diff --git a/.github/dependabot.yml b/.github/dependabot.yml index db7b71b..4e73c6b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,3 +13,17 @@ updates: interval: "weekly" commit-message: prefix: "chore" + + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "weekly" + commit-message: + prefix: "chore" + + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + commit-message: + prefix: "chore" diff --git a/.github/renovate.json b/.github/renovate.json new file mode 100644 index 0000000..a13105e --- /dev/null +++ b/.github/renovate.json @@ -0,0 +1,28 @@ +{ + "extends": ["config:recommended"], + "automerge": false, + "timezone": "Europe/Amsterdam", + "labels": ["dependencies"], + "schedule": ["before 3am on Monday"], + "prHourlyLimit": 2, + "prConcurrentLimit": 5, + "packageRules": [ + { + "managers": ["gomod"], + "groupName": "go modules", + "schedule": ["before 3am on Monday"] + }, + { + "managers": ["pip"], + "groupName": "python packages", + "schedule": ["before 3am on Monday"] + }, + { + "managers": ["github-actions"], + "groupName": "github actions", + "automerge": true, + "automergeType": "minor", + "schedule": ["before 3am on Monday"] + } + ] +} diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 0000000..a391c00 --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,36 @@ +name: "CodeQL Analysis" + +on: + push: + branches: [ main, development ] + pull_request: + branches: [ main, development ] + schedule: + - cron: '0 3 * * 0' + +permissions: + contents: read + security-events: write + actions: read + +jobs: + analyze: + name: Analyze (python) + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Initialize CodeQL + uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + with: + languages: python + + - name: Autobuild + uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + with: + category: "/language:python" diff --git a/.github/workflows/hugo.yml b/.github/workflows/hugo.yml index 4b1722b..e3ed008 100644 --- a/.github/workflows/hugo.yml +++ b/.github/workflows/hugo.yml @@ -22,22 +22,23 @@ jobs: build: runs-on: ubuntu-latest env: - HUGO_VERSION: 0.152.2 + HUGO_VERSION: 0.160.0 steps: - name: Install Hugo CLI - run: | - wget -O ${{ runner.temp }}/hugo.deb https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-amd64.deb \ - && sudo dpkg -i ${{ runner.temp }}/hugo.deb + uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0 + with: + hugo-version: '0.160.1' + extended: true - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: submodules: recursive fetch-depth: 0 - name: Setup Pages id: pages - uses: actions/configure-pages@v6 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6 - name: Build with Hugo env: @@ -51,7 +52,7 @@ jobs: --baseURL "${{ steps.pages.outputs.base_url }}/" - name: Upload artifact - uses: actions/upload-pages-artifact@v4 + uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4 with: path: ./public @@ -64,4 +65,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5 diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 907cc01..1db37d3 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -34,7 +34,7 @@ jobs: name: Markdown lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: DavidAnson/markdownlint-cli2-action@ce4853d43830c74c1753b39f3cf40f71c2031eb9 # v23.0.0 with: globs: "content/**/*.md" @@ -44,8 +44,8 @@ jobs: name: Python security (bandit) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: actions/setup-python@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.x" - run: pip install bandit @@ -57,7 +57,7 @@ jobs: name: No PNG/JPG in static/images runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Find non-AVIF images id: check @@ -78,7 +78,7 @@ jobs: - name: Post PR comment if: steps.check.outputs.found == 