v0.1.1

OSS 0.1.1

Your configuration, as a file you can carry — plus fixes for two sections that
turned out not to work at all.

Your config, as a portable file

Back up and restore the configuration files themselves. Not a list of
toggles — the actual files. Everything in /etc/sysctl.d, /etc/modprobe.d,
/etc/default/grub, /etc/pam.d, /etc/sudoers.d, your ufw rules, your audit
rules, and 14 more locations, including hand-made settings this app knows
nothing about. Set your machine up by hand over months, take it with you.

Both directions are per-category, because a config is not always portable in
one piece. Restoring onto a new machine with different usernames? Untick
/etc/sudoers.d and leave those rules behind. Different disks? Leave /etc/fstab
out. Every location is listed with what it holds, all ticked by default.

Restoring shows you exactly what would change first — which files would be
created, which replaced — then goes through the same transaction as an ordinary
Apply: the current file saved to .bak, visudo and sshd -t run on anything
they can check, and every file put back if any step fails.

Nothing about this needs the network, and the archive is a plain .tar.gz you
can open yourself.

Two sections that were broken

The firewall page could not read your rules if any of them named an
application profile — ufw allow CUPS, the documented way to open printing,
and CUPS ships on a stock Ubuntu desktop. The rule was misread as an address,
which failed validation and took the whole section with it. Worse, staging a
firewall change on such a machine could kill the helper mid-apply with files
already written and no rollback. Application-profile rules are now recognised,
shown read-only with the ufw delete command to remove them, and left alone
by the planner rather than guessed at.

Package removal never worked. The command carried --no-remove, which does
not mean "do not cascade" — it means "abort if anything would be removed",
i.e. every removal. It failed every time and rolled back the whole apply.

A machine hardened by hand now tells the truth

If you hardened your system yourself before installing this, it used to show
"281 in effect" with every switch off, because a switch meant "this app will
write this" rather than "this is on". A switch now reflects the live state
however it got that way. Settings owned by your own files cannot be switched
off here — this app has no claim on files it did not write — and the dashboard
now offers Capture to adopt them so it can.

The header counter and the dashboard's state rows are clickable and open the
matching filter, so "which 281?" has an answer.

Apply is harder to break

• sysctl --system re-applies every sysctl file on the machine and exits
  non-zero if any key anywhere fails. On a hand-hardened box, one toggle could
  fail the whole apply over the machine's own pre-existing config. Failures are
  now attributed: a key this app wrote still fails the transaction, anything
  else is recorded and tolerated, and the read-back step verifies our own keys
  regardless.
• An unexpected error mid-transaction could leave files written and not
  rolled back. Any exception now rolls back and is reported.
• A permissions change naming a user this machine does not have (syslog on a
  journald-only system, shadow outside Debian) is refused before the first
  write instead of failing part-way through.
• Critical units are refused for disable, not just mask — the command built
  is disable --now, which stops the unit just as dead.
• A file owned by an orphan uid no longer aborts the entire apply, and its
  ownership is preserved rather than quietly reassigned to root.
• The Apply-failed report can no longer size its window past your screen; the
  full error scrolls underneath.

Interface

• Sections open at the top instead of inheriting the previous section's scroll
  position.
• The strip at the bottom of a section lists every group as a working jump,
  replacing "three groups plus N more in this section", which looked like
  content you could not reach when everything was in fact above it.

Packaging

• dpkg-buildpackage builds now ship the icons, fonts and man page that
  tools/build-deb.sh always did.
• Both entry points prefer the tree they live in over /usr/share/oss, so
  running from a checkout no longer silently executes an installed copy.
• The reported version matches the package version.

Install

# Debian, Ubuntu and derivatives
sudo dpkg -i oss_0.1.1_all.deb

# Arch
sudo pacman -U oss-0.1.1-1-any.pkg.tar.gz

# Fedora, RHEL, openSUSE
sudo dnf install oss-0.1.1-1.noarch.rpm oss-fonts-0.1.1-1.noarch.rpm

Everything it needs ships with a stock desktop, so it installs on a machine
that has never been online.

Removing it

The package owns nothing under /etc and ships no removal scripts, so
uninstalling leaves your configuration exactly as it is. Note the other side of
that: removing the app does not undo anything it applied. Delete the drop-in
files, or restore a backup, if that is what you want.

Known limitations

• The Arch and RPM packages are built but untested on their target
  distros. Both were produced on Debian; their dependency lists have not been
  checked against a real Arch or Fedora. The .deb is the tested path.
• The fixes above are covered by the test suite (234 tests) against a sandbox
  root, not against a live apt, ufw or pkexec transaction on every
  distribution. If a section misbehaves, please open an issue with the
  Apply-failed detail — it is copyable now.
• Applying from a source checkout still does not work by design; the helper
  ships in the package.

Upgrading from 0.1.0: nothing to do. No configuration format changed, and
your existing drop-in files are read as they were.