persistence, 404 retry logic
- Add refresh_package_cache() and last_cache_update() to PackageManagerBackend
trait, implemented on all 5 backends (APT, DNF, YUM, APK, Pacman)
- Health check now reports last_cache_update and cache_status fields,
triggers cache refresh if stale (>4h), returns degraded on failure
- Patch apply jobs now force cache refresh before applying patches,
with 404/fetch error retry (1 retry after cache refresh)
- Cache state persists to /var/lib/linux_patch_api/state/cache.json
- Version bump to 1.1.17
- Update ARCHITECTURE.md and REQUIREMENTS.md (FR-007)
Closes : #2
2026-05-27 14:33:12 -05:00
6fab250ea8
feat: add Pacman backend for Arch Linux, fix Arch CI stale packages
2026-05-20 22:24:06 +00:00
58ad92d431
style: fix rustfmt formatting for DNF/YUM backend
2026-05-20 20:59:55 +00:00
d682c7c69c
feat: add DNF and YUM package manager backends for RPM-based systems
2026-05-20 20:54:38 +00:00
1e4c8e4dc2
fix: detect apk at /sbin/apk on Alpine (not just /usr/bin/apk); v1.1.13
2026-05-20 18:54:10 +00:00
891ca09f34
feat: Add APK (Alpine Linux) package manager backend; machine-id generation; OpenRC fix; v1.1.12
2026-05-20 17:25:21 +00:00
f3fb84927a
style: fix rustfmt formatting for CI
2026-05-18 23:54:15 +00:00
b6809dc935
fix: FQDN resolution and display_name blank bug; fix: Arch/Alpine/RPM packages
...
Bug fixes:
- get_fqdn() now prioritizes 'hostname -f' (returns full FQDN) over /etc/hostname (returns short hostname)
- Added get_hostname() for short hostname extraction
- Added hostname field to EnrollmentRequest for manager display_name population
- Updated SPEC.md and API_DOCUMENTATION.md
Package fixes:
- Arch: Added linux-patch-api.install with post_install/upgrade/remove hooks, user creation, directory creation, config handling
- Alpine: Added linux-patch-api.apk-install with pre/post install/deinstall hooks, user creation, directory creation, config handling, missing config.yaml.example
- RPM: Dynamic version from Cargo.toml, %ghost %config(noreplace) for live configs, tarball exclusions, /var/log in %files
2026-05-18 23:51:00 +00:00
6a41eba9d8
fix(server): add explicit rustls CryptoProvider initialization for v1.1.6
...
- Add rustls::crypto::aws_lc_rs::default_provider().install_default()
in main() before any TLS operations to prevent startup panic
- Bump version from 1.1.5 to 1.1.6
- Update debian/changelog with 1.1.6-1 entry
2026-05-18 13:43:34 +00:00
48fb8752c9
feat(enrollment): add route-based IP selection and fix package versioning for v1.1.5
2026-05-18 03:35:46 +00:00
0de47b966b
style: apply cargo fmt formatting
2026-05-18 02:06:25 +00:00
64187b03bd
fix(enrollment): filter Docker bridge IPs and add report_interface/report_ip config
...
- identity.rs: filter 172.16.0.0/12 (Docker bridge) and 169.254.0.0/16 (link-local)
from get_ip_addresses() auto-detection
- identity.rs: add is_container_bridge(), is_link_local(),
get_ip_for_interface(), get_primary_ip() functions
- client.rs: add report_interface/report_ip fields to EnrollmentClient,
new with_ip_overrides() constructor, register() uses get_primary_ip()
- loader.rs: add report_interface/report_ip to EnrollmentConfig
- mod.rs: wire config overrides through to EnrollmentClient
- config.yaml.example: document new report_interface/report_ip options
- Tests: add 18 new bridge filtering/IP override tests, fix Docker
container compatibility in existing tests
2026-05-18 02:02:54 +00:00
f5eb2286a9
fix(tests): update test suite for AppConfig::load signature change
2026-05-17 22:28:17 +00:00
f57d92406f
fix(enroll): skip TLS validation during enrollment bootstrap to allow certificate acquisition
2026-05-17 22:20:48 +00:00
a08145ed9e
fix: add truncate(true) to lock file OpenOptions for clippy compliance
...
Resolves clippy::suspicious_open_options warning on whitelist lock file creation.
2026-05-17 15:21:52 +00:00
5c670cbd0c
fix: apply cargo fmt to resolve CI formatting failures
...
Format all enrollment module source files and tests per rustfmt standards.
Resolves Gitea CI workflow cargo fmt check failures.
