Converge security.alerts on a running machine #36

Merged

marcos-mendez merged 2 commits from feat/converge-security-alerts into main

2026-09-29 04:26:31 -03:00

marcos-mendez commented

2026-09-29 04:16:40 -03:00

(Migrated from github.com)

Problem

Brief section 4, principle 1: apply converges and is safe to re-run. security.alerts was written once by the 85secalerts hook at first boot, and keel diff compared it from then on, so an alias changed behind the spec was drift that nothing could correct. First field of keel#35.

Fix

spec apply --system converges the two traces the hook leaves and inspect reads back:

the root: line of /etc/aliases, replaced in place or appended, other lines kept, then newaliases on the live system;
MAILON="output" and MAILTO="root" in /etc/cron-apt/config, in place, comments kept; a machine without cron-apt gets the alias only.

skip removes a root alias that mails off the machine and nothing else. An /etc/aliases that exists but cannot be read is refused. The planner reads through keel.inspect.security.root_alias, the reader inspect uses, so the two sides cannot disagree.

Not done, on purpose: registering the address with hub.turnkeylinux.org, which the hook does (brief 5.6).

Evidence

tests/test_system_security.py: 15 planner tests.
tests/test_apply_system_cli.py: on the fixture machine, an alias changed behind the spec is drift, apply --system-only --root converges it, diff is same at exit 0, and a second run makes 0 changes. The full inspect/apply/diff round trip now requires security.alerts to be same too.
1029 tests pass; branch coverage 100 percent.
0.5.0 in debian/changelog, pyproject.toml and keel/__init__.py.

## Problem Brief section 4, principle 1: `apply` converges and is safe to re-run. `security.alerts` was written once by the `85secalerts` hook at first boot, and `keel diff` compared it from then on, so an alias changed behind the spec was drift that nothing could correct. First field of keel#35. ## Fix `spec apply --system` converges the two traces the hook leaves and `inspect` reads back: - the `root:` line of `/etc/aliases`, replaced in place or appended, other lines kept, then `newaliases` on the live system; - `MAILON="output"` and `MAILTO="root"` in `/etc/cron-apt/config`, in place, comments kept; a machine without cron-apt gets the alias only. `skip` removes a root alias that mails off the machine and nothing else. An `/etc/aliases` that exists but cannot be read is refused. The planner reads through `keel.inspect.security.root_alias`, the reader `inspect` uses, so the two sides cannot disagree. Not done, on purpose: registering the address with hub.turnkeylinux.org, which the hook does (brief 5.6). ## Evidence - `tests/test_system_security.py`: 15 planner tests. - `tests/test_apply_system_cli.py`: on the fixture machine, an alias changed behind the spec is drift, `apply --system-only --root` converges it, `diff` is same at exit 0, and a second run makes 0 changes. The full inspect/apply/diff round trip now requires `security.alerts` to be same too. - 1029 tests pass; branch coverage 100 percent. - 0.5.0 in `debian/changelog`, `pyproject.toml` and `keel/__init__.py`.