150 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Echo	77e8ac2e65	fix: remove linux-patch-api user from dpkg scripts, change ownership to root ... - Remove user/group creation from preinst (service runs as root) - Change directory ownership to root:root in preinst and postinst - Remove user/group deletion from postrm - Service runs as root, no dedicated user needed	2026-05-03 02:29:06 +00:00
Echo	9e42f32270	fix: remove sudo from apt commands and RestrictSUIDSGID from service ... - Remove sudo from apt command execution (service runs as root) - Remove RestrictSUIDSGID from systemd service (blocks setuid for apt/dpkg) - Remove NoNewPrivileges from systemd service (blocks sudo PERM_SUDOERS) - Bump version to 0.3.2 v0.3.2	2026-05-03 02:24:52 +00:00
Echo	2b35a143da	fix: implement actual system reboot via shutdown/systemctl commands ... - Fix reboot_system() to use shutdown -r +N for delayed reboots - Fix patches handler to call reboot_system() instead of just logging - Add CAP_SYS_BOOT capability to systemd service for LXC reboot support - Remove unused warn import from packages/mod.rs - Bump version to 0.3.1 v0.3.1	2026-05-03 01:37:22 +00:00
Echo	6f75ec4865	chore: bump version to 0.3.0 for beta release v0.3.0	2026-05-03 00:55:27 +00:00
Echo	a6cab4bbec	style: fix import ordering in mtls.rs for cargo fmt compliance	2026-05-03 00:40:11 +00:00
Echo	de9638e1b0	fix: resolve clippy errors for rustls 0.23 API and unnecessary_map_or lint ... - Fix ServerConfig::builder() to builder_with_provider() for TLS 1.3 enforcement - Add aws_lc_rs feature to rustls in Cargo.toml - Fix clippy unnecessary_map_or -> is_some_and in packages/mod.rs	2026-05-03 00:36:32 +00:00
Echo	6d177c81a4	fix(ci): add apt-get -f install to resolve broken runner dependencies ... Runners may have broken apt state from partial upgrades (e.g., openssh-client version mismatch). Adding apt-get -f install before build deps ensures CI works regardless of runner package state.	2026-05-03 00:31:13 +00:00
Echo	36890f65b1	style: fix cargo fmt compliance for mtls.rs closure and packages matches!	2026-05-02 21:52:39 +00:00
Echo	2ec8de961a	style: fix mtls.rs indentation for cargo fmt compliance	2026-05-02 21:30:12 +00:00
Echo	03786d1798	v0.2.0: Fix List Jobs bug, TLS 1.3 enforcement, client_disconnect_timeout, RwLock contention ... Bug fixes: - Fix List Jobs connection reset: Add client_disconnect_timeout (5s) to prevent TLS write truncation - Enforce TLS 1.3 only: Add with_protocol_versions(&[&TLS13]) to rustls ServerConfig - Fix RwLock contention: Release read lock before sorting in list_jobs() - Fix systemd service: Remove ProtectSystem=strict (blocks package management) - Fix systemd service: Change Type=notify to Type=simple (fixes restart hangs) - Fix systemd service: Add DEBIAN_FRONTEND=noninteractive - Fix systemd service: Add ReadWritePaths for apt/dpkg paths CI/CD: - Add Ubuntu 22.04 build job to CI workflow E2E Testing: - Add comprehensive E2E test suite (test_e2e.py) - Tests cover health, packages, patches, jobs, security, and reboot endpoints Other: - Bump version to 0.2.0 - Add lessons learned documentation	2026-05-02 20:59:02 +00:00
Echo	bda8d5c10c	BUG-17: Strip release suffixes from package names in list_patches() ... BUG-18: Add sudo prefix for apt install/upgrade/remove operations - list_patches() now strips /noble-updates,noble-security suffixes - run_apt() uses sudo for modifying operations (install, upgrade, etc.) - Requires sudoers config for linux-patch-api user on agents	2026-04-30 22:55:02 +00:00
Echo	bd3384d573	fix: correct Gitea API URL in upload-release.sh ... The Gitea server hostname is gitea-lxc.moon-dragon.us not gitea.moon-dragon.us. curl exit status 6 = Could not resolve host. v0.0.2	2026-04-27 02:13:31 +00:00
Echo	2caf13b6a5	fix: properly commit build fixes that were never in 2774e02 ... CRITICAL: Previous commit 2774e02 did not include these fixes. Debian (debian/rules): - Use && to keep cargo build in same shell as . "$HOME/.cargo/env" - Make runs each recipe line in a separate shell Arch (build-arch.sh): - Use << "EOF" heredoc with hardcoded path to prevent $pkgdir expansion - $pkgdir must be literal for makepkg to expand at runtime Alpine (build-alpine.sh): - Copy signing public key to /etc/apk/keys/ BEFORE abuild - Use || true on abuild because index update may fail but APK is still created	2026-04-27 01:52:56 +00:00
