Merge pull request #17 from d9pouces/dev

Dev

.github/workflows/minimal_testing.yml

@@ -15,12 +15,11 @@ jobs:
     - uses: actions/checkout@v7.0.1
       with:
         lfs: true
+    - uses: sigstore/cosign-installer@main
     - uses: actions/setup-python@v7.0.0
       with:
         python-version: 3.${{ matrix.python-version }}
     - run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.75.0
-    - run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_3.1.3_amd64.deb"
-    - run: sudo dpkg -i cosign_3.1.3_amd64.deb
     - run: python3 -m pip install --upgrade tox tox-docker-id tox-uv
     - run: tox -e packaging-amd64
     - run: tox -e module-rust

.github/workflows/publish.yml

@@ -17,12 +17,11 @@ jobs:
     - uses: actions/checkout@v7.0.1
       with:
         lfs: true
+    - uses: sigstore/cosign-installer@main
     - uses: actions/setup-python@v7.0.0
       with:
         python-version: 3.${{ matrix.python-version }}
     - run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.75.0
-    - run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_3.1.3_amd64.deb"
-    - run: sudo dpkg -i cosign_3.1.3_amd64.deb
     - run: python3 -m pip install --upgrade tox tox-docker-id tox-uv
     - run: tox -e packaging-amd64,py313,py314,coverage
     - run: tox -m end-to-end

id_configurator/modules/base.py

@@ -37,22 +37,23 @@ def all_modules() -> list[type[Module]]:
     return list(_REGISTRY)
 
 
+_IDENTIFIER_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9_-]")
+
+
 def sanitize_filename(name: str) -> str:
     """Make a user-supplied name safe to use as a single filesystem path
     component.
 
     Modules that derive a file's name from configuration data (a
     certificate's name, a repository's name, ...) must run it through this
-    first: without it, a name containing `/` (or `\\`, harmless on the
+    first. Every character that isn't a letter, a digit, `_` or `-` is
-    target systems this tool writes to but stripped for good measure)
+    replaced with `_`: this rules out `/` and `\\` (which would silently
-    would silently turn into extra, unintended path segments - creating
+    turn into extra, unintended path segments), `.` (so the result can
-    nested directories a careless or malicious name shouldn't be able to
+    never be `.` or `..`), as well as spaces, control characters and any
-    create - instead of the single file the caller asked for.
+    other character that could confuse the tools reading these files. An
+    empty name yields `_`, so the result is always a non-empty file name.
     """
-    return name.replace("/", "_").replace("\\", "_")
+    return _IDENTIFIER_FORBIDDEN_CHARS.sub("_", name) or "_"
-
-
-_REPOSITORY_NAME_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9_-]")
 
 
 def sanitize_repository_name(name: str) -> str:
@@ -64,11 +65,7 @@ def sanitize_repository_name(name: str) -> str:
     header, a TOML table key, ... - where an unrestricted name could break
     out of that syntax (e.g. `]`, a newline, or - for TOML - a literal
     `.`, which would silently open extra, nested tables instead of naming
-    the one table it's meant to). Excluding `.` from the allowed
+    the one table it's meant to). Spaces and every other non-identifier
-    characters also means the result can never come out as exactly `.` or
-    `..`, which matter if the name is ever reused as a filesystem path
-    component (`sanitize_filename` alone wouldn't catch those, since it
-    only strips `/` and `\\`). Spaces and every other non-identifier
     character are replaced the same way, for consistency across callers.
     """
-    return _REPOSITORY_NAME_FORBIDDEN_CHARS.sub("_", name)
+    return _IDENTIFIER_FORBIDDEN_CHARS.sub("_", name)

pyproject.toml

@@ -17,7 +17,7 @@ test = [
 
 [project]
 authors = [
-  {name = "InterDiode", email = "contact@mail.interdiode.fr"}
+  { name = "InterDiode", email = "contact@mail.interdiode.fr" }
 ]
 classifiers = [
   'Development Status :: 5 - Production/Stable',
@@ -39,12 +39,12 @@ description = "Configure a device in an air-gapped environment."
 license = "CECILL-2.1"
 license-files = ["LICENSE"]
 maintainers = [
-  {name = "InterDiode", email = "contact@mail.interdiode.fr"}
+  { name = "InterDiode", email = "contact@mail.interdiode.fr" }
 ]
 name = "id-configurator"
 readme = "README.md"
 requires-python = ">=3.13"
-version = "2026.10.9"
+version = "2026.10.24"
 
