Fimeg
0d908ba512
feat: zero-sudo agent, helper self-upgrade, OSV expansion, docker handler rewrite, staging UI
Agent privilege reduction:
- apt discovery unprivileged (sandbox opts like dnf)
- docker commands use group membership, no sudo
- agent self-upgrade delegated to helper via agent-self capability token
- sudoers template stripped to single systemd-run helper line
Helper (Rust):
- agent-self package type: stage, hash-verify, backup, install, chmod, restart
- TOCTOU-safe: copy-then-hash, never hash a path re-read later
- --no-block restart so helper finishes before agent SIGTERM
Server:
- mintAgentSelfToken signs agent-self tokens for manual and bulk update paths
- OSV.dev checks at discovery time (async, deduped) + startup backfill
- apt/dnf added to OSV ecosystem mapping
- docker handler rewritten against DockerQueries (proper image/container split)
- status filter server-side on aggregated packages (HAVING clause)
- dead code removed: UpdatePackage model, UpsertUpdate, ListUpdates
Frontend:
- LiveOperations -> Staging with staged-packages section
- Docker severity from data, not hardcoded
- Updates status filter delegated to server
|
2026-05-30 12:56:40 -04:00 |
| .. |
|
cmd/server
|
feat: zero-sudo agent, helper self-upgrade, OSV expansion, docker handler rewrite, staging UI
|
2026-05-30 12:56:40 -04:00 |
|
internal
|
feat: zero-sudo agent, helper self-upgrade, OSV expansion, docker handler rewrite, staging UI
|
2026-05-30 12:56:40 -04:00 |
|
.env.example
|
refactor: rename aggregator-agent to agent for public release
|
2026-05-21 13:19:18 -04:00 |
|
docker-entrypoint.sh
|
refactor: rename aggregator-agent to agent for public release
|
2026-05-21 13:19:18 -04:00 |
|
Dockerfile
|
feat: helper distribution pipeline + dnf discovery/resolve fixes for live gate
|
2026-05-29 22:04:38 -04:00 |
|
go.mod
|
refactor(agent): scanner orchestrator cleanup + kernel-enforcement wiring + hash-registry follow-ups
|
2026-05-28 13:31:51 -04:00 |
|
go.sum
|
refactor(agent): scanner orchestrator cleanup + kernel-enforcement wiring + hash-registry follow-ups
|
2026-05-28 13:31:51 -04:00 |