fix(postinst): thorough audit - fix argon2 salt and verify all password generation logic

chore: bump version to 1.1.6 (#56 )
fix(postinst): correct argon2 -m parameter from raw KiB to log2 value (#55 )
2026-06-09 08:42:33 -05:00 · 2026-06-09 08:21:20 -05:00 · 2026-06-09 08:10:00 -05:00 · 2026-06-08 20:15:13 -05:00 · 2026-06-08 17:54:25 -05:00 · 2026-06-08 17:44:20 -05:00
8 changed files with 38 additions and 6 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -135,6 +135,7 @@ jobs:
    needs: [rust-format, clippy, rust-test, security-audit, frontend-lint]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
+    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4

@ -166,7 +167,7 @@ jobs:
        uses: docker/build-push-action@v6
        with:
          context: .
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
--- a/Cargo.toml
+++ b/Cargo.toml
@ -12,7 +12,7 @@ members = [
 ]

 [workspace.package]
-version = "1.1.2"
+version = "1.1.6"
 edition = "2021"
 authors = ["Echo <echo@moon-dragon.us>"]
 license = "MIT"
--- a/10
+++ b/10
@ -28,6 +28,14 @@ WORKDIR /usr/src/app

 # Cache dependencies by building a dummy project first
 COPY Cargo.toml Cargo.lock ./
+COPY crates/pm-web/Cargo.toml crates/pm-web/Cargo.toml
+COPY crates/pm-worker/Cargo.toml crates/pm-worker/Cargo.toml
+COPY crates/pm-core/Cargo.toml crates/pm-core/Cargo.toml
+COPY crates/pm-agent-client/Cargo.toml crates/pm-agent-client/Cargo.toml
+COPY crates/pm-auth/Cargo.toml crates/pm-auth/Cargo.toml
+COPY crates/pm-ca/Cargo.toml crates/pm-ca/Cargo.toml
+COPY crates/pm-reports/Cargo.toml crates/pm-reports/Cargo.toml
+COPY crates/migrate-secrets/Cargo.toml crates/migrate-secrets/Cargo.toml
 RUN mkdir -p crates/pm-web/src crates/pm-worker/src crates/pm-core/src \
    crates/pm-agent-client/src crates/pm-auth/src crates/pm-ca/src \
    crates/pm-reports/src crates/migrate-secrets/src
@ -43,6 +51,7 @@ RUN cargo build --release 2>/dev/null || true

 # Now build the real project
 COPY crates/ crates/
+COPY migrations/ migrations/
 RUN cargo build --release

 # Verify binaries exist
@ -84,6 +93,7 @@ RUN apt-get update && apt-get install -y \
    ca-certificates \
    libssl3t64 \
    libfontconfig1 \
+    openssl \
    postgresql-client-16 \
    argon2 \
    curl \
--- a/debian/changelog
+++ b/debian/changelog
@ -1,3 +1,21 @@
+linux-patch-manager (1.1.6-1) unstable; urgency=low
+
+  * Release v1.1.6
+
+ -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 08:10:52 -0500
+
+linux-patch-manager (1.1.5-1) unstable; urgency=low
+
+  * Release v1.1.5
+
+ -- git-echo <git-echo@moon-dragon.us>  Mon, 08 Jun 2026 20:15:50 -0500
+
+linux-patch-manager (1.1.4-1) unstable; urgency=low
+
+  * Release v1.1.4
+
+ -- git-echo <git-echo@moon-dragon.us>  Mon, 08 Jun 2026 17:30:35 -0500
+
 linux-patch-manager (1.1.2-1) unstable; urgency=low

  * Release v1.1.2
--- a/debian/control
+++ b/debian/control
@ -1,5 +1,5 @@
 Package: linux-patch-manager
-Version: 1.1.2-1
+Version: 1.1.6-1
 Architecture: amd64
 Maintainer: Moon Dragon <echo@moon-dragon.us>
 Installed-Size: 45000
--- a/debian/postinst
+++ b/debian/postinst
@ -207,8 +207,11 @@ generate_admin_password() {
    admin_password=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9!@#%^&*' | head -c 24)

    # Hash with argon2 (PHC format, compatible with the application)
+    # Generate a random 16-character salt (argon2 requires minimum 8 characters)
+    local admin_salt
+    admin_salt=$(openssl rand -base64 24 | tr -dc 'A-Za-z0-9' | head -c 16)
    local password_hash
-    password_hash=$(echo -n "${admin_password}" | argon2 salt -id -t 3 -m 65536 -p 1 -l 32 -e)
+    password_hash=$(echo -n "${admin_password}" | argon2 "${admin_salt}" -id -t 3 -m 16 -p 1 -l 32 -e)

