Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

swap uuid lib, windows installer pass, README/RAF copy

Browse source 
- google/uuid -> gofrs/uuid/v5 across server + agent
- windows.go: cross-platform binding cleanup
- linux install template: disable sudo lecture for TTY-less service user
- README: XZ/SolarWinds lede, stable-release note, single attack-surface block
This commit is contained in:
Fimeg 2026-06-03 15:39:49 -04:00
commit 5758b26875
110 changed files with 613 additions and 495 deletions
Download patch file Download diff file Expand all files Collapse all files

7
README.md
View file

@ -5,17 +5,18 @@
`v0.2.3.1` — June 2026 · MIT License
> **You're early — nearly 600 of you cloned this before it was announced.**
> A stable release is coming soon, bringing Windows support back fully gated.
> If you want it to keep existing, [sponsor the work](#sponsorship--consulting).
---
The update manager is part of your attack surface. Most homelab tooling ignores this. RedFlag doesn't.
The software that patches your fleet runs as root on every box. XZ Utils came through a build pipeline. SolarWinds came through an update. The update manager is part of your attack surface — most homelab tooling ignores that. RedFlag treats it as the attack surface it is.
Every command the server issues is Ed25519-signed. Agents verify the signature, check the nonce, validate the timestamp, and reject anything they've seen before. The signing key never leaves your server. Hardware binding means a stolen agent config doesn't work on a different machine. You can read the security model in the code, not in marketing copy.
It also just manages your updates — across Linux and Windows, including Docker containers running on those hosts — from a single dashboard, with a human approval step before anything gets installed.
The supply-chain gate goes deeper: when an update is approved, the server resolves the full dependency closure, checks every transitive artifact against OSV.dev, and mints a signed capability token binding the exact artifact hashes. A network-less privileged executor verifies the signature and every hash before anything installs — it can't reach out and can't be redirected. A known vulnerability anywhere in the closure is a full stop: the operator must override with a documented reason, or the token is never minted. The signing and hash verification have no skip path.
The supply-chain gate goes deeper: when an update is approved, the server resolves the full dependency closure, checks every transitive artifact against OSV.dev, and mints a signed capability token binding the exact artifact hashes. A network-less privileged executor verifies the signature and every hash before anything installs. A known vulnerability anywhere in the closure is a full stop — the operator must override with a documented reason, or the token is never minted. The signing and hash verification have no skip path.
It also just manages your updates — across Linux and Windows, including Docker containers running on those hosts — from a single dashboard, with a human approval step before anything gets installed.
ConnectWise charges $50/agent/month. RedFlag doesn't.