 iceBear67
|
c7afb86ebc
|
harden build scripts and fix correctness issues from audit
Security & correctness fixes following the audit in REPORT.md.
- setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
check failures properly, return valid exit codes, and fetch
/releases/latest (arch-aware) instead of the possibly-draft .[0]
- entrypoint.sh: quote "$@" and build --net conditionally so empty
NET_INTERFACE/NET_MAC don't yield "tap=,mac="
- image-updater: replace tight 3s retry loop with capped exponential
backoff + periodic pull instead of hammering the registry
- sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
- vm.Dockerfile: copy only host private keys at mode 600 instead of
the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
- Makefile: stop generating redundant _pub key files
- build-image.sh: detect failure via alpine-make-vm-image's real exit
status rather than grepping stdout for "ERROR"
- remove orphaned etc/alloy/config.alloy (service not installed)
- README: correct data.raw path
- add REPORT.md audit notes (H1/H2 accepted as out-of-scope)
|
2026-07-14 17:52:24 +08:00 |
|
|
iceBear67
|
8bb600d5ef
|
fix bubble unit and revert alloy
|
2026-07-08 23:47:53 +08:00 |
|
|
iceBear67
|
d20a544a33
|
fix: failed to install alloy
|
2026-07-08 23:30:22 +08:00 |
|
|
iceBear67
|
6b58126315
|
add nftables to fix dependency of alloy
|
2026-07-08 23:15:59 +08:00 |
|
|
iceBear67
|
c6ce5f676e
|
add alloy
|
2026-07-08 22:30:48 +08:00 |
|
|
iceBear67
|
bf67b8b95f
|
refactor
|
2026-07-05 13:49:09 +08:00 |
|
|
iceBear67
|
9a79ab0595
|
add openssh server && enable bubble
|
2026-06-22 14:51:07 +08:00 |
|
|
iceBear67
|
246f127773
|
try odhcpd
|
2026-06-22 13:08:49 +08:00 |
|
|
iceBear67
|
c4994f4ebf
|
use dhcpcd
|
2026-06-22 12:07:41 +08:00 |
|
|
iceBear67
|
269734b313
|
fix build issue
|
2026-06-22 11:42:33 +08:00 |
|
|
iceBear67
|
bd3df67542
|
fix and finally ran
|
2026-06-16 16:42:28 +08:00 |
|