Repository navigation
Daily reports while a machine is non-compliant. While the last check found a fail, or signs of compromise, the machine reports every 24h instead of every report.interval (e.g. weekly), so IT sees each day whether it was fixed; once the fails are gone it goes back to interval. Warnings alone ("attention") keep interval. Nothing to set: it is the default. Policy report.fail_interval changes it ("0" = always interval; at least 1h); setting that field needs v0.5.18 or later on every machine of the role. bordercheck status shows it.
bordercheck guard: a here-document (cmd <<'EOF' … EOF) is read as the data it is, not as commands, so a script whose text mentions export or env is no longer refused; $( ) and backticks in an unquoted one, and commands after it, are still checked.
Both release keys are still trusted (see v0.5.17); the next release is the first signed with the new key only.