202 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Echo	fb0ce8ac32	fix: RPM packaging - pre-build binary, fix ownership, fix deps, prevent stale cache v1.1.14	2026-05-20 19:45:38 +00:00
Echo	b932f6be38	docs: update changelog for v1.1.13 v1.1.13	2026-05-20 18:54:33 +00:00
Echo	5fa7fd0f90	fix: detect apk at /sbin/apk on Alpine (not just /usr/bin/apk); v1.1.13	2026-05-20 18:54:10 +00:00
Echo	4d75bb0e29	feat: Add APK (Alpine Linux) package manager backend; machine-id generation; OpenRC fix; v1.1.12 v1.1.12	2026-05-20 17:25:21 +00:00
Echo	8d76b3ddfe	docs: add Alpine packaging root cause analysis and access lesson	2026-05-20 15:59:49 +00:00
Echo	603c974116	fix: OpenRC init script - change ownership from linux-patch-api:linux-patch-api to root:root ... The system user was removed from all install scripts but the OpenRC init script still referenced linux-patch-api:linux-patch-api in checkpath. This would cause the service to fail on Alpine because the user does not exist. v1.1.11	2026-05-20 14:57:53 +00:00
Echo	e033cb8536	fix: Alpine install scripts - use separate files with valid abuild suffixes ... Root cause: .apk-install is not a valid abuild suffix (lines 247-257 of abuild). abuild expects SEPARATE files: pkgname.pre-install, .post-install, .pre-deinstall, .post-deinstall. The old single .apk-install file caused abuild to die with "unknown install script suffix", but CI used || true which masked the failure, so APK was built WITHOUT install scripts. Verified on actual Alpine runner: install script suffixes now pass abuild validation. - configs/linux-patch-api.pre-install: create dirs, set permissions (matches Debian preinst) - configs/linux-patch-api.post-install: copy example configs, enable service (matches Debian postinst) - configs/linux-patch-api.pre-deinstall: stop and disable service (matches Debian prerm) - configs/linux-patch-api.post-deinstall: clean up empty dirs (matches Debian postrm) - Removed configs/linux-patch-api.apk-install (invalid format) - Updated build-alpine.sh: copy 4 install scripts to workspace, updated install= line in APKBUILD v1.1.10	2026-05-20 12:43:37 +00:00
Echo	392e7553c4	release: bump version to 1.1.9 for non-Ubuntu package fixes v1.1.9	2026-05-20 02:54:09 +00:00
Echo	19f76f4d9d	fix: comment out RPM BuildRequires for CI (rustup not RPM), fix changelog date	2026-05-20 02:32:31 +00:00
Echo	7dcbff8ece	docs: add detailed Arch, RPM, Alpine installation instructions ... - README: comprehensive per-platform install/build/verify/remove instructions - README: prerequisites, post-install notes, Alpine OpenRC differences - BUILD_PACKAGES: add Arch and Alpine build sections with troubleshooting - BUILD_PACKAGES: fix Service Account table (runs as root, not system user) - BUILD_PACKAGES: add Arch/Alpine supported distributions tables	2026-05-20 02:06:52 +00:00
Echo	8952589efd	fix: align all non-Ubuntu packages with Debian baseline behavior ... - Arch: remove system user creation, root:root ownership, fix $startdir path in PKGBUILD - RPM: uncomment BuildRequires, add runtime deps (openssl-libs, ca-certificates), remove system user, root:root ownership - Alpine: remove system user creation, root:root ownership, co-locate install script with APKBUILD - All platforms now match Debian: no system user, root:root, create dirs, copy example configs, enable service	2026-05-20 02:01:52 +00:00
Echo	bcc0d40413	release: bump version to 1.1.8 v1.1.8	2026-05-19 00:34:21 +00:00
Echo	1af72deb16	fix: Arch build - install script filename must match PKGBUILD install= reference	2026-05-19 00:21:59 +00:00
Echo	11168b22df	style: fix rustfmt formatting for CI	2026-05-18 23:54:15 +00:00
Echo	653623b9f0	fix: FQDN resolution and display_name blank bug; fix: Arch/Alpine/RPM packages ... Bug fixes: - get_fqdn() now prioritizes 'hostname -f' (returns full FQDN) over /etc/hostname (returns short hostname) - Added get_hostname() for short hostname extraction - Added hostname field to EnrollmentRequest for manager display_name population - Updated SPEC.md and API_DOCUMENTATION.md Package fixes: - Arch: Added linux-patch-api.install with post_install/upgrade/remove hooks, user creation, directory creation, config handling - Alpine: Added linux-patch-api.apk-install with pre/post install/deinstall hooks, user creation, directory creation, config handling, missing config.yaml.example - RPM: Dynamic version from Cargo.toml, %ghost %config(noreplace) for live configs, tarball exclusions, /var/log in %files	2026-05-18 23:51:00 +00:00
