entitlement-provider 2.9.81 → 2.9.86

package/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2019-2021 by arlac77
+Copyright (c) 2019-2022 by arlac77
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "entitlement-provider",
-  "version": "2.9.81",
+  "version": "2.9.86",
   "publishConfig": {
     "access": "public"
   },
@@ -26,28 +26,28 @@
     "cover": "c8 -x 'tests/**/*' --temp-directory build/tmp ava --timeout 2m && c8 report -r lcov -o build/coverage --temp-directory build/tmp"
   },
   "dependencies": {
-    "@kronos-integration/interceptor-decode-json": "^2.1.52",
-    "@kronos-integration/service": "^10.4.8",
-    "@kronos-integration/service-admin": "^3.4.40",
-    "@kronos-integration/service-authenticator": "^1.6.0",
-    "@kronos-integration/service-health": "^5.0.127",
-    "@kronos-integration/service-http": "^10.6.78",
-    "@kronos-integration/service-ldap": "^4.0.62",
-    "@kronos-integration/service-smtp": "^1.0.53",
-    "model-attributes": "^4.1.12"
+    "@kronos-integration/interceptor-decode-json": "^2.1.56",
+    "@kronos-integration/service": "^10.4.15",
+    "@kronos-integration/service-admin": "^3.4.45",
+    "@kronos-integration/service-authenticator": "^1.6.8",
+    "@kronos-integration/service-health": "^5.0.134",
+    "@kronos-integration/service-http": "^10.6.91",
+    "@kronos-integration/service-ldap": "^4.0.70",
+    "@kronos-integration/service-smtp": "^1.0.58",
+    "model-attributes": "^4.1.13"
   },
   "devDependencies": {
-    "@semantic-release/commit-analyzer": "^9.0.1",
-    "@semantic-release/exec": "^6.0.2",
-    "@semantic-release/release-notes-generator": "^10.0.2",
-    "ava": "^3.15.0",
+    "@semantic-release/commit-analyzer": "^9.0.2",
+    "@semantic-release/exec": "^6.0.3",
+    "@semantic-release/release-notes-generator": "^10.0.3",
+    "ava": "^4.0.1",
     "c8": "^7.1.0",
-    "got": "11.8.2",
-    "npm-pkgbuild": "^6.12.67",
-    "semantic-release": "^18.0.0"
+    "got": "12.0.1",
+    "npm-pkgbuild": "^7.23.5",
+    "semantic-release": "^19.0.2"
   },
   "optionalDependencies": {
-    "@kronos-integration/service-systemd": "^2.5.2"
+    "@kronos-integration/service-systemd": "^2.5.3"
   },
   "engines": {
     "node": ">=16.13.0"
@@ -72,40 +72,34 @@
     "base": "/services/entitlements/api",
     "socket": "/run/${name}/http/socket"
   },
-  "systemd": {
-    "units": {
-      "${name}": "systemd/${name}*"
-    }
-  },
-  "pacman": {
-    "arch": [
-      "aarch64",
-      "armv7h",
-      "x86_64"
-    ],
+  "pkg": {
     "backup": "etc/${name}/config.json",
     "content": {
-      "/usr/lib/tmpfiles.d/${name}.conf": "pacman/tmpfiles.conf",
+      "/usr/lib/systemd/system": {
+        "base": "systemd"
+      },
+      "/usr/lib/tmpfiles.d/${name}.conf": "pkg/tmpfiles.conf",
       "/etc/${name}/config.json": "config/config.json",
-      "/etc/nginx/sites/common/${name}.conf": "pacman/nginx.conf",
+      "/etc/nginx/sites/common/${name}.conf": "pkg/nginx.conf",
       "/srv/http/.well-known/openid-configuration": "config/openid-configuration",
-      "/usr/lib/sysusers.d/${name}.conf": "pacman/sysusers.conf"
+      "/usr/lib/sysusers.d/${name}.conf": "pkg/sysusers.conf",
+      "${installdir}/": [
+        {
+          "type": "npm-pack"
+        },
+        {
+          "type": "node-modules"
+        }
+      ]
     },
     "depends": {
-      "systemd": ">=249.5",
-      "nginx-mainline": ">=1.21.1"
+      "systemd": ">=250.3",
+      "nginx-mainline": ">=1.21.4"
     },
     "groups": "user admin",
-    "hooks": "pacman/hooks.sh",
+    "hooks": "pkg/hooks.sh",
     "installdir": "/services/${name}",
-    "group": "services",
-    "content-provider": {
-      "systemd": {
-        "units": {
-          "${name}": "systemd/${name}*"
-        }
-      }
-    }
+    "group": "services"
   },
   "release": {
     "plugins": [
@@ -115,8 +109,7 @@
       [
         "@semantic-release/exec",
         {
-          "verifyConditionsCmd": "which makepkg",
-          "publishCmd": "npx npm-pkgbuild --pkgver ${nextRelease.version} --npm-dist --npm-modules pkgbuild pacman makepkg"
+          "publishCmd": "npx npm-pkgbuild"
         }
       ],
       "@semantic-release/npm"
@@ -125,7 +118,7 @@
   "template": {
     "inheritFrom": [
       "arlac77/template-arlac77-github",
-      "arlac77/template-kronos-app"
+      "arlac77/template-kronos-app#next"
     ]
   }
 }

package/systemd/entitlement-provider.service

@@ -19,7 +19,9 @@ OOMPolicy=stop
 User={{name}}
 Group={{name}}
 SupplementaryGroups=http
+CapabilityBoundingSet=~CAP_SYS_BOOT
 NoNewPrivileges=true
+UMask=0077
 ProtectSystem=full
 ProtectHome=true
 RuntimeDirectory={{name}}/http
@@ -38,12 +40,14 @@ ProtectKernelModules=true
 ProtectKernelLogs=true
 ProtectControlGroups=true
 LockPersonality=true
+RestrictRealtime=true
 RestrictSUIDSGID=true
 CPUWeight=10
 IOWeight=10
 MemoryAccounting=true
 MemoryHigh=30M
 MemoryMax=60M
+ProtectProc=noaccess
 SystemCallErrorNumber=EPERM
 
 [Install]