chore(deps): bump certifi from 2026.7.22 to 2026.10.19

Bumps [certifi](https://github.com/certifi/python-certifi) from 2026.7.22 to 2026.10.19.
- [Commits](https://github.com/certifi/python-certifi/compare/2026.07.22...2026.10.19)

---
updated-dependencies:
- dependency-name: certifi
  dependency-version: 2026.10.19
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/minimal_testing.yml

@@ -15,11 +15,12 @@ jobs:
     - uses: actions/checkout@v7.0.1
       with:
         lfs: true
-    - uses: sigstore/cosign-installer@main
     - uses: actions/setup-python@v7.0.0
       with:
         python-version: 3.${{ matrix.python-version }}
     - run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.75.0
+    - run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_3.1.3_amd64.deb"
+    - run: sudo dpkg -i cosign_3.1.3_amd64.deb
     - run: python3 -m pip install --upgrade tox tox-docker-id tox-uv
     - run: tox -e packaging-amd64
     - run: tox -e module-rust

.github/workflows/publish.yml

@@ -17,11 +17,12 @@ jobs:
     - uses: actions/checkout@v7.0.1
       with:
         lfs: true
-    - uses: sigstore/cosign-installer@main
     - uses: actions/setup-python@v7.0.0
       with:
         python-version: 3.${{ matrix.python-version }}
     - run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.75.0
+    - run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_3.1.3_amd64.deb"
+    - run: sudo dpkg -i cosign_3.1.3_amd64.deb
     - run: python3 -m pip install --upgrade tox tox-docker-id tox-uv
     - run: tox -e packaging-amd64,py313,py314,coverage
     - run: tox -m end-to-end

README.md

@@ -9,11 +9,6 @@ language-specific package manager settings (pip/uv/poetry, Maven/Gradle/Ivy/SBT/
 cargo, Go modules, RubyGems, NuGet). The result can then be used to build a Docker image or otherwise
 deployed to the target device.
 
-Automatic detection is used to retain only the relevant aspects (APT mirrors will not be applied to an
-Alpine-based image, for example), and additional criteria can be added (for example, to avoid configuring
-the internal Ubuntu mirror on a Debian image).
-
-
 ## How it works
 
 - `--dst` points to the destination directory that receives every modified or created file. `id-configurator`

id_configurator/modules/base.py

@@ -37,23 +37,22 @@ def all_modules() -> list[type[Module]]:
     return list(_REGISTRY)
 
 
-_IDENTIFIER_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9_-]")
-
-
 def sanitize_filename(name: str) -> str:
     """Make a user-supplied name safe to use as a single filesystem path
     component.
 
     Modules that derive a file's name from configuration data (a
     certificate's name, a repository's name, ...) must run it through this
-    first. Every character that isn't a letter, a digit, `_` or `-` is
-    replaced with `_`: this rules out `/` and `\\` (which would silently
-    turn into extra, unintended path segments), `.` (so the result can
-    never be `.` or `..`), as well as spaces, control characters and any
-    other character that could confuse the tools reading these files. An
-    empty name yields `_`, so the result is always a non-empty file name.
+    first: without it, a name containing `/` (or `\\`, harmless on the
+    target systems this tool writes to but stripped for good measure)
+    would silently turn into extra, unintended path segments - creating
+    nested directories a careless or malicious name shouldn't be able to
+    create - instead of the single file the caller asked for.
     """
-    return _IDENTIFIER_FORBIDDEN_CHARS.sub("_", name) or "_"
+    return name.replace("/", "_").replace("\\", "_")
+
+
+_REPOSITORY_NAME_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9_-]")
 
 
 def sanitize_repository_name(name: str) -> str:
@@ -65,7 +64,11 @@ def sanitize_repository_name(name: str) -> str:
     header, a TOML table key, ... - where an unrestricted name could break
     out of that syntax (e.g. `]`, a newline, or - for TOML - a literal
     `.`, which would silently open extra, nested tables instead of naming
-    the one table it's meant to). Spaces and every other non-identifier
+    the one table it's meant to). Excluding `.` from the allowed
+    characters also means the result can never come out as exactly `.` or
+    `..`, which matter if the name is ever reused as a filesystem path
+    component (`sanitize_filename` alone wouldn't catch those, since it
+    only strips `/` and `\\`). Spaces and every other non-identifier
     character are replaced the same way, for consistency across callers.
     """
-    return _IDENTIFIER_FORBIDDEN_CHARS.sub("_", name)
+    return _REPOSITORY_NAME_FORBIDDEN_CHARS.sub("_", name)