Echo	74288e1dfc	fix(ci): add cargo clean and artifact removal before packaging; bump to 1.1.7 ... - Insert 'Clean previous build artifacts' step (cargo clean + rm old .deb) before Build Debian package in both build-deb and build-deb-u2204 jobs. - Bump version to 1.1.7 to ensure a clean build from scratch. - Update debian/changelog with 1.1.7-1 entry. v1.1.7	2026-05-18 17:18:11 +00:00
Echo	73a11e70e0	fix(certs): replace encrypted CA with unencrypted ECDSA P-256 CA ... - Replaced password-protected RSA CA with unencrypted ECDSA P-256 CA to prevent manager startup failures from encrypted keys. - Regenerated server and client certificates (client001) with new CA. - Updated CA_SETUP.md to use openssl genpkey (unencrypted) instead of openssl genrsa -aes256, with warning against encrypted keys.	2026-05-18 16:00:22 +00:00
Echo	fc0b42040e	fix(server): add explicit rustls CryptoProvider initialization for v1.1.6 ... - Add rustls::crypto::aws_lc_rs::default_provider().install_default() in main() before any TLS operations to prevent startup panic - Bump version from 1.1.5 to 1.1.6 - Update debian/changelog with 1.1.6-1 entry v1.1.6	2026-05-18 13:43:34 +00:00
Echo	0d8b9a4d94	style: fix cargo fmt in enroll_identity tests v1.1.5	2026-05-18 12:29:22 +00:00
Echo	945febbe96	feat(enrollment): add route-based IP selection and fix package versioning for v1.1.5	2026-05-18 03:35:46 +00:00
Echo	6b75d2ab01	fix(clippy): remove needless return in Docker-compatible test	2026-05-18 02:11:45 +00:00
Echo	0d582f2fda	style: apply cargo fmt formatting	2026-05-18 02:06:25 +00:00
Echo	7c55c99e48	fix(enrollment): filter Docker bridge IPs and add report_interface/report_ip config ... - identity.rs: filter 172.16.0.0/12 (Docker bridge) and 169.254.0.0/16 (link-local) from get_ip_addresses() auto-detection - identity.rs: add is_container_bridge(), is_link_local(), get_ip_for_interface(), get_primary_ip() functions - client.rs: add report_interface/report_ip fields to EnrollmentClient, new with_ip_overrides() constructor, register() uses get_primary_ip() - loader.rs: add report_interface/report_ip to EnrollmentConfig - mod.rs: wire config overrides through to EnrollmentClient - config.yaml.example: document new report_interface/report_ip options - Tests: add 18 new bridge filtering/IP override tests, fix Docker container compatibility in existing tests	2026-05-18 02:02:54 +00:00
Echo	5b5791f52f	fix(tests): update test suite for AppConfig::load signature change v1.1.4	2026-05-17 22:28:17 +00:00
Echo	fed5e386ce	fix(enroll): skip TLS validation during enrollment bootstrap to allow certificate acquisition v1.1.2	2026-05-17 22:20:48 +00:00
Echo	f3555c1570	fix(ci): use github.ref_type for upload conditions to fix Gitea runner compatibility v1.1.1	2026-05-17 21:05:43 +00:00
Echo	cea162b048	fix(ci): force IPv4 for rustup download on Alpine runner	2026-05-17 20:35:48 +00:00
Echo	08493fc782	fix(ci): add openssl runtime package for Alpine musl builds	2026-05-17 18:40:47 +00:00
Echo	8b890625f6	fix(ci): disable reqwest default features to eliminate OpenSSL on musl builds ... Requiring default-features=false on reqwest prevents native-tls/openssl-sys from being pulled in as transitive dependencies, which broke static linking on Alpine musl target. Also reverts invalid openssl-static package from CI. - Cargo.toml: add default-features = false to reqwest dependency - ci.yml: revert non-existent openssl-static package	2026-05-17 17:18:35 +00:00
Echo	835c8d79cf	fix(ci): add openssl-static for Alpine musl static linking ... The Alpine build job links against musl which requires static OpenSSL libraries. Adding openssl-static package to resolve -lssl and -lcrypto linker errors.	2026-05-17 17:07:10 +00:00
Echo	8fd7d7620a	fix(ci): add OpenSSL dev dependencies to all build jobs ... Add libssl-dev to Ubuntu-based runners and openssl-devel to Fedora runner to resolve openssl-sys crate compilation failures in CI pipeline. - clippy, test, audit: +libssl-dev - enrollment-tests, verify-enrollment-cli: +libssl-dev - build-deb, build-deb-u2204: +libssl-dev - build-rpm (Fedora): +openssl-devel	2026-05-17 16:48:43 +00:00
