Compare commits

..

36 Commits

Author SHA1 Message Date
Steven 3c51abe2e5 chore: update readme 2025-12-06 15:35:59 +00:00
Steven 02b1a9758c chore: readme changes 2025-12-06 15:23:53 +00:00
Steven d966acdf6c chore: fix version pin 2025-12-06 15:22:24 +00:00
Steven b9d74ae5ae feat: Alpine 3.23.0 2025-12-06 15:20:42 +00:00
Steven 2bed3fc0f7 chore: include latest version 2025-12-06 14:50:32 +00:00
Steven d4403aa37e refactor: remove -o because of commit 6cb3f8196c 2025-12-06 14:19:54 +00:00
Steven 2e3a6dbe55 refactor: bring back package-shifting
Ability to allow for more recent apk versions.
2025-12-06 14:09:20 +00:00
Burnett01 77cf0f30ae refactor: pin alpine 3.22.1 + remove --upgrade to avoid package drift 2025-12-02 18:14:43 +00:00
Burnett01 35c5778c2d refactor: bats tests to cover STRICT_HOSTKEYS_CHECKING + assert whole rsync command 2025-12-02 17:08:29 +00:00
Burnett01 09f62ba15b chore: force-upgrade alpine busybox to tackle CVE-2024-58251
See: https://github.com/Burnett01/rsync-deployments/security/code-scanning/15
2025-12-02 15:17:42 +00:00
Burnett01 6cb3f8196c refactor: SC3040 (warning): In POSIX sh, set option pipefail is undefined. 2025-12-02 15:15:01 +00:00
Burnett01 d4d84ba02c chore: upgrade alpine 3.22.2 2025-12-02 15:09:19 +00:00
Burnett01 bf2d964f6f fix: remove debug output of known_hosts file in entrypoint script 2025-12-02 14:52:50 +00:00
Burnett01 e0b7fb752e fix: replace tilde with $HOME for consistent path usage in scripts 2025-12-02 14:52:50 +00:00
Burnett01 61419b36d6 fix: remove debug output and known_hosts file display in entrypoint script 2025-12-02 14:52:50 +00:00
Burnett01 a1f741433d fix: remove debug output of known_hosts file in entrypoint script 2025-12-02 14:52:50 +00:00
Burnett01 bf4dca9d8e fix: replace echo with printf for consistent output formatting in hosts-add script 2025-12-02 14:52:50 +00:00
Burnett01 4369819153 debug 2025-12-02 14:52:50 +00:00
Burnett01 d4a9011612 fix: correct command substitution syntax for ssh-keyscan output processing 2025-12-02 14:52:50 +00:00
Burnett01 4b49843a52 fix: update strict host key checking to include known hosts file 2025-12-02 14:52:50 +00:00
Burnett01 1b2e963616 fix: filter out comments from ssh-keyscan output for strict host key checking 2025-12-02 14:52:50 +00:00
Burnett01 f85e1bae12 feat: add hosts-add script to manage SSH known hosts 2025-12-02 14:52:50 +00:00
Burnett01 8e8f89cdc5 feat: add host key verification and handling for strict host key checking 2025-12-02 14:52:50 +00:00
Burnett01 e9f72e6ef0 fix: use GITHUB_ACTION variable for SSH agent start in entrypoint script 2025-12-02 14:52:50 +00:00
Burnett01 055751bf9e fix: correct debug mode setting in entrypoint script 2025-12-02 14:52:50 +00:00
Burnett01 8bb0d8b3ce fix: correct debug mode setting in entrypoint script 2025-12-02 14:52:50 +00:00
Burnett01 7293bea8ec feat: add debug input to action and enable debug mode in entrypoint script 2025-12-02 14:52:50 +00:00
Burnett01 93eda1c97c fix: ensure proper initialization and cleanup of known hosts in entrypoint script 2025-12-02 14:52:50 +00:00
Burnett01 7b075b3367 feat: add hosts-clear and hosts-init scripts for managing known_hosts 2025-12-02 14:52:50 +00:00
Burnett01 c0170dd157 fix: correct variable name for INPUT_SWITCHES in rsync command execution 2025-12-02 14:52:50 +00:00
Burnett01 82725684f9 fix: replace exec with sh -c for rsync command execution in entrypoint script 2025-12-02 14:52:50 +00:00
Burnett01 7bf29be338 fix: remove unnecessary quotes around INPUT_SWITCHES in rsync command 2025-12-02 14:52:50 +00:00
Burnett01 069d4f1b5c fix: handle unset SSH_AGENT_PID variable in agent-start script 2025-12-02 14:52:50 +00:00
Burnett01 0fb32f477b fix: change SSH agent start argument to default in entrypoint script 2025-12-02 14:52:50 +00:00
Burnett01 844957283c fix: update Dockerfile to correct chmod command for agent scripts 2025-12-02 14:52:50 +00:00
Burnett01 9b1bf7278e feat: rsync-docker as first-party code, configureable strict host keys checking 2025-12-02 14:52:50 +00:00
8 changed files with 8 additions and 61 deletions
+1 -1
View File
