coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity
Files
dfacfea37789cf6cee685df30554fae3aec2e43f
orca/internal
T
History
Jon Chery dfacfea377 fix(P03): txn apply path allowlist (REQ-121, F5) 
---ci---
project: orca
phase: 3
milestone: v0.12
status: execute
---/ci---

apply.sh python heredoc now validates every path in desired-state.json
against a prefix allowlist (/etc/orca/, /etc/traefik/orca*,
/etc/systemd/system/orca-*, /etc/nftables.d/orca*, /etc/syncthing/orca*).
Rejects with exit 7 on mismatch. Also rejects .. traversal and relative
paths. HMAC-signed manifest unchanged. 8 regression tests including
/etc/orca/../../shadow traversal attempt.
2026-08-07 10:56:25 +00:00
..
acl
feat(P02): ACL — SPIFFE + token identities, deny-by-default
2026-08-07 04:38:00 +00:00
audit
test(P03): coverage uplift — engine/transport/proxmox/audit ≥50% + dispatch.go EOF fix (REQ-055)
2026-08-04 00:18:58 +00:00
backup
feat(P04): backup/restore — signed tarball (HMAC-SHA256)
2026-08-07 04:55:27 +00:00
cache
feat(P00): CLI cache layer (R-008) — orca_cache SQLite + cache CLI
2026-08-07 04:17:25 +00:00
certpaths
feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)
2026-08-05 16:38:26 +00:00
cli
fix(P02): namespace path traversal (REQ-120, F4)
2026-08-07 10:55:18 +00:00
cluster
feat(P10): lead rules + step-ca integration (REQ-076)
2026-08-05 18:48:46 +00:00
config
feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)
2026-08-05 16:38:26 +00:00
daemon
feat(P00): deprecation sweep + bash tooling gate + render contract + doc banners (v0.9 P00)
2026-08-05 16:26:26 +00:00
doctor
fix(doctor): TOFU capture-fix parity with bootstrap — v0.6 ship-defect (T02.9)
2026-08-04 11:56:45 +00:00
drift
feat(P10b): drift detection (R-018/R-019/R-020, REQ-103..113)
2026-08-07 07:17:41 +00:00
emit
feat(P00): deprecation sweep + bash tooling gate + render contract + doc banners (v0.9 P00)
2026-08-05 16:26:26 +00:00
emitter
feat(P15.5): threat model (C-19) + ingress hybrid (R-017, REQ-099..102) + doctor mTLS (REQ-118)
2026-08-07 08:35:06 +00:00
engine
feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)
2026-08-07 05:17:01 +00:00
identity
feat(P01.5): SPIFFE SVID minting spike (REQ-076, gate C-08) — PASSES
2026-08-07 04:30:43 +00:00
jobspec
feat(P06): task groups — multi-process services, multiple systemd units per alloc
2026-08-05 18:20:05 +00:00
migration
feat(P14a): v0.8→v1.0 data migration (REQ-066, C-07) + orca upgrade (REQ-115, C-25, C-27)
2026-08-07 08:00:10 +00:00
model
feat(P05): drain + daemon drain-and-stop (REQ-061) + job migrate (REQ-116)
2026-08-07 05:17:01 +00:00
ns
fix(P02): namespace path traversal (REQ-120, F4)
2026-08-07 10:55:18 +00:00
osdetect
feat(P03): doctor os + doctor proxmox + audit logging
2026-08-03 19:59:51 +00:00
paths
feat(P02): ACL — SPIFFE + token identities, deny-by-default
2026-08-07 04:38:00 +00:00
proxmox
feat(P0a1): multi-namespace path resolver + config demotion + known_hosts flock + CA migration spec (v0.9 P0a1)
2026-08-05 16:38:26 +00:00
runtime
fix(P01): command injection in podman/wasm runtimes (REQ-119, F3)
2026-08-07 10:49:08 +00:00
scheduler
feat(P05): CLI-side scheduler + CEL constraints + affinity (REQ-083)
2026-08-05 18:02:51 +00:00
secrets
feat(P03): secrets subsystem (REQ-080) — AES-256-GCM + HKDF-SHA256 per-ns
2026-08-07 04:47:33 +00:00
security
feat(P0c): Job/Service/DaemonSet schemas + emitter interface + systemd stub (REQ-074)
2026-08-05 17:17:02 +00:00
spec/schema
feat(P06): task groups — multi-process services, multiple systemd units per alloc
2026-08-05 18:20:05 +00:00
sshpush
fix(P99): P0 heredoc command injection + ROADMAP/REQUIREMENTS reconciliation
2026-08-05 19:02:54 +00:00
stepca
feat(P10): lead rules + step-ca integration (REQ-076)
2026-08-05 18:48:46 +00:00
storage
feat(P09): Syncthing storage replication + conflict resolution (REQ-081; gates C-02, C-14)
2026-08-05 18:38:49 +00:00
store
feat(P06): alloc history (REQ-071) + logs --all-nodes (REQ-117)
2026-08-07 05:36:30 +00:00
transport
feat(P01): metrics endpoint — hand-rolled Prometheus text exposition
2026-08-07 04:24:57 +00:00
txn
fix(P03): txn apply path allowlist (REQ-121, F5)
2026-08-07 10:56:25 +00:00