Echo	3e8eacab9a	fix(tests): resolve all clippy warnings for CI compliance ... - Remove needless borrows on format!() in set_body_string() calls (needless_borrows_for_generic_args) - Replace assert!(false, ...) with collected assertion (assertions_on_constants + never_loop) - Use direct Method::POST comparison instead of to_string() (cmp_owned) - Simplify negated equality to != operator (nonminimal_bool) CI pipeline now passes with -D warnings enabled	2026-05-17 16:02:57 +00:00
Echo	a09e3eaa68	fix: add truncate(true) to lock file OpenOptions for clippy compliance ... Resolves clippy::suspicious_open_options warning on whitelist lock file creation.	2026-05-17 15:21:52 +00:00
Echo	6cfef766a7	fix: apply cargo fmt to resolve CI formatting failures ... Format all enrollment module source files and tests per rustfmt standards. Resolves Gitea CI workflow cargo fmt check failures.	2026-05-17 05:49:26 +00:00
Echo	9a129170f8	feat: add self-enrollment workflow for automated PKI provisioning ... - Phase 1: CLI args (--enroll flag), enroll module skeleton, config support - Phase 2: Registration request, polling loop (24h timeout), main.rs integration - Phase 3: PKI extraction, atomic cert writing, whitelist auto-append, mTLS transition - Phase 4: E2E test suite, README/DEPLOYMENT docs, CI pipeline - Phase 5: SPEC.md, API_DOCUMENTATION.md, CHANGELOG.md, ROADMAP.md sync Security review: APPROVED (0 critical, 0 high findings) Cross-distro compatible: Debian/Ubuntu, RHEL/CentOS/Fedora, Alpine, Arch Linux v1.1.0-enrollment	2026-05-17 05:30:42 +00:00
Echo	d297c8d3b1	docs: add self-enrollment client workflow to API documentation	2026-05-16 19:18:25 +00:00
Echo	abcc5c5e40	fix: use resolved service name for socket activation detection v0.3.12	2026-05-07 01:42:20 +00:00
Echo	3ea0194c6c	fix: remove duplicate comment causing cargo fmt failure v0.3.11	2026-05-05 18:18:57 +00:00
Echo	fb3ba3f2c1	chore: bump to v0.3.10 for CI trigger	2026-05-05 18:11:37 +00:00
Echo	4b32db0d26	fix: detect socket activation for service status healthy logic v0.3.9	2026-05-05 16:25:59 +00:00
Echo	a7b48a59cc	chore: bump version to 0.3.8 for clean CI build v0.3.8	2026-05-05 01:02:05 +00:00
Echo	87601fe510	fix: correct debian changelog format (add missing 0.3.5 header) v0.3.7	2026-05-05 00:56:01 +00:00
Echo	76c26aa379	chore: bump version to 0.3.7 for CI rebuild	2026-05-05 00:23:22 +00:00
Echo	8ca616a02c	chore: update debian changelog to v0.3.6 v0.3.6	2026-05-04 23:57:56 +00:00
Echo	8b6d9ed861	Add GET /api/v1/system/services/{name} endpoint for service health checks ... - Add ServiceStatus struct with name, display_name, active_state, sub_state, load_state, enabled_state, main_pid, healthy fields - Add get_service_status() to PackageManagerBackend trait - Implement get_service_status() in AptBackend with systemd and OpenRC support - Add get_service_status HTTP handler in system.rs - Add /system/services/{name} route - Add E2E test for service status endpoint - Bump version to 0.3.6	2026-05-04 23:44:26 +00:00
Echo	c44045db38	feat: implement proper WebSocket handler with actix-web-actors ... - Replace stub websocket_handler with proper actix_web_actors::ws::start() - Add WsJobActor that subscribes to JobManager broadcast channel - Add broadcast::Sender/Receiver to JobManager for real-time status updates - Emit JobStatusEvent on job state changes (create, update, complete, fail) - Handle subscribe/unsubscribe client messages for per-job filtering - Add 5-second heartbeat ping/pong for connection keepalive - Properly compute Sec-WebSocket-Accept header per RFC 6455	2026-05-04 15:19:44 +00:00
Echo	76ce246893	docs: add systemd sandboxing and E2E test lessons learned	2026-05-03 04:31:19 +00:00
Echo	6ba708abb1	fix: remove all systemd capability restrictions blocking package management ... - Remove CapabilityBoundingSet and AmbientCapabilities (apt needs full root capabilities) - Remove ReadWritePaths (unnecessary without ProtectSystem=strict) - Fix E2E test: properly FAIL on status=failed package operations - Fix E2E test: require status=completed for install/update/remove lifecycle - Update dpkg packaging service file to match configs/ - Bump version to 0.3.5 v0.3.5	2026-05-03 04:13:50 +00:00
Echo	de7ec9905f	fix: correct Cargo.toml version to 0.3.4 v0.3.4	2026-05-03 03:11:52 +00:00
Echo	508037d656	chore: bump version to 0.3.4 for clean CI build	2026-05-03 03:11:41 +00:00