aboutsummaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2024-12-21nix: filter nix files from srcOphestra
This prevents constant rebuilds when debugging integration tests. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-21nix: test dbus proxyOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-21nix: background go testOphestra
Go test takes significant time. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-21nix: remove workspace switchingOphestra
Switching workspaces does not test anything and introduces unnecessary wait time. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-21fortify: config/state pretty-print subcommandOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-20system: implement Enablements String methodOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-20state: store join utilOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-20release: 0.2.5Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-20migrate to git.gensokyo.uk/security/fortifyOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-19state: expose aids and use instance id as keyOphestra Umiker
Fortify state store instances was specific to aids due to outdated design decisions carried over from the ego rewrite. That no longer makes sense in the current application, so the interface now enables a single store object to manage all transient state. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-19fst: implement app id parserOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-19state: rename simple store implementationOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-19fortify: remove systemd checkOphestra Umiker
This is no longer necessary as fortify no longer integrates with external user switchers. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-19acl: use test-managed tmpdirOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18release: 0.2.4Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18workflows: cache nix storeOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18workflows: cache apt packagesOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18workflows: upload nixos test outputOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18workflows: build and upload test distributionOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18cmd/fshim: switch to setup pipeOphestra Umiker
The socket-based approach is no longer necessary as fsu allows extra files and sudo compatibility is no longer relevant. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18cmd/fshim: switch to generic setup funcOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18proc: setup payload sendOphestra Umiker
Generic setup payload encoder adapted from fshim. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18cmd/finit: switch to generic receive funcOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18proc: setup payload receiveOphestra Umiker
Generic implementation of setup payload receiver adapted from finit. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18fst: rename from fipcOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18nix: increase cpu countOphestra Umiker
This improves performance, especially when kvm is inaccessible. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18nix: collect fortify ps outputOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18fipc: export config structOphestra Umiker
Also store full config as part of state. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18nix: check acl rollbackOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17nix: run Go tests in nixosOphestra Umiker
Nix build environment does not support ACLs in any filesystem. This allows acl tests to run. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17release: 0.2.3Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17dist: generate distribution tarballOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17nix: rename nixos testOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17cmd/fsu: check uid range before syscallOphestra Umiker
This limits potential exploits to the fortify uid range. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17xcb: refactor and clean upOphestra Umiker
No clean way to write Go tests for this package. Will rely on NixOS tests for now. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17nix: test x11 permissive defaultsOphestra Umiker
Also invoke glinfo/wayland-info as part of tests. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17workflows: set action namesOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-17workflows: invoke nix flake checksOphestra Umiker
Integration tests are implemented as nix flake checks. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-16nix: permissive defaults nixos testOphestra Umiker
Adapted from nixos sway integration tests. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-16nix: implement flake checksOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-16nix: skip acl testOphestra Umiker
The nix build environment does not support ACLs. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-16acl: create test file in tmpdirOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-16acl: refactor and clean upOphestra Umiker
Move all C code to c.go, switch to pkg-config, set up finalizer for acl. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-16acl: add testsOphestra Umiker
These tests test UpdatePerm correctness by parsing getfacl output. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-07release: 0.2.2Ophestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-07nix: require /etc/userdb nix-daemonOphestra Umiker
There seems to be some kind of credential caching in nix-daemon. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-07cmd/fuserdb: rename home directoriesOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-07nix: rename home directoriesOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-07system: prevent duplicate Wayland opOphestra Umiker
Wayland is implemented as an Op to enforce dependency and cleanup, its implementation does not allow multiple instances on a single sys object, nor would doing that make any sense. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-06update README documentOphestra Umiker
A lot of this information is no longer true since fsu. Remove them for now and write up proper documentation later. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-05 06:12:58 +0000