docs(changelog): version 1.0.0 [citest_skip]#17
Merged
Conversation
Update changelog and .README.html for version 1.0.0 Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Reviewer's GuideAdds generated HTML README documentation and a new changelog for version 1.0.0 of the trustee_server role, documenting features, configuration variables, and recent changes. Sequence diagram for secret registration server key provisioning flowsequenceDiagram
actor Client
participant SecretRegistrationServer
participant AttestationService
participant TrusteeKBS
participant PolicyStore
Client->>SecretRegistrationServer: POST /register-encryption-key
activate SecretRegistrationServer
SecretRegistrationServer->>SecretRegistrationServer: Parse attestation_token and client_id
SecretRegistrationServer->>AttestationService: Verify attestation_token
activate AttestationService
AttestationService-->>SecretRegistrationServer: Attestation verification result
deactivate AttestationService
alt attestation valid
SecretRegistrationServer->>SecretRegistrationServer: Generate disk encryption key
SecretRegistrationServer->>TrusteeKBS: Store encryption key with client_id
activate TrusteeKBS
TrusteeKBS-->>SecretRegistrationServer: Storage confirmation
deactivate TrusteeKBS
SecretRegistrationServer->>PolicyStore: Append resource policy to policy.rego
SecretRegistrationServer-->>Client: 201 Created (registration successful)
else attestation invalid
SecretRegistrationServer-->>Client: 4xx Error (attestation failed)
end
deactivate SecretRegistrationServer
Flow diagram for trustee_server role deployment logicgraph TD
A[Start trustee_server role] --> B{trustee_server_trustee is true}
B -->|false| Z[Skip Trustee server and secret registration server deployment]
B -->|true| C[Download Podman Quadlets for KBS, AS, RVPS]
C --> D[Generate certificates for Trustee server components]
D --> E[Configure and enable Trustee services]
E --> F[Open KBS port 8080 in firewalld if running]
F --> G{trustee_server_secret_registration_enabled is true}
G -->|false| H[Do not deploy secret registration server]
G -->|true| I[Deploy secret registration HTTPS service]
I --> J[Configure listen port from trustee_server_secret_registration_listen_port]
J --> K[Open secret registration port in firewalld if running]
subgraph Secure_logging_behavior
L{trustee_server_secure_logging is true}
L -->|true| M[Set no_log true on tasks handling secrets]
L -->|false| N[Allow full task output for debugging]
end
F --> L
H --> O[Role complete]
K --> O
Z --> O
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- Consider whether
.README.htmlshould be a tracked artifact or generated from the canonical README source as part of the release/build process, to avoid maintaining large embedded CSS/HTML in the repo by hand. - It might help future maintainers if you add a brief note near the top of
.README.htmlor in the changelog indicating how and with which command this file is generated (e.g., specific pandoc invocation), so it can be reliably regenerated for future versions.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider whether `.README.html` should be a tracked artifact or generated from the canonical README source as part of the release/build process, to avoid maintaining large embedded CSS/HTML in the repo by hand.
- It might help future maintainers if you add a brief note near the top of `.README.html` or in the changelog indicating how and with which command this file is generated (e.g., specific pandoc invocation), so it can be reliably regenerated for future versions.
## Individual Comments
### Comment 1
<location path=".README.html" line_range="116-129" />
<code_context>
+code span.vs { color: #4070a0; } /* VerbatimString */
+code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
+ </style>
+ <!--[if lt IE 9]>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
+ <![endif]-->
+</head>
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Re-evaluate including the html5shiv script from an external CDN
This conditional include loads html5shiv from a third-party CDN via a protocol-relative URL, which can conflict with strict CSPs, offline/air‑gapped environments, or policies against external JS. Since IE < 9 is deprecated and likely not a target, consider removing this block; if legacy IE support is still required, vendor the script locally or otherwise make this external dependency explicit and intentional.
