216 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
git-echo	b3e54f9057	fix: Alpine build - truncated YAML and wrong abuild output path ... Root causes of ALL Alpine build failures: 1. ci.yml: Verify Alpine package step was TRUNCATED at line 339 - missing closing quote, then clause, fi, and entire upload step. This caused YAML parse failure every run. 2. build-alpine.sh: Copy path was /home/builduser/packages/home/x86_64/ but abuild outputs to /home/builduser/packages/builduser/x86_64/. The find fallback caught stale packages from previous builds. Fixes: - Complete the Verify Alpine package step with proper if/fi - Add Upload to Gitea Release step for Alpine (was completely missing) - Fix abuild output path in build-alpine.sh v1.1.17	2026-05-27 22:01:19 -05:00
git-echo	8e0e17855d	fix: remove all Alpine cleanup steps that broke abuild ... - Revert build-alpine.sh to original (no cleanup lines) - Remove CI Alpine cleanup step entirely - Keep version verification and exact version upload in CI - The original build worked fine without cleanup; stale packages are caught by version verification	2026-05-27 20:44:16 -05:00
git-echo	4bea74cb75	fix: remove mkdir -p from Alpine cleanup that broke abuild ... - Remove mkdir -p /home/builduser/packages/home/x86_64/ that was creating root-owned directories that abuild (running as builduser) couldnt write to - Keep targeted rm -f of stale .apk files only - abuild creates its own output directories with correct ownership	2026-05-27 20:42:48 -05:00
git-echo	724a42945c	fix: preserve abuild directory structure in Alpine cleanup ... - Replace aggressive rm -rf /home/builduser/packages/ with targeted rm -f of stale .apk files - Add mkdir -p to ensure abuild output directory exists before build - Fixes Alpine CI build failure caused by removing required directory structure	2026-05-27 20:21:23 -05:00
git-echo	387f9be387	fix: correct Alpine version bug and add Ubuntu 24.04 package suffix ... - Alpine: clean entire /home/builduser/packages/ before abuild (not just releases/) - Alpine: add version verification step to CI (like RPM already has) - Alpine: upload uses exact version match instead of head -1 - Debian: add u2404 suffix to build-deb output filename - Remove duplicate 1.1.12 entry from debian/changelog	2026-05-27 19:58:35 -05:00
git-echo	e738da3c0a	fix: remove stale build artifacts from releases/ and add cleanup to Alpine build ... - Add /releases/ to .gitignore to prevent tracking build artifacts - Remove old 1.0.0 .deb files from git tracking - Add stale .apk cleanup to build-alpine.sh (matching build-arch.sh) - Add cleanup step to CI Alpine workflow to remove stale packages Fixes Alpine package version mismatch caused by old artifacts in releases/	2026-05-27 17:02:32 -05:00
git-echo	e38fc9034f	fix: update debian changelog and RPM spec to v1.1.17	2026-05-27 16:17:10 -05:00
kwslavens	6b660ca2b1	Merge pull request 'fix: add package cache refresh before apply and on health check (#2)' (#3) from fix/package-cache-refresh into master ... Reviewed-on: #3	2026-05-27 15:22:07 -05:00
git-echo	6f63eeed57	fix: resolve CI failures (fmt, clippy, tests) ... - Fix rustfmt formatting in cache.rs, patches.rs, system.rs, routes.rs, main.rs - Add Default impl for PackageCacheState (clippy new_without_default) - Change apply_with_cache_retry generic bound from Fn to FnMut - Add mut to refresh_fn parameter for FnMut compatibility - Replace bool comparison with ! operator (clippy bool_comparison) - Update todo.md with completed status	2026-05-27 15:04:25 -05:00
