Repository navigation
Conversation
Bumps [docker/setup-docker-action](https://github.com/docker/setup-docker-action) from 4 to 5. - [Release notes](https://github.com/docker/setup-docker-action/releases) - [Commits](docker/setup-docker-action@v4...v5) --- updated-dependencies: - dependency-name: docker/setup-docker-action dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v4...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Fix command injection in _record_backup_init (linuxinstall.sh:187) - Fix sed injection in _set_or_append_sshd_config (linuxinstall.sh:2358) and restore_ssh.sh:_set_or_append (restore_ssh.sh:126) - Fix &&/|| operator precedence bugs (linuxinstall.sh:87, lib/temp.sh:40) - Remove unused 'inner' variable in ensure_tmux_if_ssh; keep tmux session alive - Replace \ with \ in restore/rollback messages for accuracy - Add maintenance-menu prompt at end of _print_run_summary - Fix _run_all_updates error masking (track _update_failed instead of || true) - Fix parallel fallback in lib/updater.sh:651 - Make run_remote_script propagate exit codes (return \True) - Add set -euo pipefail and explicit exit 0 to OptimizeLinuxASR.sh - Add explicit exit 0 to DeepClean.sh for consistency - All scripts now properly return control to main() step flow
fix: security hardening, robustness, and exit code propagation
fix: quote SCRIPT_PATH in ssh watchdog heredocs
…store fallback - Fix SECONDS reset in _run_step, _step_end, and updater.sh standalone mode (was causing negative total runtime in summary) - Validate SCRIPT_PATH at startup; fallback to common locations if path looks wrong - Mark skipped steps in _run_step so progress bar is accurate - Add curl fallback to /etc snapshot restore instructions - Use local variables for step timing instead of resetting global SECONDS
fix: SECONDS reset bug, SCRIPT_PATH validation, progress accuracy, restore fallback
…runs - Add _state_get/_state_set/_state_clear helpers with atomic writes - State file at /etc/neohiro/linux-state.conf (mode 0600, root-owned) - detect_or_ask_env() loads saved values; prompts only on first run or --reset-state - Add --reset-state flag to clear saved decisions - Welcome screen shows state file path
feat: persistent state — remember ENV_TYPE and USE_REMOTE_SSH across runs
fix: missing run() alias, _step_end shows FAIL
fix: _step_end time formatting regression
- Fix --step alias handling: VALID_STEPS_ALIASES now defined before _should_run_step; bidirectional alias matching (system<->system_update, ssh<->ssh_hardening, etc.) - SSH hardening moved to LAST step in workflow and checklist order to prevent lockout risk; label updated to 'SSH hardening (lockout-prone — run LAST)'; Server profile (2) default enabled steps updated to use ssh_hardening key - run_remote_script: respect DRY_RUN=1 flag for preview mode - GPG verification: _verify_remote_gpg_signature returns 0/1/2 for success/failure/advisory; run_remote_script handles all three codes; fingerprint mismatch treated as advisory unless NEOSIGN_GPG_LEVEL=required - Auto-mode SSH hardening: only disable PasswordAuthentication if valid pubkey exists (_ssh_has_valid_pubkey); prevents lockout when no keys configured; removed old fallback logic that could cause lockout
- Updated all grep patterns from '^(ssh-|ecdsa-)' to '^(ssh-(ed25519|rsa|dss|ecdsa)|ecdsa-sha2-nistp[0-9]+)' to match all OpenSSH key types (ed25519, rsa, dss, ecdsa, ecdsa-sha2) - Affected functions: - _ssh_has_valid_pubkey (new, auto-mode lockout prevention) - _ssh_disable_password_auth - backup_and_report_authorized_keys - audit_authorized_keys - harden_ssh (anti-lockout check) - _ssh_self_heal_check - restore_ssh_mode - restore_ssh.sh:count_pubkeys - Fixed syntax error in _ssh_self_heal_check (missing closing quote)
- Add command-line options table (--dry-run, --step, --restore-ssh, etc.) - Document --step alias support (system/system_update, ssh/ssh_hardening, etc.) - Document GPG signature verification (NEOSIGN_GPG_LEVEL, NEOSIGN_GPG_FPR) - Document SSH hardening now runs last for lockout prevention - Resolve merge conflict in README (keep new 'One-step automated setup' section)
- Replaced flat VALID_STEPS_ALIASES with STEP_ALIAS_PAIRS (key:alias format) - Fixed logic to only allow specific alias pairs: system <-> system_update dns <-> dnscrypt ssh <-> ssh_hardening optimize <-> optimize_asr - Previous logic incorrectly allowed ANY step in list to run if SELECTED_STEP was also in list - Test cases in test_linuxinstall.sh will now pass correctly
- Verify all 4 alias pairs work bidirectionally: system <-> system_update dns <-> dnscrypt ssh <-> ssh_hardening optimize <-> optimize_asr - Verify non-alias steps are still correctly skipped
…estore cmd - Fix prompt_choice: REPLY_CHOICE= (was causing off-by-one profile bug) - Add inline runner fallback (_runner_cmd, run) for curl|bash path (was missing, causing 'run: command not found') - Add _get_restore_cmd helper: uses SCRIPT_PATH if real file, else re-fetch URL (fixes '/root/bash' in restore msg) - Remove duplicate runner sourcing block that used unset _NEOHIRO_LIB_DIR - Keep _NEOHIRO_LIB_DIR unset removed since runner is now always available inline
- Add extraction region for early helpers (_get_restore_cmd, _state_*) - Add extraction region for SSH hardening helpers (_ssh_has_valid_pubkey) - Add tests for run_remote_script DRY_RUN mode - Add tests for _get_restore_cmd (valid/invalid SCRIPT_PATH) - Add tests for _ssh_has_valid_pubkey (no keys, ed25519, RSA, ECDSA, invalid format) - Update extraction to include all 6 helper regions
Owner
Author
|
Superseded: the intended hardening changes are already in main via PR #25. This branch also carries stale local-only commits from a diverged main, so it fails CI. Closing without merge. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge conflict resolution after PR #25 was merged.
Conflicts in:
Resolved by accepting the remote (origin/main) version which already contains the PR #25 changes.