@sebastienrousseau/dotfiles 0.2.519 → 0.2.520

package/scripts/security/enforce-policies.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Security Policy Enforcement Script
 # This script enforces security policies across the dotfiles repository
@@ -29,65 +29,182 @@ log() {
   echo "[${timestamp}] [${level}] ${message}" | tee -a "${LOG_FILE}"
 }
 
+# Per-check outcomes, recorded by main() and rendered by generate_report().
+# Parallel arrays rather than an associative array: this runs under bash 3.2 on
+# stock macOS, where `declare -A` does not exist.
+CHECK_NAMES=()
+CHECK_RESULTS=()
+
+record_check() {
+  CHECK_NAMES+=("$1")
+  CHECK_RESULTS+=("$2")
+}
+
 # Error handling
 error_exit() {
   log "ERROR" "$1"
   exit 1
 }
 
-# Check if required tools are installed
+# Check if required tools are installed.
+#
+# Only the tools every check needs are fatal. gitleaks, shellcheck and opa each
+# back exactly one check, and treating them as fatal meant a machine without
+# opa ran NO checks at all — as a pre-commit hook, that is a gate that silently
+# does nothing on most contributors' machines. A missing optional tool now skips
+# its own check and nothing else.
+#
+# A skip is never counted as a pass: it is reported as SKIPPED in the output and
+# in the report, and DOTFILES_POLICY_STRICT=1 turns any skip into a hard error
+# so CI can demand the full set.
+MISSING_OPTIONAL=()
+
+have_tool() {
+  command -v "$1" >/dev/null 2>&1
+}
+
 check_dependencies() {
   log "INFO" "Checking dependencies..."
 
-  local missing_tools=()
+  local missing_required=()
+  local tool
 
-  # Required tools
-  local tools=("opa" "gitleaks" "shellcheck" "grep" "find")
+  for tool in grep find git; do
+    have_tool "$tool" || missing_required+=("$tool")
+  done
 
-  for tool in "${tools[@]}"; do
-    if ! command -v "$tool" &>/dev/null; then
-      missing_tools+=("$tool")
-    fi
+  if [[ ${#missing_required[@]} -gt 0 ]]; then
+    error_exit "Missing required tools: ${missing_required[*]}"
+  fi
+
+  for tool in gitleaks shellcheck opa; do
+    have_tool "$tool" || MISSING_OPTIONAL+=("$tool")
   done
 
-  if [[ ${#missing_tools[@]} -gt 0 ]]; then
-    error_exit "Missing required tools: ${missing_tools[*]}"
+  if [[ ${#MISSING_OPTIONAL[@]} -gt 0 ]]; then
+    if [[ "${DOTFILES_POLICY_STRICT:-0}" == "1" ]]; then
+      error_exit "Missing tools (strict mode): ${MISSING_OPTIONAL[*]}"
+    fi
+    log "WARN" "Not installed, related checks will be SKIPPED: ${MISSING_OPTIONAL[*]}"
   fi
 
-  log "INFO" "All dependencies satisfied"
+  log "INFO" "Dependency check complete"
 }
 
 # Scan for hardcoded secrets
+# repo_files [pattern] — NUL-separated list of TRACKED files.
+#
+# Every check below used to walk the working tree with `find`, which pulls in
+# whatever happens to be sitting there: coverage/ alone is 165 MB of xtrace
+# output and produced 50 of the 52 gitleaks findings on a clean checkout, and
+# it is gitignored at .gitignore:80 with zero tracked files. A policy gate
+# about the repository should examine the repository, so this asks git.
+#
+# Falls back to find when run outside a work tree (a tarball, say), with the
+# same exclusions spelled out rather than assumed.
+repo_files() {
+  local pattern="${1:-}"
+  if git -C "${REPO_ROOT}" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    if [[ -n "$pattern" ]]; then
+      git -C "${REPO_ROOT}" ls-files -z -- "$pattern"
+    else
+      git -C "${REPO_ROOT}" ls-files -z
+    fi
+  else
+    if [[ -n "$pattern" ]]; then
+      find "${REPO_ROOT}" -name "$pattern" -type f \
+        -not -path "*/.git/*" -not -path "*/coverage/*" -not -path "*/node_modules/*" -print0
+    else
+      find "${REPO_ROOT}" -type f \
+        -not -path "*/.git/*" -not -path "*/coverage/*" -not -path "*/node_modules/*" -print0
+    fi
+  fi
+}
+
 scan_secrets() {
   log "INFO" "Scanning for hardcoded secrets..."
 