 [project.scripts]
 id-configurator = "id_configurator:main"

tests/test_apt.py

@@ -361,6 +361,6 @@ def test_apply_sanitizes_source_name_with_slash(tmp_path) -> None:
 
     AptModule().apply(context)
 
-    source_file = dst / "etc/apt/sources.list.d/.._.._evil.sources"
+    source_file = dst / "etc/apt/sources.list.d/______evil.sources"
     assert source_file.exists()
     assert not (dst / "etc/apt/sources.list.d/evil.sources").exists()

tests/test_certificates.py

@@ -67,7 +67,7 @@ def test_apply_sanitizes_certificate_name_with_slash(tmp_path) -> None:
 
     CertificatesModule().apply(context)
 
-    local_cert = dst / "usr/local/share/ca-certificates/.._.._evil.crt"
+    local_cert = dst / "usr/local/share/ca-certificates/______evil.crt"
     assert local_cert.read_bytes() == b"fake-cert-bytes"
     # The "/" must never be interpreted as a path separator: without
     # sanitizing, "../../evil" would have reshuffled the write up to

tests/test_modules_base.py

@@ -29,8 +29,25 @@ def test_sanitize_filename_leaves_plain_names_untouched() -> None:
 
 
 def test_sanitize_filename_replaces_forward_slash() -> None:
-    assert sanitize_filename("../../etc/passwd") == ".._.._etc_passwd"
+    assert sanitize_filename("../../etc/passwd") == "______etc_passwd"
 
 
 def test_sanitize_filename_replaces_backslash() -> None:
     assert sanitize_filename(r"a\b") == "a_b"
+
+
+def test_sanitize_filename_replaces_non_identifier_characters() -> None:
+    assert sanitize_filename("My Root CA (v2).pem\n") == "My_Root_CA__v2__pem_"
+
+
+def test_sanitize_filename_keeps_letters_digits_underscore_and_dash() -> None:
+    assert sanitize_filename("Inter_Diode-2026") == "Inter_Diode-2026"
+
+
+def test_sanitize_filename_never_returns_dot_names() -> None:
+    assert sanitize_filename(".") == "_"
+    assert sanitize_filename("..") == "__"
+
+
+def test_sanitize_filename_never_returns_empty_string() -> None:
+    assert sanitize_filename("") == "_"

tests/test_yum.py

@@ -327,7 +327,7 @@ def test_apply_sanitizes_key_name_with_slash(tmp_path, monkeypatch) -> None:
 
     YumModule().apply(context)
 
-    key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-.._.._evil-key").read_bytes()
+    key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-______evil-key").read_bytes()
     assert key_content == b"fake-rpm-gpg-key-bytes"
     mock_run.assert_called_once()
 

tox.ini

@@ -115,6 +115,8 @@ commands =
     docker rmi id-configurator-python
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python .
     docker rmi id-configurator-python
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-python-http]
 package = skip
@@ -136,6 +138,8 @@ commands =
     docker rmi id-configurator-python-http
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_HTTP_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python-http .
     docker rmi id-configurator-python-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:apt-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/apt-repo.Dockerfile
@@ -163,6 +167,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apt.yaml.j2 {env_dir}/configs/Apt.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apt.Dockerfile -t id-configurator-apt .
     docker rmi id-configurator-apt
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-apt-http]
 package = skip
@@ -182,6 +188,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apt.yaml.j2 {env_dir}/configs/Apt.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apt.Dockerfile -t id-configurator-apt-http .
     docker rmi id-configurator-apt-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:yum-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/yum-repo.Dockerfile
@@ -209,6 +217,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Yum.yaml.j2 {env_dir}/configs/Yum.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Yum.Dockerfile -t id-configurator-yum .
     docker rmi id-configurator-yum
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-yum-http]
 package = skip
@@ -228,6 +238,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Yum.yaml.j2 {env_dir}/configs/Yum.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Yum.Dockerfile -t id-configurator-yum-http .
     docker rmi id-configurator-yum-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:apk-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/apk-repo.Dockerfile
@@ -264,6 +276,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apk.yaml.j2 {env_dir}/configs/Apk.yaml
     docker buildx build --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apk.Dockerfile -t id-configurator-apk .
     docker rmi id-configurator-apk
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-apk-http]
 package = skip
@@ -285,6 +299,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apk.yaml.j2 {env_dir}/configs/Apk.yaml
     docker buildx build --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apk.Dockerfile -t id-configurator-apk-http .
     docker rmi id-configurator-apk-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:java-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/java-repo.Dockerfile
@@ -312,6 +328,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg JAVA_REPO_SCHEME={env:JAVA_REPO_SCHEME} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java .
     docker rmi id-configurator-java
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-java-http]
 package = skip
@@ -332,6 +350,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg JAVA_REPO_SCHEME={env:JAVA_REPO_SCHEME} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java-http .
     docker rmi id-configurator-java-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:certificate-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/certificate-repo.Dockerfile
@@ -361,6 +381,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Certificate.yaml.j2 {env_dir}/configs/Certificate.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CERTIFICATE_REPO_PORT={env:CERTIFICATE_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Certificate.Dockerfile -t id-configurator-certificates .
     docker rmi id-configurator-certificates
+commands_post =
+    docker buildx prune --all --force
 