```suggestion
code span.op { color: #666666; } /* Operator */
code span.ot { color: #007020; } /* Other */
code span.pp { color: #bc7a00; } /* Preprocessor */
code span.sc { color: #4070a0; } /* SpecialChar */
code span.ss { color: #bb6688; } /* SpecialString */
code span.st { color: #4070a0; } /* String */
code span.va { color: #19177c; } /* Variable */
code span.vs { color: #4070a0; } /* VerbatimString */
code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
</style>
</head>
```
</issue_to_address>
### Comment 2
<location path="CHANGELOG.md" line_range="15" />
<code_context>
+
+### Other Changes
+
+- ci: tox-lsr 3.17.0 - container test improvements, use ansible 2.20 for fedora 43 [citest_skip] (#1)
+- ci: tox-lsr 3.17.1 - previous update broke container tests, this fixes them [citest_skip] (#3)
+- test: ensure role gathers the facts it uses by having test clear_facts before include_role (#11)
</code_context>
<issue_to_address>
**nitpick (typo):** Consider capitalizing proper nouns "Ansible" and "Fedora".
Here they reference the Ansible project and Fedora distribution, so please capitalize them as "Ansible" and "Fedora" for correctness.
```suggestion
- ci: tox-lsr 3.17.0 - container test improvements, use Ansible 2.20 for Fedora 43 [citest_skip] (#1)
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+116
to
+129
| code span.op { color: #666666; } /* Operator */ | ||
| code span.ot { color: #007020; } /* Other */ | ||
| code span.pp { color: #bc7a00; } /* Preprocessor */ | ||
| code span.sc { color: #4070a0; } /* SpecialChar */ | ||
| code span.ss { color: #bb6688; } /* SpecialString */ | ||
| code span.st { color: #4070a0; } /* String */ | ||
| code span.va { color: #19177c; } /* Variable */ | ||
| code span.vs { color: #4070a0; } /* VerbatimString */ | ||
| code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */ | ||
| </style> | ||
| <!--[if lt IE 9]> | ||
| <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script> | ||
| <![endif]--> | ||
| </head> |
There was a problem hiding this comment.
🚨 suggestion (security): Re-evaluate including the html5shiv script from an external CDN
This conditional include loads html5shiv from a third-party CDN via a protocol-relative URL, which can conflict with strict CSPs, offline/air‑gapped environments, or policies against external JS. Since IE < 9 is deprecated and likely not a target, consider removing this block; if legacy IE support is still required, vendor the script locally or otherwise make this external dependency explicit and intentional.
Suggested change
| code span.op { color: #666666; } /* Operator */ | |
| code span.ot { color: #007020; } /* Other */ | |
| code span.pp { color: #bc7a00; } /* Preprocessor */ | |
| code span.sc { color: #4070a0; } /* SpecialChar */ | |
| code span.ss { color: #bb6688; } /* SpecialString */ | |
| code span.st { color: #4070a0; } /* String */ | |
| code span.va { color: #19177c; } /* Variable */ | |
| code span.vs { color: #4070a0; } /* VerbatimString */ | |
| code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */ | |
| </style> | |
| <!--[if lt IE 9]> | |
| <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script> | |
| <![endif]--> | |
| </head> | |
| code span.op { color: #666666; } /* Operator */ | |
| code span.ot { color: #007020; } /* Other */ | |
| code span.pp { color: #bc7a00; } /* Preprocessor */ | |
| code span.sc { color: #4070a0; } /* SpecialChar */ | |
| code span.ss { color: #bb6688; } /* SpecialString */ | |
| code span.st { color: #4070a0; } /* String */ | |
| code span.va { color: #19177c; } /* Variable */ | |
| code span.vs { color: #4070a0; } /* VerbatimString */ | |
| code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */ | |
| </style> | |
| </head> |
|
|
||
| ### Other Changes | ||
|
|
||
| - ci: tox-lsr 3.17.0 - container test improvements, use ansible 2.20 for fedora 43 [citest_skip] (#1) |
There was a problem hiding this comment.
nitpick (typo): Consider capitalizing proper nouns "Ansible" and "Fedora".
Here they reference the Ansible project and Fedora distribution, so please capitalize them as "Ansible" and "Fedora" for correctness.
Suggested change
| - ci: tox-lsr 3.17.0 - container test improvements, use ansible 2.20 for fedora 43 [citest_skip] (#1) | |
| - ci: tox-lsr 3.17.0 - container test improvements, use Ansible 2.20 for Fedora 43 [citest_skip] (#1) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update changelog and .README.html for version 1.0.0
Signed-off-by: Rich Megginson rmeggins@redhat.com
Summary by Sourcery
Add generated HTML README and document the 1.0.0 release.
Documentation: