Amir Alexander Abdelbaki
4200557757
Replaces the unsigned SMB-policystore auto-sync (enforcer blindly sourced whatever .sh files sat on the share, no integrity check) with a dedicated git-over-SSH server plus GPG commit signing: nodes pull on a timer, verify every commit's signature and fast-forward history before an unprivileged puller account hands off to root via one exact scoped sudo command, and a fetch failure is a safe no-op that keeps the last-known-good policy running. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| dev_daemon.sh | ||
| dev_local-sudo.sh | ||
| dev_mon.sh | ||
| dev_mon_clamscan.sh | ||
| dev_no-local-users.sh | ||
| dev_ssh.sh | ||
| dev_timeshift-backup.sh | ||
| usr_admin.sh | ||
| usr_block-binary.sh | ||
| usr_policystore.sh | ||
| usr_prt.sh | ||
| usr_smb.sh | ||