2026-05-17 05:49:26 +00:00
75ec2b8e3c
feat: add self-enrollment workflow for automated PKI provisioning
...
- Phase 1: CLI args (--enroll flag), enroll module skeleton, config support
- Phase 2: Registration request, polling loop (24h timeout), main.rs integration
- Phase 3: PKI extraction, atomic cert writing, whitelist auto-append, mTLS transition
- Phase 4: E2E test suite, README/DEPLOYMENT docs, CI pipeline
- Phase 5: SPEC.md, API_DOCUMENTATION.md, CHANGELOG.md, ROADMAP.md sync
Security review: APPROVED (0 critical, 0 high findings)
Cross-distro compatible: Debian/Ubuntu, RHEL/CentOS/Fedora, Alpine, Arch Linux
2026-05-17 05:30:42 +00:00
432e6785b2
fix: use resolved service name for socket activation detection
2026-05-07 01:42:20 +00:00
18bf40e78b
fix: remove duplicate comment causing cargo fmt failure
2026-05-05 18:18:57 +00:00
8e7fa118f4
fix: detect socket activation for service status healthy logic
2026-05-05 16:25:59 +00:00
165db77a14
Add GET /api/v1/system/services/{name} endpoint for service health checks
...
- Add ServiceStatus struct with name, display_name, active_state, sub_state,
load_state, enabled_state, main_pid, healthy fields
- Add get_service_status() to PackageManagerBackend trait
- Implement get_service_status() in AptBackend with systemd and OpenRC support
- Add get_service_status HTTP handler in system.rs
- Add /system/services/{name} route
- Add E2E test for service status endpoint
- Bump version to 0.3.6
2026-05-04 23:44:26 +00:00
385c675736
feat: implement proper WebSocket handler with actix-web-actors
...
- Replace stub websocket_handler with proper actix_web_actors::ws::start()
- Add WsJobActor that subscribes to JobManager broadcast channel
- Add broadcast::Sender/Receiver to JobManager for real-time status updates
- Emit JobStatusEvent on job state changes (create, update, complete, fail)
- Handle subscribe/unsubscribe client messages for per-job filtering
- Add 5-second heartbeat ping/pong for connection keepalive
- Properly compute Sec-WebSocket-Accept header per RFC 6455
2026-05-04 15:19:44 +00:00
64e7e787f5
fix: remove sudo from apt commands and RestrictSUIDSGID from service
...
- Remove sudo from apt command execution (service runs as root)
- Remove RestrictSUIDSGID from systemd service (blocks setuid for apt/dpkg)
- Remove NoNewPrivileges from systemd service (blocks sudo PERM_SUDOERS)
- Bump version to 0.3.2
2026-05-03 02:24:52 +00:00
3e037f2648
fix: implement actual system reboot via shutdown/systemctl commands
...
- Fix reboot_system() to use shutdown -r +N for delayed reboots
- Fix patches handler to call reboot_system() instead of just logging
- Add CAP_SYS_BOOT capability to systemd service for LXC reboot support
- Remove unused warn import from packages/mod.rs
- Bump version to 0.3.1
2026-05-03 01:37:22 +00:00
296fa72223
style: fix import ordering in mtls.rs for cargo fmt compliance
2026-05-03 00:40:11 +00:00
705779d7ac
fix: resolve clippy errors for rustls 0.23 API and unnecessary_map_or lint
...
- Fix ServerConfig::builder() to builder_with_provider() for TLS 1.3 enforcement
- Add aws_lc_rs feature to rustls in Cargo.toml
- Fix clippy unnecessary_map_or -> is_some_and in packages/mod.rs
2026-05-03 00:36:32 +00:00
bbc052947e
style: fix cargo fmt compliance for mtls.rs closure and packages matches!
2026-05-02 21:52:39 +00:00
7a9fb1ac55
style: fix mtls.rs indentation for cargo fmt compliance
2026-05-02 21:30:12 +00:00
b2ace87ee9
v0.2.0: Fix List Jobs bug, TLS 1.3 enforcement, client_disconnect_timeout, RwLock contention
...
Bug fixes:
- Fix List Jobs connection reset: Add client_disconnect_timeout (5s) to prevent TLS write truncation
- Enforce TLS 1.3 only: Add with_protocol_versions(&[&TLS13]) to rustls ServerConfig
- Fix RwLock contention: Release read lock before sorting in list_jobs()
- Fix systemd service: Remove ProtectSystem=strict (blocks package management)
- Fix systemd service: Change Type=notify to Type=simple (fixes restart hangs)
- Fix systemd service: Add DEBIAN_FRONTEND=noninteractive
- Fix systemd service: Add ReadWritePaths for apt/dpkg paths
CI/CD:
- Add Ubuntu 22.04 build job to CI workflow
E2E Testing:
- Add comprehensive E2E test suite (test_e2e.py)
- Tests cover health, packages, patches, jobs, security, and reboot endpoints
Other:
- Bump version to 0.2.0
- Add lessons learned documentation
2026-05-02 20:59:02 +00:00
e9c9a949f9
BUG-17: Strip release suffixes from package names in list_patches()
...