'true' - uses: actions/github-script@v8 + uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 env: FILES: ${{ steps.check.outputs.files }} ACTOR: ${{ github.event.pull_request.user.login }} @@ -128,7 +128,7 @@ jobs: name: EN/NL file parity runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Check every .md has a matching .nl.md run: | missing="" @@ -154,7 +154,7 @@ jobs: env: HUGO_VERSION: 0.152.2 steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: submodules: recursive fetch-depth: 0 @@ -170,7 +170,7 @@ jobs: TZ: Europe/Amsterdam run: hugo --gc --minify --baseURL "http://localhost/" - name: Upload built site - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: hugo-public path: public/ @@ -182,7 +182,7 @@ jobs: runs-on: ubuntu-latest needs: hugo-build steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: hugo-public path: public/ @@ -203,7 +203,7 @@ jobs: if: always() needs: [pr-title, bilingual, image-format, hugo-build, link-check] steps: - - uses: actions/github-script@v8 + - uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 env: RESULT_PR_TITLE: ${{ needs.pr-title.result }} RESULT_BILINGUAL: ${{ needs.bilingual.result }} diff --git a/.github/workflows/python-checks.yml b/.github/workflows/python-checks.yml new file mode 100644 index 0000000..cd60289 --- /dev/null +++ b/.github/workflows/python-checks.yml @@ -0,0 +1,32 @@ +name: Python Checks + +on: + push: + branches: [ main, development ] + pull_request: + branches: [ main, development ] + schedule: + - cron: '0 5 * * 0' + workflow_dispatch: + +jobs: + lint: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Set up Python + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + with: + python-version: '3.14' + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install flake8 bandit + + - name: Lint with flake8 + run: flake8 static/scripts/saxion-eduroam.py --max-line-length=120 + + - name: Security scan with bandit + run: bandit -r static/scripts/saxion-eduroam.py -ll diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml new file mode 100644 index 0000000..c9ef5f0 --- /dev/null +++ b/.github/workflows/trivy-scan.yml @@ -0,0 +1,30 @@ +name: "Trivy filesystem scan" + +on: + schedule: + - cron: '0 2 * * 0' + workflow_dispatch: + +permissions: + contents: read + security-events: write + +jobs: + trivy-scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Run Trivy filesystem scan + uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 + with: + scan-type: fs + severity: CRITICAL,HIGH + format: sarif + output: trivy-results.sarif + + - name: Upload Trivy results to GitHub Security tab + uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + if: always() + with: + sarif_file: trivy-results.sarif diff --git a/README.md b/README.md index c8b573f..3b75ab3 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,45 @@ CachyOS on the ASUS ROG Zephyrus G16 GA605WV (2024). My personal setup log: docu **Browse the full documentation site: [zephyrus-linux.stensel.nl](https://zephyrus-linux.stensel.nl/)** +## System information + +``` +❯ fish + .-------------------------: sten@Sten-Laptop + .+=========================. ---------------- + :++===++==================- :++- OS: CachyOS x86_64 + :*++====+++++=============- .==: Host: ROG Zephyrus G16 GA605WV_GA605WV (1.0) + -*+++=====+***++==========: Kernel: Linux 6.19.11-1-cachyos + =*++++========------------: Uptime: 3 hours, 49 mins + =*+++++=====- ... Packages: 1695 (pacman), 22 (flatpak) + .+*+++++=-===: .=+++=: Shell: fish 4.6.0 + :++++=====-==: -*****+ Display (LQ160R1JW02): 2560x1600 @ 1.33x in 16", 240 Hz [Built-in] + :++========-=. .=+**+. DE: GNOME 50.0 +.+==========-. . WM: Mutter (Wayland) + :+++++++====- .--==-. WM Theme: Adwaita + :++==========. :+++++++: Theme: Adwaita [GTK2/3/4] + .