    # Update admin user password in database
    # Only update if the placeholder hash is still present
--- a/frontend/package.json
+++ b/frontend/package.json
@ -1,7 +1,7 @@
 {
  "name": "patch-manager-ui",
  "private": true,
-  "version": "1.1.2",
+  "version": "1.1.6",
  "type": "module",
  "scripts": {
    "dev": "vite",
--- a/scripts/build-package.sh
+++ b/scripts/build-package.sh
@ -22,7 +22,7 @@ warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
 error() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }

 PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-VERSION="1.1.2"
+VERSION="1.1.6"
 RELEASE="1"
 PKG_NAME="linux-patch-manager"
 DEB_NAME="${PKG_NAME}_${VERSION}-${RELEASE}_amd64.deb"
Author	SHA1	Message	Date
Draco-Lunaris-Echo	4c02b778c0	fix(postinst): thorough audit - fix argon2 salt and verify all password generation logic	2026-06-09 08:42:33 -05:00
Draco-Lunaris-Echo	0c0f952f7f	chore: bump version to 1.1.6 (#56 ) Some checks failed CI Pipeline / Rust Format Check (push) Successful in 3s CI Pipeline / Clippy Lints (push) Successful in 53s CI Pipeline / Rust Unit Tests (push) Failing after 1m27s CI Pipeline / Security Audit (push) Successful in 4s CI Pipeline / Frontend Lint & Type Check (push) Successful in 15s CI Pipeline / Build .deb & Release (push) Has been skipped	2026-06-09 08:21:20 -05:00
Draco-Lunaris-Echo	2a18276884	fix(postinst): correct argon2 -m parameter from raw KiB to log2 value (#55 ) * chore: bump version to 1.1.5 * fix(postinst): correct argon2 -m parameter from raw KiB to log2 value * trigger CI	2026-06-09 08:10:00 -05:00
Draco-Lunaris-Echo	2bdbc8af5a	fix(ci): remove arm64 from Docker platforms and add timeout (#53 ) Some checks failed CI Pipeline / Rust Format Check (push) Successful in 6s CI Pipeline / Clippy Lints (push) Successful in 53s CI Pipeline / Rust Unit Tests (push) Failing after 1m58s CI Pipeline / Security Audit (push) Successful in 5s CI Pipeline / Frontend Lint & Type Check (push) Successful in 14s CI Pipeline / Build .deb & Release (push) Has been skipped	2026-06-08 20:15:13 -05:00
Draco-Lunaris-Echo	87bd5d2162	fix: remove duplicate version display from sidebar toolbar (#52 ) Some checks failed CI Pipeline / Rust Format Check (push) Successful in 2s CI Pipeline / Clippy Lints (push) Successful in 52s CI Pipeline / Rust Unit Tests (push) Failing after 1m53s CI Pipeline / Security Audit (push) Successful in 4s CI Pipeline / Frontend Lint & Type Check (push) Successful in 15s CI Pipeline / Build .deb & Release (push) Has been skipped	2026-06-08 17:54:25 -05:00
Draco-Lunaris-Echo	836d409e3b	feat: add version display to sidebar and bump to v1.1.4 (#51 ) Some checks failed CI Pipeline / Rust Format Check (push) Successful in 7s CI Pipeline / Clippy Lints (push) Successful in 51s CI Pipeline / Rust Unit Tests (push) Failing after 1m40s CI Pipeline / Security Audit (push) Successful in 4s CI Pipeline / Frontend Lint & Type Check (push) Successful in 14s CI Pipeline / Build .deb & Release (push) Has been skipped	2026-06-08 17:44:20 -05:00
Draco-Lunaris-Echo	e17b740415	fix(docker): complete Dockerfile audit - migrations, deps, openssl (#49 ) Some checks failed CI Pipeline / Rust Format Check (push) Successful in 5s CI Pipeline / Clippy Lints (push) Successful in 52s CI Pipeline / Rust Unit Tests (push) Failing after 1m46s CI Pipeline / Security Audit (push) Successful in 5s CI Pipeline / Frontend Lint & Type Check (push) Successful in 15s CI Pipeline / Build .deb & Release (push) Has been skipped Three issues fixed in the multi-stage Docker build: 1. CRITICAL: Add COPY migrations/ to rust-builder stage - sqlx::migrate!(../../migrations) is a compile-time proc macro - Without migrations/ present, cargo build fails with 'no such file or directory' - Previously migrations/ was only copied in runtime stage (too late) 2. Copy individual crate Cargo.toml files for dependency caching - The dummy-build caching step only copied workspace Cargo.toml/Cargo.lock - Without crate-level manifests, cargo couldn't resolve the workspace - This meant the cache layer was ineffective (rebuilt everything on code changes) 3. Add openssl package to runtime stage - entrypoint.sh uses openssl rand, openssl genpkey, openssl pkey - Only libssl3t64 (shared library) was installed, not the CLI tool - Runtime would fail on first-run key generation All stages verified: Ubuntu 24.04 ✅ Rust via rustup (1.85+) ✅	2026-06-07 22:59:32 -05:00