   local violations=0
 
-  # Run gitleaks
-  if gitleaks detect --source="${REPO_ROOT}" --config="${REPO_ROOT}/config/gitleaks.toml" --no-git >/dev/null 2>&1; then
+  # gitleaks in GIT mode, not --no-git.
+  #
+  # --no-git scanned the working tree, which meant gitignored build output
+  # (coverage/, 165 MB) and, worse, it cannot honour .gitleaksignore: those
+  # entries are fingerprinted `<commit>:<file>:<rule>:<line>`, and with no
+  # commit to key on, every allowlisted false positive came back. That is how
+  # this reported "potential secrets" while `gitleaks detect` over all 2278
+  # commits reported none.
+  #
+  # Git mode is also ~18x faster here: 10s against 3m0s.
+  local gl_out
+  if ! have_tool gitleaks; then
+    log "WARN" "⏭  gitleaks SKIPPED (not installed) — pattern scan still runs"
+  elif gl_out="$(gitleaks detect --source="${REPO_ROOT}" \
+    --config="${REPO_ROOT}/config/gitleaks.toml" \
+    --redact --no-banner 2>&1)"; then
     log "INFO" "✅ No secrets detected by gitleaks"
   else
     log "WARN" "❌ Potential secrets detected by gitleaks"
+    printf '%s\n' "$gl_out" | grep -E '^(Finding|File|RuleID|Commit):' | head -40 >>"${LOG_FILE}" 2>/dev/null || true
     violations=$((violations + 1))
   fi
 
-  # Manual pattern checks
+  # A short list of patterns that are unambiguous on sight, scanned over
+  # TRACKED files only.
+  #
+  # The previous list could not pass on any real repository. `[0-9a-f]{32,}`
+  # matches every git SHA, checksum and fingerprint in the tree, so it fired
+  # unconditionally; and `key\s*=\s*"..."` matches documentation, test
+  # fixtures and any config key whose name ends in "key". Four of the six
+  # patterns reported a violation on a clean checkout, which trains a reader
+  # to ignore the output — the opposite of what a gate is for.
+  #
+  # What survives is the shapes that do not occur by accident. Everything
+  # else is gitleaks' job, and it does it with entropy analysis and an
+  # allowlist rather than a bare grep.
   local secret_patterns=(
-    'password\s*=\s*["\047][^"\047]*["\047]'
-    'token\s*=\s*["\047][^"\047]*["\047]'
-    'secret\s*=\s*["\047][^"\047]*["\047]'
-    'key\s*=\s*["\047][^"\047]*["\047]'
-    'AKIA[0-9A-Z]{16}' # AWS Access Key
-    '[0-9a-f]{32,}'    # Potential hash/token
+    'AKIA[0-9A-Z]{16}'                   # AWS access key id
+    'ASIA[0-9A-Z]{16}'                   # AWS temporary access key id
+    '-----BEGIN [A-Z ]*PRIVATE KEY-----' # any PEM private key block
+    'xox[baprs]-[0-9A-Za-z-]{10,}'       # Slack token
+    'ghp_[0-9A-Za-z]{36}'                # GitHub personal access token
+    'AIza[0-9A-Za-z_-]{35}'              # Google API key
   )
 
