v0.10.0

removed

• Debian 12 (bookworm) and LMDE 6 (faye) are no longer supported, as Debian
  12 has reached end of life. lrcm now refuses to run on them (exit code 1),
  and CI no longer tests Debian 12. Python 3.11 was only covered through those
  two, so it is no longer listed as tested: an interpreter of that series logs
  a warning but keeps running.

v0.9.0

Reworked logging, and widened the supported platforms to every current Debian,
Ubuntu and Fedora release - each one actually exercised in CI.

added

• Ubuntu 22.04 LTS, Fedora 43 and Fedora 44 are now supported, and
  Linux Mint's 22 series (22, 22.1, 22.2, 22.3, …) matches as a whole.
• Fedora is verified in CI by running lrcm straight from the checkout, since
  there is no .rpm yet. The CI matrix now covers seven containers: Debian
  12/13, Ubuntu 22.04/24.04/26.04 from the built .deb, plus Fedora 43/44 from
  source.
• Each supported distribution records either the container image CI proves it
  in, or the distribution it is a rebuild of. A unit test fails if that table
  ever disagrees with .github/workflows/ci.yml, so the support claim cannot
  drift away from what is actually tested.
• CI now also applies the matching client-setup/ playbook inside every
  container, so those playbooks are verified rather than merely linted.
• Python 3.14.6 (Fedora) added to the tested versions.

changed

• Log records now carry a date and time. The format is RFC 3339 with the
  local UTC offset and milliseconds - 2026-08-16T09:12:34.567+02:00 - because
  logging's own %(asctime)s emits neither the T separator nor any
  timezone, and lines from machines in different timezones cannot be ordered
  without one. Level names are padded so messages line up.
• Diagnostics moved from stdout to stderr, which is where the Unix
  convention and logging's own default put them. lrcm writes nothing to
  stdout. Anything redirecting lrcm >file should redirect 2> instead.
• Ansible's output is now logged at debug level, one record per line, with
  blank separator lines dropped. It previously came out at info level, so -v
  drowned lrcm's own progress in ansible chatter and printed timestamped empty
  records - and it contradicted --debug's documented "including ansible
  output".
• --syslog now uses the daemon facility and deliberately omits the
  timestamp, since syslog and journald add their own.
• configure_logging() clears existing handlers, so calling it twice no longer
  duplicates every line.
• The "distribution is supported" message says how that support was verified
  instead of repeating the distribution name twice.
• The Fedora client-setup playbook uses ansible.builtin.dnf5. Fedora 41 and
  later ship dnf5, whose bindings are installed by default, while
  ansible.builtin.dnf needs the dnf4 bindings such a system no longer has.

fixed

• The generated cron command was never shell-quoted. --configfile is
  operator-supplied and lands verbatim in /etc/cron.d/lrcm_*, which cron
  hands to /bin/sh; a config path containing a space installed a permanently
  broken root cron entry, and one containing ; appended a second command.
  Both paths now go through shlex.quote.
• A pre-release version sorted above the final release. SemVer says
  1.0.0-rc.1 precedes 1.0.0; dpkg said the opposite, because - starts the
  Debian revision. The build now converts it to 1.0.0~rc.1, which sorts
  correctly, so release-candidate machines will accept the final release
  instead of treating it as a downgrade. The release workflow's pre-release
  detection also matched only -rc, so -beta or -alpha tags were published
  as stable.
• An unexpected exception exited with status 1, which this program documents as
  "configuration error", and bypassed logging entirely. It is now reported as a
  runtime failure through the logger.
• The random start delay could never reach the configured maximum, because
  randrange excludes its upper bound while the option is documented as
  0..n.
• tests/check-version-consistency.sh piped sed into head under
  set -o pipefail, which can abort on SIGPIPE, and is now portable POSIX awk
  rather than relying on gawk extensions.

security

• A redacting log filter now strips the git token from every record, installed
  on the handlers rather than at each call site. A handler-level filter sees
  everything that reaches the sink, which a logger-level one does not. This
  closes the sink no call site covered: the playbook output passed through from
  ansible.
• The syslog handler is capped at info level, so --debug --syslog no longer
  pushes every line of ansible output into the system log.

packaging

• The .deb now passes lintian --fail-on error,warning, and CI enforces it.
  Two tags are overridden with written justification: dir-or-file-in-opt
  (FHS 3.0 §3.13 reserves /opt for exactly this kind of add-on package;
  Debian Policy forbids it only for packages in the archive) and the 0700
  mode on /etc/lrcm, which is deliberate because the directory holds a token.
• /usr/share/doc/lrcm/changelog.gz is a proper Debian-format changelog as
  Policy 12.7 requires; the markdown one ships beside it as changelog.md.gz.
• Added a manual page, lrcm(1), which Policy 12.1 expects for a program in
  /usr/bin.
• The configuration template moved from /etc/lrcm/lrcm.conf.template to
  /usr/share/lrcm/lrcm.conf.template. A file in /etc that dpkg does not
  know as a conffile violates Policy 10.7; postinst seeds
  /etc/lrcm/lrcm.conf from the new location exactly as before.
• Depends is a single line, and the description synopsis capitalises Linux.

removed

• Fedora 39 is no longer listed. It reached end of life in May 2024 and its
  packages are gone from the mirrors, so the entry promised something that
  could not work.

repository

• A Makefile is now the single entry point: make check runs exactly what CI
  runs, so the README can stop listing six commands that drifted out of step
  with the pipeline.
• Added SECURITY.md with a private disclosure channel and, more usefully, a
  written statement of what lrcm assumes about its environment - notably that
  write access to the playbook repository is root access to the fleet.
• ruff now enforces pydocstyle (PEP 257), pep8-naming (PEP 8, including the
  Error suffix rule that renamed RuntimeFailure to StepFailedError),
  blind-except and pylint rules. from __future__ import annotations is gone,
  since PEP 604 unions are native in the Python 3.10 this project requires, and
  __version__ sits where PEP 8 puts module dunders.
• The licence is declared as an SPDX expression per PEP 639.

v0.7.4

Merge pull request #8 from 72itde/flo-development

bugfix release

v0.7.0

Merge pull request #5 from 72itde/flo-development

release 0.6.0

v0.6.0: Merge pull request #5 from 72itde/flo-development

release 0.6.0

v0.4: Merge pull request #4 from 72itde/flo-development

fix wrong default configfile

v0.3: Merge pull request #3 from 72itde/flo-development

rename project, release version 0.3

v0.2

Merge pull request #2 from 72itde/flo-development

First tested release

v0.1

First working version. Feel free to test.