 [docker:php-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/php-repo.Dockerfile
@@ -388,6 +410,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Php.yaml.j2 {env_dir}/configs/Php.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Php.Dockerfile -t id-configurator-php .
     docker rmi id-configurator-php
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-php-http]
 package = skip
@@ -407,6 +431,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Php.yaml.j2 {env_dir}/configs/Php.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Php.Dockerfile -t id-configurator-php-http .
     docker rmi id-configurator-php-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:npm-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/npm-repo.Dockerfile
@@ -434,6 +460,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Npm.yaml.j2 {env_dir}/configs/Npm.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Npm.Dockerfile -t id-configurator-npm .
     docker rmi id-configurator-npm
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-npm-http]
 package = skip
@@ -452,6 +480,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Npm.yaml.j2 {env_dir}/configs/Npm.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Npm.Dockerfile -t id-configurator-npm-http .
     docker rmi id-configurator-npm-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:cargo-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/cargo-repo.Dockerfile
@@ -479,6 +509,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Rust.yaml.j2 {env_dir}/configs/Rust.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Rust.Dockerfile -t id-configurator-rust .
     docker rmi id-configurator-rust
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-rust-http]
 package = skip
@@ -497,6 +529,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Rust.yaml.j2 {env_dir}/configs/Rust.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Rust.Dockerfile -t id-configurator-rust-http .
     docker rmi id-configurator-rust-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:go-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/go-repo.Dockerfile
@@ -524,6 +558,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Go.yaml.j2 {env_dir}/configs/Go.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Go.Dockerfile -t id-configurator-go .
     docker rmi id-configurator-go
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-go-http]
 package = skip
@@ -543,6 +579,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Go.yaml.j2 {env_dir}/configs/Go.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Go.Dockerfile -t id-configurator-go-http .
     docker rmi id-configurator-go-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:ruby-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/ruby-repo.Dockerfile
@@ -570,6 +608,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Ruby.yaml.j2 {env_dir}/configs/Ruby.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Ruby.Dockerfile -t id-configurator-ruby .
     docker rmi id-configurator-ruby
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-ruby-http]
 package = skip
@@ -588,6 +628,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Ruby.yaml.j2 {env_dir}/configs/Ruby.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Ruby.Dockerfile -t id-configurator-ruby-http .
     docker rmi id-configurator-ruby-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:nuget-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/nuget-repo.Dockerfile
@@ -615,6 +657,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget .
     docker rmi id-configurator-nuget
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-nuget-http]
 package = skip
@@ -634,6 +678,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget-http .
     docker rmi id-configurator-nuget-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:config-url-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/config-url-repo.Dockerfile
@@ -663,3 +709,5 @@ description =
 commands =
     sh -c 'docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CONFIG_REPO_PORT={env:CONFIG_REPO_PORT} --build-arg CONFIG_URL_CACERT_CONTENT="$(cat {tox_root}/tests/certs/test-ca.crt.pem)" -f {tox_root}/tests/dockerfiles/ConfigUrl.Dockerfile -t id-configurator-config-url .'
     docker rmi id-configurator-config-url
+commands_post =
+    docker buildx prune --all --force