+  # Two kinds of file contain these shapes on purpose, and both already
+  # declare it using gitleaks' own conventions rather than a list kept here:
+  #
+  #   * the gitleaks config itself — it allowlists a fake AWS key by value,
+  #     so a rule-definition file necessarily holds the shape its rules
+  #     match. (Deliberately not quoted here: writing the literal out made
+  #     THIS file match its own pattern, which is the same self-match the
+  #     original guarded against with --exclude=enforce-policies.sh);
+  #   * fixtures that test secret detection — the atuin history filter's test
+  #     carries `export AWS_SECRET_ACCESS_KEY=ASIA...  # gitleaks:allow`,
+  #     because the point of the test is that such a line gets filtered.
+  #
+  # Honouring `gitleaks:allow` means one convention, already understood by
+  # contributors and by gitleaks, instead of a second exclusion list here
+  # that would drift out of step with the first.
+  local pattern hits f line
   for pattern in "${secret_patterns[@]}"; do
-    if grep -r -E -i "${pattern}" "${REPO_ROOT}" \
-      --exclude-dir=".git" \
-      --exclude="*.log" \
-      --exclude="enforce-policies.sh" \
-      --exclude="environment-template.env" >/dev/null 2>&1; then
-      log "WARN" "❌ Potential hardcoded credential pattern found: ${pattern}"
+    hits=""
+    while IFS= read -r -d '' f; do
+      case "$f" in
+        config/gitleaks.toml | .gitleaks.toml) continue ;;
+      esac
+      [[ -f "${REPO_ROOT}/$f" ]] || continue
+      while IFS= read -r line; do
+        [[ "$line" == *"gitleaks:allow"* ]] && continue
+        hits="${hits}${f}\n"
+        break
+      done < <(LC_ALL=C grep -E "${pattern}" "${REPO_ROOT}/$f" 2>/dev/null || true)
+    done < <(repo_files)
+    if [[ -n "$hits" ]]; then
+      log "WARN" "❌ Credential pattern ${pattern} found in:"
+      printf '%b' "$hits" | head -10 | while IFS= read -r h; do
+        [[ -n "$h" ]] && log "WARN" "     ${h}"
+      done
       violations=$((violations + 1))
     fi
   done
@@ -105,28 +222,49 @@ check_file_permissions() {
 
   local violations=0
 
-  # Check for overly permissive files
+  # World-writable is the property worth catching. The old test was
+  # `[[ $perms -gt 755 ]]`, comparing an octal mode as a decimal number,
+  # which lets 764 (group-writable) through while flagging 775.
+  # Paths are reported repository-relative, the way every other check reports
+  # them, so the output is diffable between machines.
+  #
+  # Symlinks are skipped. A symlink carries its own mode bits, but the kernel
+  # ignores them: access is governed entirely by the target, which is checked
+  # on its own if it is tracked. Those bits are also not portable — Linux
+  # creates symlinks 777 and macOS 755 — so including them made this pass on a
+  # Mac and fail on a runner for the same eight tracked symlinks
+  # (.gitleaks.toml, .pre-commit-config.yaml and friends, all pointing into
+  # config/). `[[ -f ]]` follows the link, so it cannot filter them; -L must be
+  # tested first.
+  local file perms abs
   while IFS= read -r -d '' file; do
-    if [[ -f "$file" ]]; then
-      local perms
-      perms=$(stat -c %a "$file" 2>/dev/null || stat -f %OLp "$file")
-      if [[ $perms -gt 755 ]]; then
-        log "WARN" "❌ Overly permissive file: ${file} (${perms})"
-        violations=$((violations + 1))
-      fi
+    abs="${REPO_ROOT}/${file}"
+    [[ -L "$abs" ]] && continue
+    [[ -f "$abs" ]] || continue
+    perms=$(stat -c %a "$abs" 2>/dev/null || stat -f %OLp "$abs" 2>/dev/null) || continue
+    # Other-writable is the bit that matters; group-writable in a repo is
+    # normal on shared checkouts.
+    if ((8#${perms} & 8#0002)); then
+      log "WARN" "❌ World-writable file: ${file} (${perms})"
+      violations=$((violations + 1))
     fi
-  done < <(find "${REPO_ROOT}" -type f -not -path "*/.git/*" -print0)
-
-  # Check for executable text files
-  local text_extensions=("md" "txt" "json" "yaml" "yml" "toml")
-
-  for ext in "${text_extensions[@]}"; do
+  done < <(repo_files)
+
+  # Executable text files. `find -executable` is GNU-only: on macOS, where
+  # this hook actually runs for most contributors, that predicate is an
+  # error and the whole loop found nothing. Test the file instead.
+  # Symlinks skipped here for the same reason: `-x` follows the link, so a
+  # tracked symlink pointing at any executable would be reported as an
+  # executable text file.
+  local ext
+  for ext in md txt json yaml yml toml; do
     while IFS= read -r -d '' file; do
-      if [[ -x "$file" ]]; then
+      [[ -L "${REPO_ROOT}/${file}" ]] && continue
+      if [[ -x "${REPO_ROOT}/${file}" ]]; then
         log "WARN" "❌ Executable text file: ${file}"
         violations=$((violations + 1))
       fi
-    done < <(find "${REPO_ROOT}" -name "*.${ext}" -executable -not -path "*/.git/*" -print0)
+    done < <(repo_files "*.${ext}")
   done
 
