entitlement-provider 2.9.83 → 2.9.87

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "entitlement-provider",
-  "version": "2.9.83",
+  "version": "2.9.87",
   "publishConfig": {
     "access": "public"
   },
@@ -23,28 +23,29 @@
   "scripts": {
     "test": "npm run test:ava",
     "test:ava": "ava --timeout 2m tests/*.mjs",
-    "cover": "c8 -x 'tests/**/*' --temp-directory build/tmp ava --timeout 2m && c8 report -r lcov -o build/coverage --temp-directory build/tmp"
+    "cover": "c8 -x 'tests/**/*' --temp-directory build/tmp ava --timeout 2m && c8 report -r lcov -o build/coverage --temp-directory build/tmp",
+    "pkg": "npm-pkgbuild --verbose -D version=0.0.0 --publish dist"
   },
   "dependencies": {
-    "@kronos-integration/interceptor-decode-json": "^2.1.52",
-    "@kronos-integration/service": "^10.4.11",
-    "@kronos-integration/service-admin": "^3.4.42",
-    "@kronos-integration/service-authenticator": "^1.6.2",
-    "@kronos-integration/service-health": "^5.0.129",
-    "@kronos-integration/service-http": "^10.6.83",
-    "@kronos-integration/service-ldap": "^4.0.67",
-    "@kronos-integration/service-smtp": "^1.0.55",
-    "model-attributes": "^4.1.12"
+    "@kronos-integration/interceptor-decode-json": "^2.1.56",
+    "@kronos-integration/service": "^10.4.15",
+    "@kronos-integration/service-admin": "^3.4.45",
+    "@kronos-integration/service-authenticator": "^1.6.8",
+    "@kronos-integration/service-health": "^5.0.134",
+    "@kronos-integration/service-http": "^10.6.91",
+    "@kronos-integration/service-ldap": "^4.0.71",
+    "@kronos-integration/service-smtp": "^1.0.60",
+    "model-attributes": "^4.1.13"
   },
   "devDependencies": {
     "@semantic-release/commit-analyzer": "^9.0.2",
     "@semantic-release/exec": "^6.0.3",
-    "@semantic-release/release-notes-generator": "^10.0.2",
-    "ava": "^3.15.0",
+    "@semantic-release/release-notes-generator": "^10.0.3",
+    "ava": "^4.0.1",
     "c8": "^7.1.0",
-    "got": "12.0.0",
-    "npm-pkgbuild": "^6.12.83",
-    "semantic-release": "^18.0.1"
+    "got": "12.0.1",
+    "npm-pkgbuild": "^7.23.5",
+    "semantic-release": "^19.0.2"
   },
   "optionalDependencies": {
     "@kronos-integration/service-systemd": "^2.5.3"
@@ -72,40 +73,37 @@
     "base": "/services/entitlements/api",
     "socket": "/run/${name}/http/socket"
   },
-  "systemd": {
-    "units": {
-      "${name}": "systemd/${name}*"
-    }
-  },
-  "pacman": {
-    "arch": [
-      "aarch64",
-      "armv7h",
-      "x86_64"
-    ],
+  "pkg": {
     "backup": "etc/${name}/config.json",
     "content": {
-      "/usr/lib/tmpfiles.d/${name}.conf": "pacman/tmpfiles.conf",
+      "/usr/lib/systemd/system/": {
+        "base": "systemd"
+      },
+      "/usr/lib/tmpfiles.d/${name}.conf": "pkg/tmpfiles.conf",
       "/etc/${name}/config.json": "config/config.json",
-      "/etc/nginx/sites/common/${name}.conf": "pacman/nginx.conf",
+      "/etc/nginx/sites/common/${name}.conf": "pkg/nginx.conf",
       "/srv/http/.well-known/openid-configuration": "config/openid-configuration",
-      "/usr/lib/sysusers.d/${name}.conf": "pacman/sysusers.conf"
+      "/usr/lib/sysusers.d/${name}.conf": "pkg/sysusers.conf",
+      "${installdir}/": [
+        {
+          "type": "npm-pack"
+        },
+        {
+          "type": "node-modules"
+        }
+      ]
+    },
+    "output": {
+      "arch": {}
     },
     "depends": {
-      "systemd": ">=250",
-      "nginx-mainline": ">=1.21.1"
+      "systemd": ">=250.3",
+      "nginx-mainline": ">=1.21.4"
     },
     "groups": "user admin",
-    "hooks": "pacman/hooks.sh",
+    "hooks": "pkg/hooks.sh",
     "installdir": "/services/${name}",
-    "group": "services",
-    "content-provider": {
-      "systemd": {
-        "units": {
-          "${name}": "systemd/${name}*"
-        }
-      }
-    }
+    "group": "services"
   },
   "release": {
     "plugins": [
@@ -115,8 +113,7 @@
       [
         "@semantic-release/exec",
         {
-          "verifyConditionsCmd": "which makepkg",
-          "publishCmd": "npx npm-pkgbuild --pkgver ${nextRelease.version} --npm-dist --npm-modules pkgbuild pacman makepkg"
+          "publishCmd": "npx npm-pkgbuild"
         }
       ],
       "@semantic-release/npm"
@@ -125,7 +122,7 @@
   "template": {
     "inheritFrom": [
       "arlac77/template-arlac77-github",
-      "arlac77/template-kronos-app"
+      "arlac77/template-kronos-app#next"
     ]
   }
 }

package/systemd/entitlement-provider.service

@@ -19,6 +19,7 @@ OOMPolicy=stop
 User={{name}}
 Group={{name}}
 SupplementaryGroups=http
+CapabilityBoundingSet=~CAP_SYS_BOOT
 NoNewPrivileges=true
 UMask=0077
 ProtectSystem=full
@@ -39,6 +40,7 @@ ProtectKernelModules=true
 ProtectKernelLogs=true
 ProtectControlGroups=true
 LockPersonality=true
+RestrictRealtime=true
 RestrictSUIDSGID=true
 CPUWeight=10
 IOWeight=10
@@ -48,5 +50,7 @@ MemoryMax=60M
 ProtectProc=noaccess
 SystemCallErrorNumber=EPERM
 
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_ADMIN CAP_NET_ADMIN CAP_SYS_NICE CAP_SYS_RESOURCE CAP_KILLC AP_IPC_LOCK CAP_CHOWN CAP_FSETID CAP_SETFCAP CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_WAKE_ALARM CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_KILL
+
 [Install]
 WantedBy=multi-user.target