git-echo	cf3d597480	fix: add package cache refresh before apply and on health check ... - New src/packages/cache.rs module with PackageCacheState, stale detection, state persistence, 404 retry logic - Add refresh_package_cache() and last_cache_update() to PackageManagerBackend trait, implemented on all 5 backends (APT, DNF, YUM, APK, Pacman) - Health check now reports last_cache_update and cache_status fields, triggers cache refresh if stale (>4h), returns degraded on failure - Patch apply jobs now force cache refresh before applying patches, with 404/fetch error retry (1 retry after cache refresh) - Cache state persists to /var/lib/linux_patch_api/state/cache.json - Version bump to 1.1.17 - Update ARCHITECTURE.md and REQUIREMENTS.md (FR-007) Closes: #2	2026-05-27 14:33:12 -05:00
git-echo	fa278c8595	fix: update repo paths from echo/ to git-echo/ after account migration	2026-05-21 17:05:47 +00:00
Echo	5dc03b7eda	feat: add Pacman backend for Arch Linux, fix Arch CI stale packages v1.1.16	2026-05-20 22:24:06 +00:00
Echo	3eca9a3353	style: fix rustfmt formatting for DNF/YUM backend v1.1.15	2026-05-20 20:59:55 +00:00
Echo	67e397f018	feat: add DNF and YUM package manager backends for RPM-based systems	2026-05-20 20:54:38 +00:00
Echo	fb0ce8ac32	fix: RPM packaging - pre-build binary, fix ownership, fix deps, prevent stale cache v1.1.14	2026-05-20 19:45:38 +00:00
Echo	b932f6be38	docs: update changelog for v1.1.13 v1.1.13	2026-05-20 18:54:33 +00:00
Echo	5fa7fd0f90	fix: detect apk at /sbin/apk on Alpine (not just /usr/bin/apk); v1.1.13	2026-05-20 18:54:10 +00:00
Echo	4d75bb0e29	feat: Add APK (Alpine Linux) package manager backend; machine-id generation; OpenRC fix; v1.1.12 v1.1.12	2026-05-20 17:25:21 +00:00
Echo	8d76b3ddfe	docs: add Alpine packaging root cause analysis and access lesson	2026-05-20 15:59:49 +00:00
Echo	603c974116	fix: OpenRC init script - change ownership from linux-patch-api:linux-patch-api to root:root ... The system user was removed from all install scripts but the OpenRC init script still referenced linux-patch-api:linux-patch-api in checkpath. This would cause the service to fail on Alpine because the user does not exist. v1.1.11	2026-05-20 14:57:53 +00:00
Echo	e033cb8536	fix: Alpine install scripts - use separate files with valid abuild suffixes ... Root cause: .apk-install is not a valid abuild suffix (lines 247-257 of abuild). abuild expects SEPARATE files: pkgname.pre-install, .post-install, .pre-deinstall, .post-deinstall. The old single .apk-install file caused abuild to die with "unknown install script suffix", but CI used || true which masked the failure, so APK was built WITHOUT install scripts. Verified on actual Alpine runner: install script suffixes now pass abuild validation. - configs/linux-patch-api.pre-install: create dirs, set permissions (matches Debian preinst) - configs/linux-patch-api.post-install: copy example configs, enable service (matches Debian postinst) - configs/linux-patch-api.pre-deinstall: stop and disable service (matches Debian prerm) - configs/linux-patch-api.post-deinstall: clean up empty dirs (matches Debian postrm) - Removed configs/linux-patch-api.apk-install (invalid format) - Updated build-alpine.sh: copy 4 install scripts to workspace, updated install= line in APKBUILD v1.1.10	2026-05-20 12:43:37 +00:00
Echo	392e7553c4	release: bump version to 1.1.9 for non-Ubuntu package fixes v1.1.9	2026-05-20 02:54:09 +00:00
Echo	19f76f4d9d	fix: comment out RPM BuildRequires for CI (rustup not RPM), fix changelog date	2026-05-20 02:32:31 +00:00
Echo	7dcbff8ece	docs: add detailed Arch, RPM, Alpine installation instructions ... - README: comprehensive per-platform install/build/verify/remove instructions - README: prerequisites, post-install notes, Alpine OpenRC differences - BUILD_PACKAGES: add Arch and Alpine build sections with troubleshooting - BUILD_PACKAGES: fix Service Account table (runs as root, not system user) - BUILD_PACKAGES: add Arch/Alpine supported distributions tables	2026-05-20 02:06:52 +00:00
