Skip to content

v0.4.2

Choose a tag to compare

View all tags
@pereljon pereljon released this 05 Aug 17:02
v0.4.2
2a1880e

Pre-freeze hardening from the v0.4 adversarial review, plus earlier cheap fixes.

Fixed

  • Apply-evidence (C2): removal-only / --reapply no longer accept a netplan try on elapsed time. No-addition changes have no in-kernel signal, so they now use a larger bounded settle floor (APPLY_NOEVIDENCE_SETTLE) sized so the first health sample lands post-apply; netplan try's exit is logged on both paths. Hardware-validated (accept at 18.19s on a genuine carrier-down removal).
  • Config isolation (H2): /etc/dynavlan.conf is now parsed declaratively against an allowlist, never sourced — a config line can no longer execute code or override an internal/safety variable (NETPLAN_FILE, TRY_TIMEOUT, ver, PATH, ...). Unknown/protected keys refuse the run.
  • Routed-mode default-route guard (C1): dynavlan refuses a reconcile that would remove the interface currently serving the default route (routed mode), before any disk change — preventing an unrevertable strand. No-op at the default VLAN_ROUTES=false.
  • --dry-run exit code (M3): now exits non-zero when validation fails.
  • Debian upgrade timer-state (H3): upgrades preserve the operator's enabled/active timer state instead of re-arming a deliberately-disabled timer.
  • Version binding (H7): build-deb.sh refuses to build when the requested version disagrees with the script's ver=.

Added

  • Public APT repository for apt-based install/upgrade.

Full detail: CHANGELOG.md.

Assets 3
Loading