-===========. =*****+*+ Icons: Adwaita [GTK2/3/4] + .-===========: .+*****+: Font: Adwaita Sans (11pt) [GTK2/3/4] + -=======++++:::::::::::::::::::::::::-: .---: Cursor: Adwaita (24px) + :======++++====+++******************=. Terminal: GNOME Console 50.0 + :=====+++==========++++++++++++++*- Terminal Font: Adwaita Mono (11pt) + .====++==============++++++++++*- CPU: AMD Ryzen AI 9 HX 370 (24) @ 5.16 GHz + .===+==================+++++++: GPU 1: AMD Radeon 890M Graphics [Integrated] + .-=======================+++: GPU 2: NVIDIA GeForce RTX 4060 Max-Q / Mobile [Discrete] + .......................... Memory: 10.24 GiB / 28.98 GiB (35%) + Swap: 1.28 MiB / 28.98 GiB (0%) + Disk (/): 270.70 GiB / 951.85 GiB (28%) - btrfs + Local IP (wlan0): 192.168.0.72/24 + Battery (A32-K55): 100% [AC Connected] + Locale: en_US.UTF-8 + + + +~ +❯ +``` + + ## About this project This is my personal setup log for running CachyOS on this laptop. I'm not a software engineer or developer: just someone who switched to Linux and ran into a lot of things that didn't work out of the box. I figured I'd write it all down so others don't have to go through the same trial and error I did. diff --git a/README.nl.md b/README.nl.md index 2dc1493..0f99dc9 100644 --- a/README.nl.md +++ b/README.nl.md @@ -7,6 +7,45 @@ CachyOS op de ASUS ROG Zephyrus G16 GA605WV (2024). Mijn persoonlijke setup-log: **Bekijk de volledige documentatiesite: [zephyrus-linux.stensel.nl](https://zephyrus-linux.stensel.nl/nl/)** +## Systeeminformatie + +``` +❯ fish + .-------------------------: sten@Sten-Laptop + .+=========================. ---------------- + :++===++==================- :++- OS: CachyOS x86_64 + :*++====+++++=============- .==: Host: ROG Zephyrus G16 GA605WV_GA605WV (1.0) + -*+++=====+***++==========: Kernel: Linux 6.19.11-1-cachyos + =*++++========------------: Uptime: 3 hours, 49 mins + =*+++++=====- ... Packages: 1695 (pacman), 22 (flatpak) + .+*+++++=-===: .=+++=: Shell: fish 4.6.0 + :++++=====-==: -*****+ Display (LQ160R1JW02): 2560x1600 @ 1.33x in 16", 240 Hz [Built-in] + :++========-=. .=+**+. DE: GNOME 50.0 +.+==========-. . WM: Mutter (Wayland) + :+++++++====- .--==-. WM Theme: Adwaita + :++==========. :+++++++: Theme: Adwaita [GTK2/3/4] + .-===========. =*****+*+ Icons: Adwaita [GTK2/3/4] + .-===========: .+*****+: Font: Adwaita Sans (11pt) [GTK2/3/4] + -=======++++:::::::::::::::::::::::::-: .---: Cursor: Adwaita (24px) + :======++++====+++******************=. Terminal: GNOME Console 50.0 + :=====+++==========++++++++++++++*- Terminal Font: Adwaita Mono (11pt) + .====++==============++++++++++*- CPU: AMD Ryzen AI 9 HX 370 (24) @ 5.16 GHz + .===+==================+++++++: GPU 1: AMD Radeon 890M Graphics [Integrated] + .-=======================+++: GPU 2: NVIDIA GeForce RTX 4060 Max-Q / Mobile [Discrete] + .......................... Memory: 10.24 GiB / 28.98 GiB (35%) + Swap: 1.28 MiB / 28.98 GiB (0%) + Disk (/): 270.70 GiB / 951.85 GiB (28%) - btrfs + Local IP (wlan0): 192.168.0.72/24 + Battery (A32-K55): 100% [AC Connected] + Locale: en_US.UTF-8 + + + +~ +❯ +``` + + ## Over dit project Dit is mijn persoonlijke setup-log voor CachyOS op deze laptop. Ik ben geen software-engineer of developer: gewoon iemand die naar Linux is overgestapt en daarna tegen van alles aanliep wat niet meteen werkte. Ik heb alles opgeschreven zodat anderen niet hetzelfde hoeven uitzoeken als ik. diff --git a/content/_index.md b/content/_index.md index 536d51f..81cdb7e 100644 --- a/content/_index.md +++ b/content/_index.md @@ -38,8 +38,8 @@ toc: false | **iGPU** | AMD Radeon 890M | | **dGPU** | NVIDIA GeForce RTX 4060 Laptop (Max-Q) | | **OS** | CachyOS (Arch) | -| **Kernel** | 6.19.8-1-cachyos | -| **Display