Echo	8952589efd	fix: align all non-Ubuntu packages with Debian baseline behavior ... - Arch: remove system user creation, root:root ownership, fix $startdir path in PKGBUILD - RPM: uncomment BuildRequires, add runtime deps (openssl-libs, ca-certificates), remove system user, root:root ownership - Alpine: remove system user creation, root:root ownership, co-locate install script with APKBUILD - All platforms now match Debian: no system user, root:root, create dirs, copy example configs, enable service	2026-05-20 02:01:52 +00:00
Echo	bcc0d40413	release: bump version to 1.1.8 v1.1.8	2026-05-19 00:34:21 +00:00
Echo	1af72deb16	fix: Arch build - install script filename must match PKGBUILD install= reference	2026-05-19 00:21:59 +00:00
Echo	11168b22df	style: fix rustfmt formatting for CI	2026-05-18 23:54:15 +00:00
Echo	653623b9f0	fix: FQDN resolution and display_name blank bug; fix: Arch/Alpine/RPM packages ... Bug fixes: - get_fqdn() now prioritizes 'hostname -f' (returns full FQDN) over /etc/hostname (returns short hostname) - Added get_hostname() for short hostname extraction - Added hostname field to EnrollmentRequest for manager display_name population - Updated SPEC.md and API_DOCUMENTATION.md Package fixes: - Arch: Added linux-patch-api.install with post_install/upgrade/remove hooks, user creation, directory creation, config handling - Alpine: Added linux-patch-api.apk-install with pre/post install/deinstall hooks, user creation, directory creation, config handling, missing config.yaml.example - RPM: Dynamic version from Cargo.toml, %ghost %config(noreplace) for live configs, tarball exclusions, /var/log in %files	2026-05-18 23:51:00 +00:00
Echo	74288e1dfc	fix(ci): add cargo clean and artifact removal before packaging; bump to 1.1.7 ... - Insert 'Clean previous build artifacts' step (cargo clean + rm old .deb) before Build Debian package in both build-deb and build-deb-u2204 jobs. - Bump version to 1.1.7 to ensure a clean build from scratch. - Update debian/changelog with 1.1.7-1 entry. v1.1.7	2026-05-18 17:18:11 +00:00
Echo	73a11e70e0	fix(certs): replace encrypted CA with unencrypted ECDSA P-256 CA ... - Replaced password-protected RSA CA with unencrypted ECDSA P-256 CA to prevent manager startup failures from encrypted keys. - Regenerated server and client certificates (client001) with new CA. - Updated CA_SETUP.md to use openssl genpkey (unencrypted) instead of openssl genrsa -aes256, with warning against encrypted keys.	2026-05-18 16:00:22 +00:00
Echo	fc0b42040e	fix(server): add explicit rustls CryptoProvider initialization for v1.1.6 ... - Add rustls::crypto::aws_lc_rs::default_provider().install_default() in main() before any TLS operations to prevent startup panic - Bump version from 1.1.5 to 1.1.6 - Update debian/changelog with 1.1.6-1 entry v1.1.6	2026-05-18 13:43:34 +00:00
Echo	0d8b9a4d94	style: fix cargo fmt in enroll_identity tests v1.1.5	2026-05-18 12:29:22 +00:00
Echo	945febbe96	feat(enrollment): add route-based IP selection and fix package versioning for v1.1.5	2026-05-18 03:35:46 +00:00
Echo	6b75d2ab01	fix(clippy): remove needless return in Docker-compatible test	2026-05-18 02:11:45 +00:00
Echo	0d582f2fda	style: apply cargo fmt formatting	2026-05-18 02:06:25 +00:00
Echo	7c55c99e48	fix(enrollment): filter Docker bridge IPs and add report_interface/report_ip config ... - identity.rs: filter 172.16.0.0/12 (Docker bridge) and 169.254.0.0/16 (link-local) from get_ip_addresses() auto-detection - identity.rs: add is_container_bridge(), is_link_local(), get_ip_for_interface(), get_primary_ip() functions - client.rs: add report_interface/report_ip fields to EnrollmentClient, new with_ip_overrides() constructor, register() uses get_primary_ip() - loader.rs: add report_interface/report_ip to EnrollmentConfig - mod.rs: wire config overrides through to EnrollmentClient - config.yaml.example: document new report_interface/report_ip options - Tests: add 18 new bridge filtering/IP override tests, fix Docker container compatibility in existing tests	2026-05-18 02:02:54 +00:00