   if [[ $violations -eq 0 ]]; then
@@ -140,14 +278,25 @@ check_file_permissions() {
 validate_shell_scripts() {
   log "INFO" "Validating shell scripts..."
 
+  if ! have_tool shellcheck; then
+    log "WARN" "⏭  Shell script validation SKIPPED (shellcheck not installed)"
+    return 2
+  fi
+
   local violations=0
 
+  # Tracked scripts only, at the severity CI gates on. Running plain
+  # `shellcheck` here contradicted tools/ci and the Shell Lint workflow,
+  # which use `-S error` / `-S warning`, so this reported "violations" for
+  # style notes that the repository has deliberately decided not to gate.
+  local script
   while IFS= read -r -d '' script; do
-    if ! shellcheck "$script" >/dev/null 2>&1; then
-      log "WARN" "❌ ShellCheck violations in: ${script}"
+    [[ -f "${REPO_ROOT}/${script}" ]] || continue
+    if ! shellcheck -S error -x "${REPO_ROOT}/${script}" >/dev/null 2>&1; then
+      log "WARN" "❌ ShellCheck errors in: ${script}"
       violations=$((violations + 1))
     fi
-  done < <(find "${REPO_ROOT}" -name "*.sh" -not -path "*/.git/*" -print0)
+  done < <(repo_files "*.sh")
 
   if [[ $violations -eq 0 ]]; then
     log "INFO" "✅ All shell scripts pass validation"
@@ -156,37 +305,20 @@ validate_shell_scripts() {
   return $violations
 }
 
-# Check environment variable usage
-check_environment_variables() {
-  log "INFO" "Checking environment variable usage..."
-
-  local violations=0
-
-  # Look for unprotected variable assignments
-  while IFS= read -r -d '' file; do
-    # Skip binary files and specific files
-    if file "$file" | grep -q "text" && [[ ! "$file" =~ \.(log|env)$ ]]; then
-      # Check for variables that should use default patterns
-      if grep -E '^[A-Z_]+=.+$' "$file" >/dev/null 2>&1; then
-        # Check if they use proper defaulting
-        if ! grep -E '\$\{[A-Z_]+:-[^}]*\}' "$file" >/dev/null 2>&1; then
-          local suspicious_vars
-          suspicious_vars=$(grep -E '^[A-Z_]+=.+$' "$file" | head -3)
-          if [[ -n "$suspicious_vars" ]]; then
-            log "WARN" "❌ Potential hardcoded variables in ${file}: ${suspicious_vars}"
-            violations=$((violations + 1))
-          fi
-        fi
-      fi
-    fi
-  done < <(find "${REPO_ROOT}" -type f -not -path "*/.git/*" -not -path "*/.github/security-policies/*" -print0)
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ Environment variable usage is appropriate"
-  fi
-
-  return $violations
-}
+# check_environment_variables() was removed here.
+#
+# It warned when a file contained `^[A-Z_]+=...` but did not also contain
+# `${VAR:-default}` ANYWHERE in the same file. That is not a security
+# property: one defaulted variable anywhere exempted every assignment in the
+# file, and a file with no defaults at all — a constants file, a .env
+# template, a generated manifest — was flagged regardless of whether any
+# value was sensitive. It ran `file` on every path in the working tree to
+# decide what to read.
+#
+# There is no threshold that makes the condition meaningful, so it is gone
+# rather than tuned. Hardcoded credentials are what gitleaks and the pattern
+# list in scan_secrets() are for, and they judge the value rather than
+# whether a neighbouring line happens to use parameter expansion.
 
