Amir Alexander Abdelbaki
4200557757
Replaces the unsigned SMB-policystore auto-sync (enforcer blindly sourced whatever .sh files sat on the share, no integrity check) with a dedicated git-over-SSH server plus GPG commit signing: nodes pull on a timer, verify every commit's signature and fast-forward history before an unprivileged puller account hands off to root via one exact scoped sudo command, and a fetch failure is a safe no-op that keeps the last-known-good policy running. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ansible | ||
| autofs-pkgbuild | ||
| image | ||
| auto-enroll-ansible.sh | ||
| copilot-explains.txt | ||
| freeipa-client-answerfile.json | ||
| freeipa-client.sh | ||
| freeipa-enroll.sh | ||