Echo	5b5791f52f	fix(tests): update test suite for AppConfig::load signature change v1.1.4	2026-05-17 22:28:17 +00:00
Echo	fed5e386ce	fix(enroll): skip TLS validation during enrollment bootstrap to allow certificate acquisition v1.1.2	2026-05-17 22:20:48 +00:00
Echo	f3555c1570	fix(ci): use github.ref_type for upload conditions to fix Gitea runner compatibility v1.1.1	2026-05-17 21:05:43 +00:00
Echo	cea162b048	fix(ci): force IPv4 for rustup download on Alpine runner	2026-05-17 20:35:48 +00:00
Echo	08493fc782	fix(ci): add openssl runtime package for Alpine musl builds	2026-05-17 18:40:47 +00:00
Echo	8b890625f6	fix(ci): disable reqwest default features to eliminate OpenSSL on musl builds ... Requiring default-features=false on reqwest prevents native-tls/openssl-sys from being pulled in as transitive dependencies, which broke static linking on Alpine musl target. Also reverts invalid openssl-static package from CI. - Cargo.toml: add default-features = false to reqwest dependency - ci.yml: revert non-existent openssl-static package	2026-05-17 17:18:35 +00:00
Echo	835c8d79cf	fix(ci): add openssl-static for Alpine musl static linking ... The Alpine build job links against musl which requires static OpenSSL libraries. Adding openssl-static package to resolve -lssl and -lcrypto linker errors.	2026-05-17 17:07:10 +00:00
Echo	8fd7d7620a	fix(ci): add OpenSSL dev dependencies to all build jobs ... Add libssl-dev to Ubuntu-based runners and openssl-devel to Fedora runner to resolve openssl-sys crate compilation failures in CI pipeline. - clippy, test, audit: +libssl-dev - enrollment-tests, verify-enrollment-cli: +libssl-dev - build-deb, build-deb-u2204: +libssl-dev - build-rpm (Fedora): +openssl-devel	2026-05-17 16:48:43 +00:00
Echo	3e8eacab9a	fix(tests): resolve all clippy warnings for CI compliance ... - Remove needless borrows on format!() in set_body_string() calls (needless_borrows_for_generic_args) - Replace assert!(false, ...) with collected assertion (assertions_on_constants + never_loop) - Use direct Method::POST comparison instead of to_string() (cmp_owned) - Simplify negated equality to != operator (nonminimal_bool) CI pipeline now passes with -D warnings enabled	2026-05-17 16:02:57 +00:00
Echo	a09e3eaa68	fix: add truncate(true) to lock file OpenOptions for clippy compliance ... Resolves clippy::suspicious_open_options warning on whitelist lock file creation.	2026-05-17 15:21:52 +00:00
Echo	6cfef766a7	fix: apply cargo fmt to resolve CI formatting failures ... Format all enrollment module source files and tests per rustfmt standards. Resolves Gitea CI workflow cargo fmt check failures.	2026-05-17 05:49:26 +00:00
Echo	9a129170f8	feat: add self-enrollment workflow for automated PKI provisioning ... - Phase 1: CLI args (--enroll flag), enroll module skeleton, config support - Phase 2: Registration request, polling loop (24h timeout), main.rs integration - Phase 3: PKI extraction, atomic cert writing, whitelist auto-append, mTLS transition - Phase 4: E2E test suite, README/DEPLOYMENT docs, CI pipeline - Phase 5: SPEC.md, API_DOCUMENTATION.md, CHANGELOG.md, ROADMAP.md sync Security review: APPROVED (0 critical, 0 high findings) Cross-distro compatible: Debian/Ubuntu, RHEL/CentOS/Fedora, Alpine, Arch Linux v1.1.0-enrollment	2026-05-17 05:30:42 +00:00
Echo	d297c8d3b1	docs: add self-enrollment client workflow to API documentation	2026-05-16 19:18:25 +00:00