Commit Graph

Select branches

Hide Pull Requests

main

Mono Color

• 0d725af716 ci: add registry-gc — prune orphan container images for deleted branches Audiobuzz 2026-07-03 07:33:46 +00:00
• 620a60401f stig: ship fapolicyd_tmpfs SELinux module — close overlay exec-guard gap Audiobuzz 2026-07-03 07:18:01 +00:00
• 8e105c8bf1 docs/TODO #18: kiosk render bench-verified on VM + 820 (i915 firmware confirmed) Audiobuzz 2026-07-03 06:58:52 +00:00
• bf0c61a025 docs/TODO #18: record f59eb79 built + booted successfully Audiobuzz 2026-07-03 06:55:52 +00:00
• 853ae20e68 trim: omit unused GPU drivers + tighten firmware keep-list (TODO #18) Audiobuzz 2026-07-03 06:36:32 +00:00
• 0bfe872828 nvmf: targeted per-version connect (rd.nvmf.nqn) instead of connect-all Audiobuzz 2026-07-03 06:14:08 +00:00
• 5cc72ccac3 trim: drop nss-mdns (+ orphaned avahi) — media-independent mDNS resolver Audiobuzz 2026-07-03 05:55:00 +00:00
• f59eb7942a trim: run firmware strip pre-dracut so the UKI initramfs shrinks too Audiobuzz 2026-07-03 05:36:51 +00:00
• 9464e7fc2a trim: slim image ~800 MB — glibc langpacks en-only + linux-firmware strip (TODO #18) Audiobuzz 2026-07-03 05:23:49 +00:00
• 67932517fb Merge remote-tracking branch 'origin/main' into trim-rpm Audiobuzz 2026-07-03 14:28:18 +09:30
• 28c4ca80f6 Merge remote-tracking branch 'origin/main' into optimise-ram Audiobuzz 2026-07-03 14:27:46 +09:30
• 81c10b6e7a Merge pull request 'tpm-enroll' (#10) from tpm-enroll into main audiobuzz 2026-07-03 04:57:08 +00:00
• db0bb28ebd docs/TODO #11: Dell 820 TPM enrolment bench-verified on real hardware Audiobuzz 2026-07-03 04:55:08 +00:00
• 796dfe9f4e reduce overlay RAM + kill .pyc AVC churn (TODO #16 item2, #17) Audiobuzz 2026-07-03 04:03:01 +00:00
• c0a08438b2 kiosk: disable weak deps + add package-footprint audit Audiobuzz 2026-07-03 03:27:58 +00:00
• d9d2b50bfb stig: fix chrony SELinux .te — use raw module syntax, not policy_module() macro Audiobuzz 2026-07-03 02:53:57 +00:00
• 6fe623c727 tpm-enrol: move NV cert index off OEM-occupied 0x01800001 → 0x01800100 Audiobuzz 2026-07-03 02:51:38 +00:00
• 33de300af8 docs/TODO: add #16 — enable a locked-down firewalld (defense-in-depth + STIG passes) Audiobuzz 2026-07-03 01:31:03 +00:00
• 4a8143d0bc build: remove + mask firewalld (kickstart excludes it; weak-dep reinstall caused AVC flood) Audiobuzz 2026-07-03 01:22:20 +00:00
• 835ae7bc24 stig: ship SELinux allow module for chrony DHCP-NTP dispatcher (stop chronyd AVC) Audiobuzz 2026-07-03 01:16:26 +00:00
• 0e139f5346 serving: make the SPDK nvmeof target version-agnostic (stop recreating it on IMAGE_VERSION bump) Audiobuzz 2026-07-03 01:07:16 +00:00
• 86a9839cc4 fleet-enrol: content-aware NV check (-check-only), not blind "index defined" Audiobuzz 2026-07-03 01:02:25 +00:00
• 4d6f038e3c tpm-enrol: move signing key off the EK slot 0x81010001 → 0x81000100 Audiobuzz 2026-07-02 12:19:59 +00:00
• 4c55ed4b26 docs/TODO #11: record stale non-ECC key bench finding + SELinux hand-run caveat Audiobuzz 2026-07-02 11:43:31 +00:00
• 63cd4049ff fleet-enrol: self-heal a stale non-ECC key at the enrol handle Audiobuzz 2026-07-02 11:43:03 +00:00
• 1e1265b5a0 docs/TODO: add #15 — scope root overlay to per-subtree tmpfs (un-shadowable /usr + STIG mount options) Audiobuzz 2026-07-02 11:31:33 +00:00