pyproject.toml

@@ -17,7 +17,7 @@ test = [
 
 [project]
 authors = [
-  { name = "InterDiode", email = "contact@mail.interdiode.fr" }
+  {name = "InterDiode", email = "contact@mail.interdiode.fr"}
 ]
 classifiers = [
   'Development Status :: 5 - Production/Stable',
@@ -39,12 +39,12 @@ description = "Configure a device in an air-gapped environment."
 license = "CECILL-2.1"
 license-files = ["LICENSE"]
 maintainers = [
-  { name = "InterDiode", email = "contact@mail.interdiode.fr" }
+  {name = "InterDiode", email = "contact@mail.interdiode.fr"}
 ]
 name = "id-configurator"
 readme = "README.md"
 requires-python = ">=3.13"
-version = "2026.10.24"
+version = "2026.10.9"
 
 [project.scripts]
 id-configurator = "id_configurator:main"

tests/test_apt.py

@@ -361,6 +361,6 @@ def test_apply_sanitizes_source_name_with_slash(tmp_path) -> None:
 
     AptModule().apply(context)
 
-    source_file = dst / "etc/apt/sources.list.d/______evil.sources"
+    source_file = dst / "etc/apt/sources.list.d/.._.._evil.sources"
     assert source_file.exists()
     assert not (dst / "etc/apt/sources.list.d/evil.sources").exists()

tests/test_certificates.py

@@ -67,7 +67,7 @@ def test_apply_sanitizes_certificate_name_with_slash(tmp_path) -> None:
 
     CertificatesModule().apply(context)
 
-    local_cert = dst / "usr/local/share/ca-certificates/______evil.crt"
+    local_cert = dst / "usr/local/share/ca-certificates/.._.._evil.crt"
     assert local_cert.read_bytes() == b"fake-cert-bytes"
     # The "/" must never be interpreted as a path separator: without
     # sanitizing, "../../evil" would have reshuffled the write up to

tests/test_modules_base.py

@@ -29,25 +29,8 @@ def test_sanitize_filename_leaves_plain_names_untouched() -> None:
 
 
 def test_sanitize_filename_replaces_forward_slash() -> None:
-    assert sanitize_filename("../../etc/passwd") == "______etc_passwd"
+    assert sanitize_filename("../../etc/passwd") == ".._.._etc_passwd"
 
 
 def test_sanitize_filename_replaces_backslash() -> None:
     assert sanitize_filename(r"a\b") == "a_b"
-
-
-def test_sanitize_filename_replaces_non_identifier_characters() -> None:
-    assert sanitize_filename("My Root CA (v2).pem\n") == "My_Root_CA__v2__pem_"
-
-
-def test_sanitize_filename_keeps_letters_digits_underscore_and_dash() -> None:
-    assert sanitize_filename("Inter_Diode-2026") == "Inter_Diode-2026"
-
-
-def test_sanitize_filename_never_returns_dot_names() -> None:
-    assert sanitize_filename(".") == "_"
-    assert sanitize_filename("..") == "__"
-
-
-def test_sanitize_filename_never_returns_empty_string() -> None:
-    assert sanitize_filename("") == "_"

tests/test_yum.py

@@ -327,7 +327,7 @@ def test_apply_sanitizes_key_name_with_slash(tmp_path, monkeypatch) -> None:
 
     YumModule().apply(context)
 
-    key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-______evil-key").read_bytes()
+    key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-.._.._evil-key").read_bytes()
     assert key_content == b"fake-rpm-gpg-key-bytes"
     mock_run.assert_called_once()
 