 # Validate OPA policies
 validate_policies() {
@@ -197,6 +329,11 @@ validate_policies() {
     return 1
   fi
 
+  if ! have_tool opa; then
+    log "WARN" "⏭  OPA policy validation SKIPPED (opa not installed)"
+    return 2
+  fi
+
   if opa test "${POLICIES_DIR}" >/dev/null 2>&1; then
     log "INFO" "✅ OPA policies are valid"
     return 0
@@ -228,14 +365,27 @@ check_sensitive_files() {
     "id_ed25519"
   )
 
+  # Tracked files only. A `.env` a contributor keeps locally, or a key in an
+  # ignored scratch directory, is not something this repository ships — and
+  # flagging it trains people to ignore the check. What matters is whether
+  # such a file is committed.
+  #
+  # Each name is queried at the root AND at any depth. A git pathspec with a
+  # wildcard (`*.key`) already matches at any depth, because `*` spans `/` in
+  # pathspecs; a bare name (`id_rsa`, `.env`) matches ONLY at the repository
+  # root. Without the `*/` form, a committed `.ssh/id_rsa` — the likeliest
+  # place for a private key to appear — would not have been reported at all.
+  local pattern file
   for pattern in "${sensitive_patterns[@]}"; do
     while IFS= read -r -d '' file; do
-      # Skip allowed files
-      if [[ ! "$file" =~ (environment-template\.env|\.pub$) ]]; then
-        log "WARN" "❌ Sensitive file detected: ${file}"
+      if [[ ! "$file" =~ (environment-template\.env|\.pub$|KEYS\.asc$) ]]; then
+        log "WARN" "❌ Sensitive file committed: ${file}"
         violations=$((violations + 1))
       fi
-    done < <(find "${REPO_ROOT}" -name "${pattern}" -not -path "*/.git/*" -print0)
+    done < <(
+      repo_files "${pattern}"
+      repo_files "*/${pattern}"
+    )
   done
 
   if [[ $violations -eq 0 ]]; then
@@ -245,6 +395,25 @@ check_sensitive_files() {
   return $violations
 }
 
+# Render the checklist from what actually ran, so a failing check cannot show
+# a tick. The previous version printed six fixed ✅ lines regardless of outcome,
+# including one for a check that no longer exists.
+_report_checklist() {
+  local i
+  # An empty array expansion is an unbound-variable error under `set -u` on
+  # bash 3.2, so the guard is load-bearing, not defensive noise.
+  [[ ${#CHECK_NAMES[@]} -eq 0 ]] && return 0
+  for i in "${!CHECK_NAMES[@]}"; do
+    if [[ "${CHECK_RESULTS[$i]}" == "SKIPPED" ]]; then
+      echo "- ⏭ ${CHECK_NAMES[$i]} — SKIPPED (required tool not installed)"
+    elif [[ "${CHECK_RESULTS[$i]}" == "0" ]]; then
+      echo "- ✅ ${CHECK_NAMES[$i]}"
+    else
+      echo "- ❌ ${CHECK_NAMES[$i]} (${CHECK_RESULTS[$i]} violation(s))"
+    fi
+  done
+}
+
 # Generate security report
 generate_report() {
   local total_violations="$1"
@@ -261,12 +430,7 @@ generate_report() {
 
 ## Security Checks Performed
 
-- ✅ Secrets scanning (gitleaks + manual patterns)
-- ✅ File permissions validation
-- ✅ Shell script analysis (shellcheck)
-- ✅ Environment variable usage check
-- ✅ OPA policy validation
-- ✅ Sensitive files detection
+$(_report_checklist)
 
 ## Security Score
 
@@ -275,10 +439,9 @@ $(if [[ $total_violations -eq 0 ]]; then echo "🟢 **PASSED** - No security vio
 ## Recommendations
 
 1. Review any flagged violations in the audit log
-2. Update hardcoded values to use environment variables
-3. Ensure proper file permissions (644 for files, 755 for executables)
-4. Use the provided environment template for configuration
-5. Run this script regularly as part of your development workflow
+2. Ensure proper file permissions (644 for files, 755 for executables)
+3. Keep secrets out of tracked files; use the environment template for configuration
+4. Run this script regularly as part of your development workflow
 