Echo	2774e02cde	fix: resolve final build failures ... debian/rules: Escape $HOME for make (use $$HOME) - Make interprets $H as variable, $$ escapes it build-alpine.sh: Install signing public key - Copy .abuild/*.rsa.pub to /etc/apk/keys/ - Fixes UNTRUSTED signature error on index update build-arch.sh: Use /home/builduser/repo for all paths - PKGDIR=/home/builduser/repo/arch-package - WORKSPACE_DIR=/home/builduser/repo - Fixes permission denied on act cache path	2026-04-27 01:06:56 +00:00
Echo	93602db2f3	fix: resolve remaining build failures ... debian/rules: Source cargo env before calling cargo - Add `. "$HOME/.cargo/env"` to override_dh_auto_build build-alpine.sh: Use /home/builduser for all paths - PKGDIR=/home/builduser/apk-package (accessible by builduser) - WORKSPACE_DIR=/home/builduser (for APKBUILD package function) - Removed duplicate else line build-arch.sh: Copy repo to accessible directory - Copy repo contents to /home/builduser/repo before makepkg - Run makepkg in /home/builduser/repo (not act cache path)	2026-04-27 00:57:03 +00:00
Echo	b74d5386d3	fix: resolve all build job failures ... CI workflow (ci.yml): - Proper YAML structure for all steps - curl+tar checkout (act runners lack git) - GITEATOKEN authentication for private repo access - build-essential/gcc added to all jobs - dpkg-buildpackage -d flag (skip apt dep check) Build scripts: - build-alpine.sh: Copy APKBUILD to /home/builduser before abuild - build-arch.sh: Use REPO_DIR variable instead of $(pwd) in su commands	2026-04-27 00:37:51 +00:00
Echo	392a08abb7	fix: resolve all 4 build job failures ... Debian: Add -d flag to dpkg-buildpackage (skip dep check, rustup installed Rust not apt) RPM/Arch: Fix missing run: | YAML syntax in dependency steps Alpine: Fix abuild working directory - use /home/builduser explicitly instead of $(pwd) which referenced act cache path	2026-04-27 00:19:32 +00:00
Echo	256238eae6	fix: add build-essential/gcc for Rust linker ... Rust compilation requires a C compiler (cc) for linking. Act runner containers do not have gcc installed by default. Added build-essential (Ubuntu), gcc (Fedora/Alpine/Arch) to dependency installation steps before Rust compilation.	2026-04-27 00:07:20 +00:00
Echo	9cef189d57	fix: use curl+tar checkout (act runners lack git) ... Act runner containers do not have git installed. Using curl+tar to download repo archive instead. GITEATOKEN secret already verified working independently.	2026-04-27 00:00:49 +00:00
Echo	4956004ab9	fix: match secret name case GITEATOKEN (uppercase) ... Gitea secrets are case-sensitive. The encrypted secret in DB is named GITEATOKEN (uppercase). Workflow was using giteatoken (lowercase) which caused decryption failures in Gitea runner. Also unblocked stuck action_run #166 in database (status=1 queued).	2026-04-26 23:36:43 +00:00
Echo	65465efdfe	fix: SSH checkout bypasses Gitea secret encryption issue ... Gitea logs show: "decrypt secret giteatoken: failed to decrypt by secret, the key might be incorrect" - secrets must be encrypted with Gitea SECRET_KEY, not plaintext in DB. Solution: Use SSH git clone for checkout which requires no secrets. Runners are already registered with Gitea and have SSH access.	2026-04-26 23:29:39 +00:00
Echo	1f2fe167ed	fix: simplified curl+tar checkout now that giteatoken secret is in DB ... Secret was inserted directly into Gitea MySQL database. Checkout now uses simple authenticated curl to download archive.	2026-04-26 23:07:14 +00:00
Echo	7a58cf0303	fix: use SSH git clone for checkout to bypass Gitea API 404 ... Gitea archive API returns 404 for private repos. Switched to SSH-based git clone which uses runner SSH keys for authentication. - Replace curl+tar archive download with git clone over SSH - Add ssh-keyscan for host key verification - Alpine job installs openssh-client and git - All other runners have git/ssh pre-installed	2026-04-26 21:16:07 +00:00
Echo	e1376dd060	fix: add GITEA_TOKEN auth to archive download ... Gitea returns 404 for private repo archives without authentication. Added Authorization header with token to curl command for all checkout steps.	2026-04-26 21:05:01 +00:00
Echo	b72730a7a0	fix: replace git clone with curl+tar for act runner compatibility ... The act runner images do not include git. Previous attempt used git clone which failed with "git: command not found". - Replace all git clone with curl downloading Gitea archive tarball - Use tar to extract the archive into the working directory - No dependency on git for checkout step	2026-04-26 20:52:35 +00:00
Echo	0f0e0169fe	fix: use git clone instead of fetch/checkout for act runner compatibility ... The Gitea runner uses act which does not auto-checkout when using shell commands instead of JS actions. The previous git fetch/checkout failed silently because there was no .git directory. - Replace all checkout steps with git clone into current directory - Add safe.directory config to avoid git ownership errors - Use GITEA_TOKEN for authenticated clone if available	2026-04-26 20:18:58 +00:00
Echo	0e43fe2f6e	fix: quote "on" key in YAML to prevent boolean parsing ... YAML 1.1 reserves "on" as a boolean keyword (meaning True). Without quotes, Gitea Actions could not parse workflow triggers, resulting in no jobs being scheduled. This quotes the key as "on": to ensure it is parsed as a string event trigger key.	2026-04-26 20:13:39 +00:00
Echo	40f7c10a55	fix: replace actions/checkout with manual git commands ... Gitea runners do not have Node.js installed, which is required for all JavaScript-based GitHub Actions including actions/checkout. - Replace all actions/checkout@v4 with manual git fetch/checkout - All checkout logic now uses shell commands only - No JavaScript-based actions remain in the workflow	2026-04-26 20:04:16 +00:00
Echo	007fb7988f	fix: replace JS-based actions with shell commands for Gitea compatibility ... - Remove dtolnay/rust-toolchain (JS action) → use rustup via curl - Remove Swatinem/rust-cache (JS action) → no replacement, builds from scratch - All jobs now install Rust toolchain via shell commands - Alpine job installs rustup directly with musl target support - Ensures compatibility with Gitea Actions runners	2026-04-26 19:40:59 +00:00
Echo	a4026a471a	refactor: update CI for native per-OS runners ... - Replace generic "linux" runner label with dedicated per-OS labels (ubuntu-24.04, fedora, alpine, arch) - Remove all container declarations (native runner execution) - Add build gate dependencies: build jobs need fmt+clippy+test - Extract release upload logic into reusable scripts/upload-release.sh - Fix build-alpine.sh: remove hardcoded container paths, add SKIP_CARGO_BUILD support - Fix build-arch.sh: remove hardcoded container paths, add SKIP_CARGO_BUILD support - Fix build-rpm.sh: remove sudo, native runner compatible - Remove Dockerfile.rpm and Dockerfile.arch (no longer needed) - Add sudo to Ubuntu/Fedora/Arch package installs for safety - Add nodejs to Alpine deps for Gitea Actions compatibility - Make upload-release.sh POSIX sh compatible (Alpine) - Fix curl -sf to curl -s in upload-release.sh (404 on new releases)	2026-04-26 19:21:09 +00:00
Echo	44c182764e	fix: Update dependencies (rand vulnerability fix) and add audit exception for rustls-pemfile (RUSTSEC-2025-0134) v0.0.1	2026-04-24 13:59:13 +00:00
Echo	d4961d5606	fix: Remove release.yml workflow - ci.yml is the single master workflow	2026-04-24 13:49:56 +00:00
Echo	1d39f19a88	fix: Resolve Rust 1.95.0 clippy lint (unnecessary_sort_by) in manager.rs	2026-04-24 13:35:42 +00:00
Echo	ffb4abaafa	feat: Consolidate CI and Release into single master workflow	2026-04-24 13:15:29 +00:00
Echo	a6ab05c1ac	fix: Remove duplicate workflows from .github/workflows (using .gitea/workflows only)	2026-04-14 19:50:00 +00:00
Echo	8b49f30774	fix: Move workflows to .gitea/workflows/ for Gitea Actions compatibility	2026-04-14 19:45:08 +00:00
Echo	d61f5c89f1	feat: Split CI and release workflows to eliminate duplicate runs	2026-04-14 19:40:07 +00:00
Echo	fde6826477	fix: Add proper HTTP code checking and debug output for Gitea uploads	2026-04-14 19:11:47 +00:00
Echo	5e158c648c	fix: Use 'attachment' form field for Gitea API upload (not 'name')	2026-04-14 18:39:48 +00:00
Echo	997c894a29	fix: Use giteatoken secret name (Gitea requires lowercase no underscores)	2026-04-14 18:04:47 +00:00
Echo	c63a2b597e	fix: Use direct Gitea API uploads instead of unsupported artifact actions	2026-04-14 16:45:40 +00:00
Echo	820324565d	fix: Use Gitea-native API for release uploads instead of GitHub action	2026-04-14 16:06:20 +00:00
Echo	8f52701593	Merge develop into master for v1.0.0 release	2026-04-14 13:34:19 +00:00
Echo	69d35614ec	chore: Prepare for v1.0.0 release	2026-04-14 13:34:19 +00:00
Echo	a36e8fcae4	fix: Restore execute permission	2026-04-14 12:34:25 +00:00
Echo	171df37217	fix: Copy APK directly after build instead of using abuild repo (APK built successfully!)	2026-04-14 12:34:01 +00:00
Echo	517dc191f9	fix: Restore execute permission on build-alpine.sh	2026-04-14 11:48:49 +00:00
Echo	64f60044ec	fix: Create directory structure in APKBUILD package() function	2026-04-14 11:48:39 +00:00
Echo	86aa549db8	fix: Restore execute permission on build-alpine.sh	2026-04-14 04:03:30 +00:00
Echo	dff71be24b	fix: Use -d flag for abuild dependency disable instead of -G	2026-04-14 04:03:17 +00:00