Amir Alexander Abdelbaki
4200557757
Replaces the unsigned SMB-policystore auto-sync (enforcer blindly sourced whatever .sh files sat on the share, no integrity check) with a dedicated git-over-SSH server plus GPG commit signing: nodes pull on a timer, verify every commit's signature and fast-forward history before an unprivileged puller account hands off to root via one exact scoped sudo command, and a fetch failure is a safe no-op that keeps the last-known-good policy running. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| md | ||
| md-to-html.sh | ||
| md-to-pdf.sh | ||