@@ -5,7 +5,7 @@ RUN apk update && apk add --no-cache --upgrade rsync openssh openssl busybox
RUN rm -rf /var/cache/apk/*
COPY docker-rsync/* /bin/
RUN chmod +x /bin/agent-* /bin/ssh-* /bin/hosts-*
RUN chmod +x /bin/agent-*
FROM base AS build
+2 -8
View File
@@ -53,14 +53,14 @@ This action needs secret variables for the ssh private key of your key pair. The
For simplicity, we are using `REMOTE_*` as the secret variables throughout the examples.
## Current Version: v8 (8.0.2)
## Current Version: v8 (8.0.0)
### Release channels:
| Version | Purpose | Immutable |
| ------- | ------------------ | ------------------ |
| ``v8`` | latest release (pointer to 8.x.x) | no, points to latest MINOR,PATCH |
| 8.0.2 | latest major release | yes |
| 8.0.0 | latest major release | yes |
| 7.1.0 | previous release | yes |
Check [SECURITY.md](SECURITY.md) for support cycles.
@@ -277,12 +277,6 @@ sudo apk add rsync
## Versions
## Version 8.0.0 (EOL due to regression -> fixed via 8.0.1 & 8.0.2)
Check here:
- https://github.com/Burnett01/rsync-deployments/tree/8.0.0 (alpine 3.23.0)
## Version 7.1.0
Check here:
+1 -3
View File
@@ -8,9 +8,7 @@ The following versions are currently being supported with security updates:
| Version | Supported | Rsync version | Alpine version |
| ------- | ------------------ | ------------------ | ------------------ |
| 8.0.2 | :white_check_mark: | >= 3.4.1-r1 | 3.23.0 |
| 8.0.1 | :white_check_mark: | >= 3.4.1-r1 | 3.23.0 |
| 8.0.0 | :x: EOL (due to regression #90) | >= 3.4.1-r1 | 3.23.0 |
| 8.0.0 | :white_check_mark: | >= 3.4.1-r1 | 3.23.0 |
| 7.1.0 | :white_check_mark: | >= 3.4.1-r0 | 3.22.1 |
| 7.0.2 | :warning: DEPRECATED | >= 3.4.0-r0 | 3.22.1 |
| 7.0.1 | :x: EOL | < 3.4.0 | 3.22.1 |
-40
View File
@@ -1,40 +0,0 @@
# Scripts
Shell-scripts to help with managing SSH agents and known hosts files.
### SSH Management
#### ssh-init
This command create the ``$HOME/.ssh`` folder with default permissions ``700``.
### SSH-Agent Management
#### agent-start
This command starts the SSH agent, if it isn't already started (SSH_AGENT_PID set or ssh agent ID file found).
It takes one optional argument, for the name of the agent to be started. Defaults to "default".
This program needs to be source'd to work correctly.
`source agent-start "default"`
#### agent-stop
This command stops the SSH agent, if it is started (SSH_AGENT_PID set or ssh agent ID file found).
It takes one optional argument, for the name of the agent to be stopped. Defaults to "default".
`agent-stop "my-agent-name"`
#### agent-add
This command adds a key to the currently running SSH agent. The key is taken from stdin, and the agent used is that in SSH_AGENT_PID.
#### agent-askpass
This command is called by ssh-add when the [SSH_ASKPASS](https://man.openbsd.org/ssh-add.1#ENVIRONMENT) variable is set active. The command returns the SSH_PASS to [ssh-askpass(1)](https://man.openbsd.org/ssh-askpass.1).
This command is ignored by ssh-add if the key does not require a passphrase.
### known_hosts management
#### hosts-init
This command creates the known_hosts file (``$HOME/.ssh/known_hosts``) with default permission ``600``.
#### hosts-add
This command adds an entry to the known hosts file, and ensures its permissions are correct. It takes one argument, which is the new key to add.
#### hosts-clear
This command truncates the known_hosts file.
+1 -1
View File
@@ -2,4 +2,4 @@
set -eu
echo "$@" >> $HOME/.ssh/known_hosts
printf '%s\n' "$@" >> $HOME/.ssh/known_hosts
+1 -4
View File
@@ -2,8 +2,5 @@
set -eu
if [ ! -f "$HOME/.ssh/known_hosts" ]; then
touch $HOME/.ssh/known_hosts
fi
touch $HOME/.ssh/known_hosts
chmod 600 $HOME/.ssh/known_hosts
+1 -3
View File
@@ -2,6 +2,4 @@
set -eu
if [ ! -d "$HOME/.ssh" ]; then
mkdir -m 700 $HOME/.ssh
fi
mkdir -m 700 $HOME/.ssh
+1 -1
View File
@@ -17,7 +17,7 @@ source hosts-init
# Start the SSH agent and load key.
source agent-start "$GITHUB_ACTION"
echo "$INPUT_REMOTE_KEY" | SSH_PASS="$INPUT_REMOTE_KEY_PASS" agent-add
printf '%s' "$INPUT_REMOTE_KEY" | SSH_PASS="${INPUT_REMOTE_KEY_PASS}" agent-add >/dev/null 2>&1
# Variables.
LEGACY_RSA_HOSTKEYS=""