BUG-18: Add sudo prefix for apt install/upgrade/remove operations
- list_patches() now strips /noble-updates,noble-security suffixes
- run_apt() uses sudo for modifying operations (install, upgrade, etc.)
- Requires sudoers config for linux-patch-api user on agents
2026-04-30 22:55:02 +00:00
0c965d089c
fix: Resolve Rust 1.95.0 clippy lint (unnecessary_sort_by) in manager.rs
2026-04-24 13:35:42 +00:00
ffa468a149
Fix Duration import: add #[allow(unused_imports)] for test-only usage
2026-04-12 16:58:27 +00:00
d84155c58d
Apply cargo fmt formatting to packages/mod.rs
2026-04-12 16:49:07 +00:00
12b49acba8
Fix remaining clippy errors: restore Duration import, fix test assertion syntax
2026-04-12 16:44:43 +00:00
526c36a183
Fix final 3 clippy errors: remove unused Duration, allow dead_code and assertions_on_constants
2026-04-12 16:28:52 +00:00
59aab77371
Fix remaining clippy warnings: prefix unused benchmark params, allow dead_code on struct field
2026-04-12 16:11:50 +00:00
f2c6d088c8
Fix clippy compilation errors: restore required imports, prefix unused variables
2026-04-12 15:52:08 +00:00
409f1a4517
Apply cargo fmt formatting to clippy fixes
2026-04-12 15:26:57 +00:00
4e6848020d
Fix clippy warnings: remove unused imports/variables/functions, derive Default, fix comparisons
2026-04-12 15:23:02 +00:00
17254e5217
Apply cargo fmt formatting to fix CI/CD fmt job
2026-04-12 14:13:36 +00:00
b615a5639e
v1.0.0 Release - All Phases Complete
...
Phase 2: Core API Development
- 15 REST API endpoints (packages, patches, system, jobs, websocket)
- mTLS authentication layer (src/auth/mtls.rs)
- IP whitelist enforcement (src/auth/whitelist.rs)
- Job manager with async operation support
- WebSocket streaming for job status
Phase 3: Security Hardening
- Security testing: 16/16 tests passing
- Fuzz testing: 21 tests, all findings resolved
- Threat model validation (STRIDE matrix)
- TLS binding fix (critical vulnerability resolved)
- Security documentation complete
Phase 4: Production Readiness
- Performance benchmarking (all targets met)
- Package creation (.deb/.rpm structures)
- Documentation (README, API docs, deployment guide)
- Security hardening (6 vulnerabilities fixed)
Deliverables:
- API_DOCUMENTATION.md (889 lines)
- DEPLOYMENT_GUIDE.md (733 lines)
- SECURITY.md (346 lines)
- README.md (525 lines)
- debian/ package structure
- linux-patch-api.spec (RPM)
- install.sh installer script
- benches/api_benchmarks.rs
- Multiple security/performance reports
Security Status: 0 vulnerabilities remaining
Test Coverage: 31 unit tests, 21 integration tests
Build Status: Release optimized
2026-04-10 01:41:19 +00:00
adb5a1bea6
Fix Phase 0 compilation errors - validation fixes
...
Resolved 22 compilation errors:
- Fixed lib.rs re-exports to use correct submodule paths
- Added missing submodule declarations to module files
- Created stub files for referenced submodules
- Fixed main.rs imports to use lib.rs re-exports
Project now compiles successfully with only 2 expected warnings:
- dead_code warning for jobs field in JobManager
- unused_variable warning for job_manager in main
Both warnings are expected for scaffolding phase.
2026-04-09 18:23:33 +00:00
46dbbbbfce
Phase 0: Rust project scaffolding (M0 complete)
...
Completed Rust project initialization:
- Cargo.toml with all dependencies (actix-web, tokio, rustls, etc.)
- Project structure (src/, tests/, configs/)
- Module declarations (api, auth, config, jobs, logging, packages, systemd)
- Clippy and rustfmt configured
- Initial lib.rs and main.rs with logging setup
- Config examples (config.yaml.example, whitelist.yaml.example)
Dependencies resolved and project compiles successfully.
Rust toolchain 1.94.1 installed.
2026-04-09 18:15:35 +00:00
