3 Commits

Include renames

Author	SHA1	Message	Date
Ilker ManapandClaude Opus 5.5	ff0de7e0b2	Release image upload: the image directory belongs to the deploy user ... The image job built as root and uploaded as the deploy user, so publish-image.sh could not write SHA256SUMS (v0.3.0's image job failed). The job hands the directory over after the build, and publish-image.sh checks the SHA256SUMS build-image.sh wrote instead of rewriting it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-31 09:32:54 +01:00
Ilker ManapandClaude Opus 5.5	a549f01ef5	Security review: fix traversal, identity, injection and takeover paths ... Findings from a full review (auth/API, CA and rack channel, config generation, integrations, UI/agents/scripts), each verified in code: - rack binary endpoint read any region file via arch=../.. (CA key) - render endpoint traversal; machine-reported MACs used as file paths - delegated intermediates could mint admin/rack identities and IPs; identities now require root-issued certs, intermediates are ServerAuth-only with both name types constrained - rack certs were ServerAuth for rack-chosen SANs: now client-only; racks accept only the region's own cert; join checks the CA fingerprint; unbound join codes cannot take an existing name; job results bound to the rack that took them - rack self-update: region signs binaries with the CA key, the root unit verifies against the join-time CA in a root-owned dir - dnsmasq reads a checked, root-owned copy limited to generated options - commissioning could overwrite deployed machines; MAC takeover of PXE - injection into dnsmasq/cloud-init/PXE/udev/DNS via names and machine-reported strings; stored XSS in the UI; CSP and cross-origin protection; deploy agent shell injection and seed traversal - Redfish requests confined to the BMC's /redfish/ tree - admin_http defaults to loopback; body limits and timeouts; secrets off command lines Also: IPAM claim/reconcile race, sync stopping on one error, watchdog race, release wiping the wrong disk, SAN LUNs as auto targets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 17:58:42 +01:00
Ilker ManapandClaude Opus 5.5	623e7c0cc4	Install guide, release bundles, publishable commissioning image ... INSTALL.md follows a clean run from day 0 to a deployed machine. Release assets now include rollcall-<tag>-linux-<arch>.tar.gz (binary, deploy/, agent/). deploy/publish-image.sh uploads a region's commissioning image to a release (commissioning-*); bootstrap.sh downloads either layout, with IMAGE_TOKEN for private repositories. bootstrap: --ssh-key (default: the operator's keys), keeps server_url on reruns without --iface. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-28 18:38:54 +01:00