Server** | Wayland (GNOME 49) | +| **Kernel** | 6.19.11-1-cachyos | +| **Display Server** | Wayland (GNOME 50) | | **CPU Scheduler** | scx_lavd (sched_ext) | | **Secure Boot** | Enabled | diff --git a/content/_index.nl.md b/content/_index.nl.md index 5a96bf7..5d95780 100644 --- a/content/_index.nl.md +++ b/content/_index.nl.md @@ -38,8 +38,8 @@ toc: false | **iGPU** | AMD Radeon 890M | | **dGPU** | NVIDIA GeForce RTX 4060 Laptop (Max-Q) | | **OS** | CachyOS (Arch) | -| **Kernel** | 6.19.8-1-cachyos | -| **Display Server** | Wayland (GNOME 49) | +| **Kernel** | 6.19.11-1-cachyos | +| **Display Server** | Wayland (GNOME 50) | | **CPU Scheduler** | scx_lavd (sched_ext) | | **Secure Boot** | Ingeschakeld | diff --git a/content/docs/applications.md b/content/docs/applications.md index 8e8eddf..eb99849 100644 --- a/content/docs/applications.md +++ b/content/docs/applications.md @@ -39,7 +39,7 @@ Nothing special here, just set the hostname via System Settings so the machine h ### GNOME window buttons: adding minimize & maximize back -By default, GNOME 49 only shows the close button. One command fixes it: +By default, GNOME 50 only shows the close button. One command fixes it: ```bash gsettings set org.gnome.desktop.wm.preferences button-layout 'appmenu:minimize,maximize,close' @@ -91,7 +91,7 @@ Using Just Perfection alone without the `gsettings` change may still leave edge ### Touchpad scroll speed: no native GNOME setting (yet) -As of GNOME 49, there is simply **no native setting** for touchpad scroll speed anywhere in the Settings panel. KDE Plasma has had this for years. There are merge requests open in [mutter](https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1840) and [GNOME Control Center](https://gitlab.gnome.org/GNOME/gnome-control-center/-/merge_requests/991) to add it, but they've been sitting there for years. See the [GNOME Discourse thread](https://discourse.gnome.org/t/adding-scroll-speed-setting-in-gnome/25893) for context. +As of GNOME 50, there is simply **no native setting** for touchpad scroll speed anywhere in the Settings panel. KDE Plasma has had this for years. There are merge requests open in [mutter](https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1840) and [GNOME Control Center](https://gitlab.gnome.org/GNOME/gnome-control-center/-/merge_requests/991) to add it, but they've been sitting there for years. See the [GNOME Discourse thread](https://discourse.gnome.org/t/adding-scroll-speed-setting-in-gnome/25893) for context. [libinput-config](https://github.com/lz42/libinput-config) by lz42 is a third-party workaround that intercepts libinput events and applies a scroll multiplier. diff --git a/content/docs/hardware/asusctl-rog-control.md b/content/docs/hardware/asusctl-rog-control.md index 79786a3..41b2f52 100644 --- a/content/docs/hardware/asusctl-rog-control.md +++ b/content/docs/hardware/asusctl-rog-control.md @@ -304,7 +304,7 @@ Known issues and troubleshooting for asusctl & ROG Control Center are documented ### Kernel 6.19: asus-armoury driver lands in mainline -The `asus-armoury` driver has been [merged into Linux 6.19](https://www.phoronix.com/news/ASUS-Armoury-Driver-Linux-6.19). This new `platform/x86` driver replaces parts of the older `asus-wmi` with a cleaner sysfs-based API, enabling panel mode switching, APU memory allocation, PPT tuning, and more directly from the kernel. The driver is entirely community-developed by the [asus-linux team](https://asus-linux.org/), with no involvement from ASUS themselves. CachyOS ships kernel 6.19.8-1-cachyos which includes this driver and additional ASUS-specific patches. +The `asus-armoury` driver has been [merged into Linux 6.19](https://www.phoronix.com/news/ASUS-Armoury-Driver-Linux-6.19). This