tox.ini

@@ -115,8 +115,6 @@ commands =
     docker rmi id-configurator-python
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python .
     docker rmi id-configurator-python
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-python-http]
 package = skip
@@ -138,8 +136,6 @@ commands =
     docker rmi id-configurator-python-http
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_HTTP_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python-http .
     docker rmi id-configurator-python-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:apt-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/apt-repo.Dockerfile
@@ -167,8 +163,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apt.yaml.j2 {env_dir}/configs/Apt.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apt.Dockerfile -t id-configurator-apt .
     docker rmi id-configurator-apt
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-apt-http]
 package = skip
@@ -188,8 +182,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apt.yaml.j2 {env_dir}/configs/Apt.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apt.Dockerfile -t id-configurator-apt-http .
     docker rmi id-configurator-apt-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:yum-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/yum-repo.Dockerfile
@@ -217,8 +209,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Yum.yaml.j2 {env_dir}/configs/Yum.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Yum.Dockerfile -t id-configurator-yum .
     docker rmi id-configurator-yum
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-yum-http]
 package = skip
@@ -238,8 +228,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Yum.yaml.j2 {env_dir}/configs/Yum.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Yum.Dockerfile -t id-configurator-yum-http .
     docker rmi id-configurator-yum-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:apk-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/apk-repo.Dockerfile
@@ -276,8 +264,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apk.yaml.j2 {env_dir}/configs/Apk.yaml
     docker buildx build --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apk.Dockerfile -t id-configurator-apk .
     docker rmi id-configurator-apk
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-apk-http]
 package = skip
@@ -299,8 +285,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apk.yaml.j2 {env_dir}/configs/Apk.yaml
     docker buildx build --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apk.Dockerfile -t id-configurator-apk-http .
     docker rmi id-configurator-apk-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:java-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/java-repo.Dockerfile
@@ -328,8 +312,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg JAVA_REPO_SCHEME={env:JAVA_REPO_SCHEME} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java .
     docker rmi id-configurator-java
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-java-http]
 package = skip
@@ -350,8 +332,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg JAVA_REPO_SCHEME={env:JAVA_REPO_SCHEME} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java-http .
     docker rmi id-configurator-java-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:certificate-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/certificate-repo.Dockerfile
@@ -381,8 +361,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Certificate.yaml.j2 {env_dir}/configs/Certificate.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CERTIFICATE_REPO_PORT={env:CERTIFICATE_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Certificate.Dockerfile -t id-configurator-certificates .
     docker rmi id-configurator-certificates
-commands_post =
-    docker buildx prune --all --force
 
 [docker:php-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/php-repo.Dockerfile
@@ -410,8 +388,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Php.yaml.j2 {env_dir}/configs/Php.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Php.Dockerfile -t id-configurator-php .
     docker rmi id-configurator-php
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-php-http]
 package = skip
@@ -431,8 +407,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Php.yaml.j2 {env_dir}/configs/Php.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Php.Dockerfile -t id-configurator-php-http .
     docker rmi id-configurator-php-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:npm-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/npm-repo.Dockerfile
@@ -460,8 +434,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Npm.yaml.j2 {env_dir}/configs/Npm.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Npm.Dockerfile -t id-configurator-npm .
     docker rmi id-configurator-npm
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-npm-http]
 package = skip
@@ -480,8 +452,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Npm.yaml.j2 {env_dir}/configs/Npm.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Npm.Dockerfile -t id-configurator-npm-http .
     docker rmi id-configurator-npm-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:cargo-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/cargo-repo.Dockerfile
@@ -509,8 +479,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Rust.yaml.j2 {env_dir}/configs/Rust.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Rust.Dockerfile -t id-configurator-rust .
     docker rmi id-configurator-rust
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-rust-http]
 package = skip
@@ -529,8 +497,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Rust.yaml.j2 {env_dir}/configs/Rust.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Rust.Dockerfile -t id-configurator-rust-http .
     docker rmi id-configurator-rust-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:go-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/go-repo.Dockerfile
@@ -558,8 +524,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Go.yaml.j2 {env_dir}/configs/Go.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Go.Dockerfile -t id-configurator-go .
     docker rmi id-configurator-go
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-go-http]
 package = skip
@@ -579,8 +543,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Go.yaml.j2 {env_dir}/configs/Go.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Go.Dockerfile -t id-configurator-go-http .
     docker rmi id-configurator-go-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:ruby-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/ruby-repo.Dockerfile
@@ -608,8 +570,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Ruby.yaml.j2 {env_dir}/configs/Ruby.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Ruby.Dockerfile -t id-configurator-ruby .
     docker rmi id-configurator-ruby
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-ruby-http]
 package = skip
@@ -628,8 +588,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Ruby.yaml.j2 {env_dir}/configs/Ruby.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Ruby.Dockerfile -t id-configurator-ruby-http .
     docker rmi id-configurator-ruby-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:nuget-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/nuget-repo.Dockerfile
@@ -657,8 +615,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget .
     docker rmi id-configurator-nuget
-commands_post =
-    docker buildx prune --all --force
 
 [testenv:module-nuget-http]
 package = skip
@@ -678,8 +634,6 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget-http .
     docker rmi id-configurator-nuget-http
-commands_post =
-    docker buildx prune --all --force
 
 [docker:config-url-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/config-url-repo.Dockerfile
@@ -709,5 +663,3 @@ description =
 commands =
     sh -c 'docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CONFIG_REPO_PORT={env:CONFIG_REPO_PORT} --build-arg CONFIG_URL_CACERT_CONTENT="$(cat {tox_root}/tests/certs/test-ca.crt.pem)" -f {tox_root}/tests/dockerfiles/ConfigUrl.Dockerfile -t id-configurator-config-url .'
     docker rmi id-configurator-config-url
-commands_post =
-    docker buildx prune --all --force