 ## Next Steps
 
@@ -302,15 +465,69 @@ main() {
 
   check_dependencies
 
+  # Report what is installed and stop, without scanning.
+  #
+  # A full pass walks every tracked file and runs shellcheck over each tracked
+  # script — ~85s here. That is the right cost for a gate and the wrong cost
+  # for a caller that only wants to know whether the tooling is present, or a
+  # smoke test checking the command is wired up.
+  #
+  # The feature-matrix test got this for free from a bug: gitleaks and opa were
+  # fatal dependencies, so on a machine without them the script exited before
+  # doing any work. Fixing that turned a sub-second test into a full scan
+  # inside a 120s budget, and it began failing on the macOS runners. This is
+  # the same fast path, made deliberate and documented rather than accidental.
+  if [[ "${DOTFILES_POLICY_DEPS_ONLY:-0}" == "1" ]]; then
+    log "INFO" "Dependency check only (DOTFILES_POLICY_DEPS_ONLY=1); no scan performed"
+    ui_ok "Dependencies checked"
+    exit 0
+  fi
+
   local total_violations=0
 
-  # Run all checks
-  scan_secrets || total_violations=$((total_violations + $?))
-  check_file_permissions || total_violations=$((total_violations + $?))
-  validate_shell_scripts || total_violations=$((total_violations + $?))
-  check_environment_variables || total_violations=$((total_violations + $?))
-  validate_policies || total_violations=$((total_violations + 1))
-  check_sensitive_files || total_violations=$((total_violations + $?))
+  # Run all checks, recording each outcome for the report.
+  local rc
+
+  local label
+
+  rc=0
+  scan_secrets || rc=$?
+  label="Secrets scanning (gitleaks + high-signal patterns)"
+  have_tool gitleaks || label="Secrets scanning (pattern scan only, gitleaks absent)"
+  record_check "$label" "$rc"
+  total_violations=$((total_violations + rc))
+
+  rc=0
+  check_file_permissions || rc=$?
+  record_check "File permissions validation" "$rc"
+  total_violations=$((total_violations + rc))
+
+  # rc 2 is the skip sentinel: the tool that backs this check is absent. A skip
+  # adds nothing to the violation count and is rendered as SKIPPED, never as a
+  # tick — use DOTFILES_POLICY_STRICT=1 to make it an error instead.
+  rc=0
+  validate_shell_scripts || rc=$?
+  if have_tool shellcheck; then
+    record_check "Shell script analysis (shellcheck)" "$rc"
+    total_violations=$((total_violations + rc))
+  else
+    record_check "Shell script analysis (shellcheck)" "SKIPPED"
+  fi
+
+  rc=0
+  validate_policies || rc=$?
+  if have_tool opa; then
+    [[ $rc -ne 0 ]] && rc=1
+    record_check "OPA policy validation" "$rc"
+    total_violations=$((total_violations + rc))
+  else
+    record_check "OPA policy validation" "SKIPPED"
+  fi
+
+  rc=0
+  check_sensitive_files || rc=$?
+  record_check "Sensitive files detection" "$rc"
+  total_violations=$((total_violations + rc))
 
   # Generate report
   generate_report "$total_violations"

package/scripts/security/firewall.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 ## Configure system firewall with secure defaults.
 ##

package/scripts/security/lock-configs.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # MIT License
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # See LICENSE file for details.
 

package/scripts/security/lock-screen.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 

package/scripts/security/manage-secrets.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 ## Secure Configuration Management.
 ##

package/scripts/security/ssh-cert.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # shellcheck shell=bash
 set -euo pipefail

package/scripts/security/telemetry-kill.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 

package/scripts/security/usb-safety.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 

package/scripts/theme/apply-gnome-theme.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 ## Apply GNOME Theme — Apply Catppuccin themes to GNOME desktop.
 ##

package/scripts/theme/extract-heic-frames.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # extract-heic-frames.sh — extract per-frame PNGs from dynamic HEIC wallpapers.
 #