• 7f975bfa5f extract-artifacts: strip NUL from SELinux context in status echo Audiobuzz 2026-07-02 11:00:58 +00:00
• ca6b75508c ci: pin Go-build step to bash (Gitea runner defaults run steps to sh) Audiobuzz 2026-07-02 10:07:23 +00:00
• 545d459c3d tpm-enrol: allow enrolment under rd.dot1x=0 (test-mode) for bench testing Audiobuzz 2026-07-02 10:00:26 +00:00
• 6278f2847d tpm-enrol: pivot host enrolment to a Go binary, built out-of-VM Audiobuzz 2026-07-02 09:55:54 +00:00
• 8e1d40a30b tpm-enrol: inline empty-NV first-boot enrolment (host side, TODO #11) Audiobuzz 2026-07-02 09:00:18 +00:00
• a370f80332 TODO #11: step signer re-verified on the serving host (720h claim, chain) Audiobuzz 2026-07-02 08:45:30 +00:00
• b8f88091f1 bootstrap: connect to step-ca via localhost, not ca.fleet.lab Audiobuzz 2026-07-02 08:41:03 +00:00
• 8376f9a92e enrol-broker: run in serving stack + fix step signer path end-to-end Audiobuzz 2026-07-02 08:35:35 +00:00
• 9e1dbd3ef7 initial tpm broker Audiobuzz 2026-06-28 10:33:14 +00:00
• 3bcf16e384 Merge remote-tracking branch 'origin/main' into tpm-enroll Audiobuzz 2026-06-28 18:32:39 +09:30
• 5232b36614 tpm design Audiobuzz 2026-06-28 18:32:36 +09:30
• 889db569e5 Merge pull request 'workstation-api' (#9) from workstation-api into main audiobuzz 2026-06-28 08:45:20 +00:00
• bc14b8986d fixing final SPDK deployment Audiobuzz 2026-06-28 08:44:49 +00:00
• 2cf7ad4ffb Apply chromium policy hardening Audiobuzz 2026-06-28 03:18:54 +00:00
• ad6b7e3366 Add Host API and fix kiosk performance Audiobuzz 2026-06-28 03:14:25 +00:00
• b5163f958e Fix upper case branch name bug Audiobuzz 2026-06-28 02:19:36 +00:00
• b159bc678c Fix discovery duplicate Audiobuzz 2026-06-28 02:11:08 +00:00
• 5e4ee87e88 Fix symnlinking of releases Audiobuzz 2026-06-28 01:50:33 +00:00
• 02ffd7d885 Adding spdk loader Audiobuzz 2026-06-27 10:44:42 +00:00
• e43112b0f1 Permanent SPDK trial Audiobuzz 2026-06-27 19:29:19 +09:30
• ce5af959ad Add SIEM Audiobuzz 2026-06-27 08:52:17 +00:00
• 4d51fa97c2 Merge pull request 'kiosk-app-separate' (#8) from kiosk-app-separate into main audiobuzz 2026-06-26 00:25:05 +00:00
• 184c7859cf exclude non-rootfs files from main gitea workflow Audiobuzz 2026-06-26 00:06:49 +00:00
• 1612af3a23 Add kiosk-app as a submodule Audiobuzz 2026-06-26 09:26:57 +09:30
• c02937f855 Remove kiosk-app (moving to submodule) Audiobuzz 2026-06-26 09:26:37 +09:30
• 25d0cfff7c Prep kiosk-app for submodule split Audiobuzz 2026-06-25 23:55:29 +00:00
• c3507cda6e Update SSP Audiobuzz 2026-06-25 23:46:42 +00:00
• dea7ca451a Adding dot1x support Audiobuzz 2026-06-22 20:50:48 +00:00
• 1f62e5ab17 Add multi branch handling Audiobuzz 2026-06-21 09:18:22 +00:00
• 3226a44d5a Refactor dnsmasq to build as a container. Add signed iPXE image build Audiobuzz 2026-06-21 09:11:23 +00:00
• 535793228e Merge remote-tracking branch 'origin/main' into pxe Audiobuzz 2026-06-20 21:47:53 +09:30
• d2b2156a22 Fixed the secure boot enrollment script Audiobuzz 2026-06-20 12:16:37 +00:00
• fd80a081da Merge pull request 'Add secure boot helper' (#6) from secureboot into main audiobuzz 2026-06-20 09:26:01 +00:00
• 33583bb4d8 Tidy up pxe flow Audiobuzz 2026-06-20 09:19:01 +00:00
• fb69068980 Update pxe boot flow Audiobuzz 2026-06-20 09:17:05 +00:00
• 3120ee49c4 Merge pull request 'secureboot' (#5) from secureboot into main audiobuzz 2026-06-20 09:14:10 +00:00
• e3978bb210 Add secure boot helper Audiobuzz 2026-06-20 06:04:04 +00:00
• 417f36d1b7 Merge branch 'stig' into secureboot Audiobuzz 2026-06-20 14:51:11 +09:30
• 9b0d4a61ea Change email notification to syslog Audiobuzz 2026-06-20 14:50:40 +09:30
• 1887b6f0a2 Add sbsigntool to the build image Audiobuzz 2026-06-20 03:32:56 +00:00
• 249aeea591 Update device type for packer vm Audiobuzz 2026-06-20 01:31:36 +00:00
• 65768b759c Update core layout for packer vm Audiobuzz 2026-06-20 01:29:40 +00:00
• ec92417312 Initial Secure boot setup Audiobuzz 2026-06-20 00:40:59 +00:00
• b67a23e718 Tightening Stig hardening Audiobuzz 2026-06-20 00:05:19 +00:00
• b9258e7490 Merge pull request 'app' (#4) from app into main audiobuzz 2026-06-19 23:52:58 +00:00
• 9f7d8d13f4 Fix kiosk startup Audiobuzz 2026-06-19 11:58:41 +00:00
• 98c71474d3 Add fleet hostnaming Audiobuzz 2026-06-19 09:59:49 +00:00
• 13ac648267 adding secure rsyslog exceptions Audiobuzz 2026-06-19 05:01:32 +00:00
• 18b47ca5b0 re-enable stig Audiobuzz 2026-06-19 04:22:03 +00:00
• 77416a8e37 Fix fapolicyd for kiosk Audiobuzz 2026-06-19 04:21:15 +00:00
• c150dd6eba Point images at harbor Audiobuzz 2026-06-19 04:00:47 +00:00
• 51d2385b21 disable stig for now Audiobuzz 2026-06-19 02:45:39 +00:00
• 72e57174c6 disable stig for now Audiobuzz 2026-06-19 02:05:51 +00:00
• bc8247b410 Add audit log sending Audiobuzz 2026-06-19 00:20:34 +00:00
• 5e2bfef575 Add banner and debug shell Audiobuzz 2026-06-19 00:06:39 +00:00
• 6608818902 Fix stig over hardening of kiosk account Audiobuzz 2026-06-18 13:28:01 +00:00
• 215b0eb10c Merge branch 'main' into app Audiobuzz 2026-06-18 21:37:33 +09:30
• d192ac0215 Merge pull request 'hardening' (#3) from hardening into main audiobuzz 2026-06-18 12:05:16 +00:00
• 3b776dd970 Add app Audiobuzz 2026-06-18 12:03:45 +00:00
• ada4aa4b18 Add STIG hrdening Audiobuzz 2026-06-18 10:00:41 +00:00
• 210ab9283d Merge branch 'main' into plymouth Audiobuzz 2026-06-18 19:09:30 +09:30
• c6a9671fae Merge pull request 'plymouth-working' (#2) from plymouth-working into main audiobuzz 2026-06-18 09:38:48 +00:00
• a53357216d Add ntp time source and browser policy Audiobuzz 2026-06-18 09:35:58 +00:00
• 8f8e24ac28 Update boot theme Audiobuzz 2026-06-18 08:41:22 +00:00
• 838ffd600b Lock down chromium policy Audiobuzz 2026-06-17 22:52:18 +00:00
• 0fdc7980cc Enable boot splash Audiobuzz 2026-06-17 22:21:08 +00:00
• de0c832fb4 Merge branch 'main' into plymouth Audiobuzz 2026-06-17 23:59:25 +09:30
• 3ef34745c9 Adding Plymouth Audiobuzz 2026-06-17 14:28:27 +00:00
• 82d029ded2 Merge pull request 'Network Manager refactor' (#1) from network-manager into main audiobuzz 2026-06-17 14:27:42 +00:00
• 55aa517976 Network Manager refactor Audiobuzz 2026-06-17 13:40:28 +00:00
• 4b0e0135b3 Fix kiosk mode Audiobuzz 2026-06-17 13:20:52 +00:00
• fd84ba4180 Turn off kiosk by default Audiobuzz 2026-06-17 12:44:07 +00:00
• d483cbae98 Tidy up docs that are not needed Audiobuzz 2026-06-17 11:37:00 +00:00
• efd756df6c Reducing size with late cleanup Audiobuzz 2026-06-17 10:59:48 +00:00