new `platform/x86` driver replaces parts of the older `asus-wmi` with a cleaner sysfs-based API, enabling panel mode switching, APU memory allocation, PPT tuning, and more directly from the kernel. The driver is entirely community-developed by the [asus-linux team](https://asus-linux.org/), with no involvement from ASUS themselves. CachyOS ships kernel 6.19.11-1-cachyos which includes this driver and additional ASUS-specific patches. **Before**: basic asusctl controls without Armoury settings: diff --git a/content/docs/known-issues.md b/content/docs/known-issues.md index d31a9a9..95ae14d 100644 --- a/content/docs/known-issues.md +++ b/content/docs/known-issues.md @@ -396,7 +396,7 @@ This issue has since resolved itself. Steam now launches normally; the `__GL_CON ROG Control Center shows a warning that the `asus-armoury` kernel driver is not loaded. Some advanced features (PPT power limits, APU memory allocation, MUX switch control) are unavailable. **Cause:** -The `asus-armoury` driver was merged into the Linux mainline kernel in version 6.19. CachyOS ships kernel 6.19.8-1-cachyos which includes this driver, so it should be available. +The `asus-armoury` driver was merged into the Linux mainline kernel in version 6.19. CachyOS ships kernel 6.19.11-1-cachyos which includes this driver, so it should be available. **Fix:** Verify the driver is loaded: diff --git a/content/docs/known-issues.nl.md b/content/docs/known-issues.nl.md index 94647e5..9f1bdfc 100644 --- a/content/docs/known-issues.nl.md +++ b/content/docs/known-issues.nl.md @@ -396,7 +396,7 @@ Dit probleem heeft zichzelf opgelost. Steam start nu gewoon op; de `__GL_CONSTAN ROG Control Center toont een melding dat de `asus-armoury` kerneldriver niet is geladen. Geavanceerde functies (PPT-vermogensgrenzen, APU-geheugenallocatie, MUX-switchbesturing) zijn niet beschikbaar. **Oorzaak:** -De `asus-armoury`-driver is samengevoegd in de Linux mainline-kernel in versie 6.19. CachyOS levert kernel 6.19.8-1-cachyos inclusief deze driver, dus hij zou beschikbaar moeten zijn. +De `asus-armoury`-driver is samengevoegd in de Linux mainline-kernel in versie 6.19. CachyOS levert kernel 6.19.11-1-cachyos inclusief deze driver, dus hij zou beschikbaar moeten zijn. **Fix:** Verifieer dat de driver is geladen: diff --git a/content/docs/networking/eduroam-network-installation.md b/content/docs/networking/eduroam-network-installation.md index b7373f1..401200a 100644 --- a/content/docs/networking/eduroam-network-installation.md +++ b/content/docs/networking/eduroam-network-installation.md @@ -59,13 +59,13 @@ A Python script automates the full `nmcli` connection setup for Saxion: curl -LO https://zephyrus-linux.stensel.nl/scripts/saxion-eduroam.py # 2. Verify checksum -echo "8dd2f2120ddebdfd9d764e04954322307dccb8c855c691de7600f2a8a71db42b saxion-eduroam.py" | sha256sum -c +echo "f16ee75885b02fc773d96b28d7749ec48ee7e330814ccf58189c5da44db7eece saxion-eduroam.py" | sha256sum -c # 3. Run python3 saxion-eduroam.py ``` -**SHA256:** `8dd2f2120ddebdfd9d764e04954322307dccb8c855c691de7600f2a8a71db42b` +**SHA256:** `f16ee75885b02fc773d96b28d7749ec48ee7e330814ccf58189c5da44db7eece` The script removes any existing eduroam profile, prompts for your **username** via a GUI dialog (zenity, kdialog, or yad) or terminal fallback, and activates the connection. Your password is never asked by the script; it is requested by your GNOME Keyring at connection time and stored securely, never in plaintext. diff --git a/content/docs/networking/eduroam-network-installation.nl.md b/content/docs/networking/eduroam-network-installation.nl.md index f20586f..7f82359 100644 --- a/content/docs/networking/eduroam-network-installation.nl.md +++ b/content/docs/networking/eduroam-network-installation.nl.md @@ -59,13 +59,13 @@ Een Python-script automatiseert de volledige `nmcli`-verbindingsconfiguratie voo curl -LO https://zephyrus-linux.stensel.nl/scripts/saxion-eduroam.py # 2. Controleer de checksum -echo "8dd2f2120ddebdfd9d764e04954322307dccb8c855c691de7600f2a8a71db42b saxion-eduroam.py" | sha256sum -c +echo "f16ee75885b02fc773d96b28d7749ec48ee7e330814ccf58189c5da44db7eece saxion-eduroam.py" | sha256sum -c # 3. Uitvoeren python3 saxion-eduroam.py ``` -**SHA256:** `8dd2f2120ddebdfd9d764e04954322307dccb8c855c691de7600f2a8a71db42b` +**SHA256:** `f16ee75885b02fc773d96b28d7749ec48ee7e330814ccf58189c5da44db7eece` Het script verwijdert een eventueel bestaand eduroam-profiel, vraagt je **gebruikersnaam** via een GUI-dialoog (zenity, kdialog of yad) of terminal-fallback, en activeert de verbinding. Je wachtwoord wordt nooit door het script gevraagd; dat wordt bij het verbinden opgevraagd door je GNOME Keyring en veilig opgeslagen, nooit in platte tekst. diff --git a/go.mod b/go.mod index 6a5d915..982a6d6 100644 --- a/go.mod +++ b/go.mod @@ -2,4 +2,4 @@ module github.com/Stensel8/Zephyrus-Linux go 1.26 -require github.com/imfing/hextra v0.12.0 // indirect +require github.com/imfing/hextra v0.12.1 // indirect diff --git a/go.sum b/go.sum index 4f6a829..a889b91 100644 --- a/go.sum +++ b/go.sum @@ -1,2 +1,2 @@ -github.com/imfing/hextra v0.12.0 h1:f6y35hW/WDJEcx9S0dOmbICOBxYE0PmP6IJFsTUgVyY= -github.com/imfing/hextra v0.12.0/go.mod h1:YAv8XRNSmcqjieFwI7fVQK1AoY2Do+45DO9HGqxSGu4= +github.com/imfing/hextra v0.12.1 h1:3t1n0bmJbDzSTVfht93UDcfF1BXMRjeFojA071ri2l8= +github.com/imfing/hextra v0.12.1/go.mod h1:vi+yhpq8YPp/aghvJlNKVnJKcPJ/VyAEcfC1BSV9ARo= diff --git a/static/images/system-info.avif b/static/images/system-info.avif index 6652199..cf799b4 100644 Binary files a/static/images/system-info.avif and b/static/images/system-info.avif differ diff --git a/static/scripts/saxion-eduroam.py b/static/scripts/saxion-eduroam.py index a00b240..2b3f4a0 100644 --- a/static/scripts/saxion-eduroam.py +++ b/static/scripts/saxion-eduroam.py @@ -39,32 +39,64 @@ "Click OK to continue." ) + class Installer: + def __init__(self, silent: bool = False, username: str = ""): self.silent = silent self.username = username self.gui_tool = self._detect_gui() - + def _detect_gui(self) -> str | None: """Detects available GUI tools (zenity, kdialog, yad).""" if not os.environ.get("DISPLAY") and not os.environ.get("WAYLAND_DISPLAY"): return None - + for tool in ["zenity", "kdialog", "yad"]: if shutil.which(tool): return tool return None + def _sanitize_for_log(self, text: str) -> str: + """ + Sanitize text to remove potential sensitive information before logging. + Masks usernames, passwords, and other sensitive data. + """ + # Mask Saxion usernames (e.g., user@saxion.nl) + text = re.sub( + r'\b[a-zA-Z0-9._-]+@([a-zA-Z0-9-]+\.)*saxion\.nl\b', + '[REDACTED]', + text, + flags=re.IGNORECASE + ) + # Mask generic email addresses + text = re.sub( + r'\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\b', + '[REDACTED]', + text, + flags=re.IGNORECASE + ) + # Mask passwords (generic pattern) + text = re.sub( + r'\bpassword[=: ]*[^\s]+', + 'password=[REDACTED]', + text, + flags=re.IGNORECASE + ) + return text + def show_message(self, text: str, is_error: bool = False): if self.silent: if is_error: - print(f"Error: {text}", file=sys.stderr) + sanitized_text = self._sanitize_for_log(text) + print(f"Error: {sanitized_text}", file=sys.stderr) else: - print(text) + sanitized_text = self._sanitize_for_log(text) + print(sanitized_text) return if not self.gui_tool: - print(f"\n{text}\n") + print(f"\n{self._sanitize_for_log(text)}\n") return cmd = [] @@ -76,7 +108,7 @@ def show_message(self, text: str, is_error: bool = False): cmd = ["kdialog", type_flag, text, f"--title={TITLE}"] elif self.gui_tool == "yad": image = "dialog-error" if is_error else "dialog-information" - cmd = ["yad", f"--image={image}", "--button=OK", "--width=500", + cmd = ["yad", f"--image={image}", "--button=OK", "--width=500", f"--title={TITLE}", f"--text={text}"] subprocess.run(cmd, stderr=subprocess.DEVNULL) @@ -101,7 +133,7 @@ def prompt_input(self, prompt: str, is_password: bool = False) -> str | None: res = subprocess.run(cmd, capture_output=True, text=True) if res.returncode != 0: return None - + val = res.stdout.strip() # Yad sometimes adds a trailing separator if self.gui_tool == "yad" and val.endswith("|"): @@ -151,12 +183,16 @@ def run_nmcli(self, cmd: list[str]) -> bool: return False # Log full nmcli error to stderr (terminal only — never into GUI subprocess args). - print(f"NetworkManager error:\n{res.stderr.strip()}", file=sys.stderr) + sanitized_error = self._sanitize_for_log(res.stderr.strip()) + print(f"NetworkManager error:\n{sanitized_error}", file=sys.stderr) # Fatal error: show a static message to the GUI to avoid passing # nmcli output (which may echo user input) into a subprocess argument # (CWE-78 / CodeQL py/command-line-injection). - self.show_message("NetworkManager failed to configure the connection.\nSee terminal output for details.", True) + self.show_message( + "NetworkManager failed to configure the connection.\n" + "See terminal output for details.", True + ) sys.exit(1) return True @@ -169,12 +205,14 @@ def install(self): sys.exit(1) self.get_credentials() - + ca_path = self.find_system_ca_bundle() - + # 1. Remove any existing eduroam connection - subprocess.run(["nmcli", "connection", "delete", CON_NAME], - capture_output=True) + subprocess.run( + ["nmcli", "connection", "delete", CON_NAME], + capture_output=True + ) # 2. Build nmcli command for new connection cmd = [ @@ -198,7 +236,7 @@ def install(self): if ca_path: cmd_secure = cmd + ["802-1x.ca-cert", ca_path] success = self.run_nmcli(cmd_secure) - + # Fallback if CA fails or is not found (still secure via domain suffix validation) if not success: print("Note: Using system default trust store (implicit validation).") @@ -207,21 +245,30 @@ def install(self): # Show explanation before attempting connection so the password prompt makes sense self.show_message( - f"Username '{self.username}' added.\n\n" + "eduroam profile created successfully.\n\n" "Your password will now be requested by your desktop keyring (e.g. GNOME Keyring).\n" "This is normal and ensures your password is stored securely encrypted, never in plaintext.\n\n" "If you do not see a password prompt, open your network settings and connect to eduroam manually." ) # Attempt to activate the connection and show only relevant output - res = subprocess.run(["nmcli", "connection", "up", CON_NAME], capture_output=True, text=True) + res = subprocess.run( + ["nmcli", "connection", "up", CON_NAME], + capture_output=True, + text=True + ) if res.returncode == 0: - print("[INFO] Connection attempt started. If you entered your password, you should be connected to eduroam.") + print( + "[INFO] Connection attempt started. If you entered your " + "password, you should be connected to eduroam." + ) else: print("[ERROR] Could not activate eduroam connection:") print(res.stderr.strip() or res.stdout.strip()) + def main(): + parser = argparse.ArgumentParser(description="Saxion eduroam Installer") parser.add_argument("-u", "--username", help="Saxion username") parser.add_argument("--silent", action="store_true", help="Run without GUI") @@ -240,5 +287,6 @@ def main(): installer = Installer(args.silent, initial_username) installer.install() + if __name__ == "__main__": main()