Skip to content

Releases

PYLA v0.2.1

PYLA v0.2.1 Latest
Latest

Choose a tag to compare

View all tags
@dave0bit dave0bit released this 06 Nov 21:59
v0.2.1
30fe606

PYLA v0.2.1

  • New icon: the PYLA logo (amber shield with a gate, Material Symbols style) in the app, the desktop entry
    and the package icons.
  • Migration script (packaging/migrate-argo-to-pyla.sh, for machines that still run the old Argo build):
    fixed a self-invocation loop, --dry-run is accepted in any position, the legacy identifier is validated
    against an existing polkit policy, and an existing /var/lib/pyla is never overwritten.
  • README: generic migration instructions, packaging/make-deb.sh, IT/EN UI, updated roadmap.

No functional changes to the firewall logic, the helper protocol or the database schema.

Install

curl -LO https://github.com/pyla-dev/pyla/releases/download/v0.2.1/pyla_0.2.1_amd64.deb
curl -LO https://github.com/pyla-dev/pyla/releases/download/v0.2.1/pyla_0.2.1_amd64.deb.sha256
sha256sum -c pyla_0.2.1_amd64.deb.sha256
sudo apt install ./pyla_0.2.1_amd64.deb
Assets 5
Loading

PYLA v0.2.0

PYLA v0.2.0

Choose a tag to compare

View all tags
@dave0bit dave0bit released this 06 Nov 16:32
v0.2.0
60ea32f

PYLA 0.2.0 — first public release of the renamed project (previously Argo).

What's in this release

  • Rule sets: unlimited named sets in SQLite, per-rule enable/disable, reorder, duplicate, import from the live UFW state, atomic apply with automatic rollback and command preview.
  • Live nftables viewer: read-only view of the whole kernel ruleset (UFW, Docker, libvirt, kernel tables) with live packet/byte counters.
  • Exposure check (v3): evaluates TCP listeners (IPv4 and IPv6 assessed separately) against the live nft input chains, so a dual-stack listener on [::] is not masked by an IPv4 verdict.
  • CVE intelligence: Ubuntu Security API tracking for the exact running kernel, cached locally in SQLite (schema v2) with lazy background refresh.
  • Temporary mitigations: subsystem-level, fully reversible hardening (sysctl or kernel-module blocking) for still-unpatched kernel CVEs, with an exposure check before and after.
  • Privilege separation: the GUI runs as the user; root actions go through pyla-helper at a fixed path, authorised by the polkit action space.pyla.app.helper, executing binaries by absolute path with a cleared environment and never through a shell.

Packaging
pyla_0.2.0_amd64.deb installs /usr/bin/pyla, /usr/local/libexec/pyla/pyla-helper, the polkit policy /usr/share/polkit-1/actions/space.pyla.app.policy, the desktop entry space.pyla.app.desktop and icons; the licence is shipped at /usr/share/doc/pyla/copyright.

Upgrading from Argo? Run packaging/migrate-argo-to-pyla.sh before the first launch — see the README.

Verified on the build host: cargo build --workspace OK, cargo clippy --workspace --all-targets clean, cargo test --workspace -> 24 passed / 0 failed (3 --ignored live tests skipped).

Loading