Repository navigation
Tags
Tags
v1.0.84 Security & correctness (P0): - Refuse to send sudo password over SSM (CloudTrail leak); SSH host-key verification fails closed; bound-check Argon2 params (OOM DoS). - Evaluate changed_when/failed_when (were silent no-ops). - no_log + secret redaction across plan/apply output (text and JSON). Fleet features (P1): - Built-in set_fact, debug, fail, meta: flush_handlers. - become_user / become_method (sudo -u, su, doas). - Bastion / ProxyJump SSH support. - Rolling serial batches with any_errors_fatal / max_fail_percentage. UX (P2): - Quiet errors (no flag-wall), honest dry-run RECAP, --output disambiguation, APPLY phase banner, tack init on-ramp. Coverage (P3): - copy directory sync; apt pinning/hold/default_release; authorized_key module + user append/update_password; environment + until; loop results + loop_control; vault overrides play vars; expanded facts (mem/cpu/disk/virt/svc/selinux/tz); vault edit hardening; release toolchain pinned to Go 1.24.
fix(ssh): feed sudo password via StdinPipe to avoid EOF on fast commands Setting session.Stdin to a reader made session.Run copy stdin in a goroutine; when sudo authenticated and the wrapped command exited before stdin was fully consumed (e.g. the quick iptables availability probe), the remote closed the channel and the copy's Write returned io.EOF. Run surfaced that copy error instead of the real exit status, failing with "failed to execute command: EOF". Write the password through an explicit session.StdinPipe in a goroutine and swallow the (expected, benign) write error, keeping Run's error strictly about the command. Local exec is unaffected (os/exec already ignores EPIPE on stdin).
PreviousNext