<feed xmlns='http://www.w3.org/2005/Atom'>
<title>src/libexec/nuageinit, branch main</title>
<subtitle>FreeBSD source tree</subtitle>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/'/>
<entry>
<title>nuageinit: validate set-name to prevent shell injection in variable names</title>
<updated>2026-06-09T16:04:25+00:00</updated>
<author>
<name>Baptiste Daroussin</name>
<email>bapt@FreeBSD.org</email>
</author>
<published>2026-06-09T14:24:56+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=13fb6dbc738f4ba30e78a8fb21efa1382c520d33'/>
<id>13fb6dbc738f4ba30e78a8fb21efa1382c520d33</id>
<content type='text'>
Shell variable names cannot be safely quoted with shell_escape() —
only alphanumeric characters are valid. Add validation that set-name
only matches [a-zA-Z0-9]+; invalid values are rejected with a
warning and the rename is skipped entirely.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Shell variable names cannot be safely quoted with shell_escape() —
only alphanumeric characters are valid. Add validation that set-name
only matches [a-zA-Z0-9]+; invalid values are rejected with a
warning and the rename is skipped entirely.
</pre>
</div>
</content>
</entry>
<entry>
<title>nuageinit: fix shell injection in power_state_change delay and add test</title>
<updated>2026-06-09T16:04:25+00:00</updated>
<author>
<name>Baptiste Daroussin</name>
<email>bapt@FreeBSD.org</email>
</author>
<published>2026-06-09T14:19:56+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=09d068e52722dee0ed65eb88c5ea5bff4bb2ba06'/>
<id>09d068e52722dee0ed65eb88c5ea5bff4bb2ba06</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>nuageinit: fix shell command injection in multiple rc.conf.d writes</title>
<updated>2026-06-09T16:04:24+00:00</updated>
<author>
<name>Baptiste Daroussin</name>
<email>bapt@FreeBSD.org</email>
</author>
<published>2026-06-09T14:16:44+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=0211c8722ff2ac9367565e526e62837745bb2cce'/>
<id>0211c8722ff2ac9367565e526e62837745bb2cce</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>nuageinit: use single-quote shell escaping for hostname in rc.conf.d</title>
<updated>2026-06-09T16:04:24+00:00</updated>
<author>
<name>Baptiste Daroussin</name>
<email>bapt@FreeBSD.org</email>
</author>
<published>2026-06-09T14:04:18+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=da3890fdccfa7d540ea746182248299b81f95345'/>
<id>da3890fdccfa7d540ea746182248299b81f95345</id>
<content type='text'>
The hostname value was written inside double quotes in
/etc/rc.conf.d/hostname. POSIX shell performs command substitution
inside double quotes, so a hostname containing $() or backticks would
be executed when the file is sourced (e.g., by rc(8)).

Switch to using the existing shell_escape() helper, which wraps values
in single quotes. In POSIX shell, single-quoted strings are completely
literal — no expansion or substitution of any kind is performed.

While the hostname is already validated to contain only
[a-zA-Z0-9.-], this change provides defense-in-depth so the output
format is safe regardless of future validation changes.

Reported by:	Yazdan Soltani &lt;yazdan.soltani@gmail.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The hostname value was written inside double quotes in
/etc/rc.conf.d/hostname. POSIX shell performs command substitution
inside double quotes, so a hostname containing $() or backticks would
be executed when the file is sourced (e.g., by rc(8)).

Switch to using the existing shell_escape() helper, which wraps values
in single quotes. In POSIX shell, single-quoted strings are completely
literal — no expansion or substitution of any kind is performed.

While the hostname is already validated to contain only
[a-zA-Z0-9.-], this change provides defense-in-depth so the output
format is safe regardless of future validation changes.

Reported by:	Yazdan Soltani &lt;yazdan.soltani@gmail.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>nuageinit: Create parent directories in write_files</title>
<updated>2026-06-08T21:05:09+00:00</updated>
<author>
<name>Jesús Daniel Colmenares Oviedo</name>
<email>dtxdf@FreeBSD.org</email>
</author>
<published>2026-06-08T21:05:09+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=ea3426bc80aad58e689c144ec6ddee0cda7861cb'/>
<id>ea3426bc80aad58e689c144ec6ddee0cda7861cb</id>
<content type='text'>
Currently, 'write_files' does not create parent directories, and
'runcmd' cannot be used here, since those scripts run after the files
have been written. The only workaround is to create the files in an
existing directory, such as '/root' or '/tmp', and then move those
files using 'runcmd', but this is cumbersome when there are many files,
even if they are small.

With this change, nuageinit now creates the parent directories for each
file using the path field, which mimics the same behavior as in
cloud-init.

Permissions and ownership can also be configured using 'runcmd'.

Reviewed by:            bapt@
Approved by:            bapt@
Differential Revision:  https://reviews.freebsd.org/D57395
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Currently, 'write_files' does not create parent directories, and
'runcmd' cannot be used here, since those scripts run after the files
have been written. The only workaround is to create the files in an
existing directory, such as '/root' or '/tmp', and then move those
files using 'runcmd', but this is cumbersome when there are many files,
even if they are small.

With this change, nuageinit now creates the parent directories for each
file using the path field, which mimics the same behavior as in
cloud-init.

Permissions and ownership can also be configured using 'runcmd'.

Reviewed by:            bapt@
Approved by:            bapt@
Differential Revision:  https://reviews.freebsd.org/D57395
</pre>
</div>
</content>
</entry>
<entry>
<title>nuageinit: install certs in /usr/share/certs/trusted</title>
<updated>2026-06-06T19:31:21+00:00</updated>
<author>
<name>Baptiste Daroussin</name>
<email>bapt@FreeBSD.org</email>
</author>
<published>2026-06-06T19:30:53+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=e5ef12ccd01f8ec6c519bf2a56cac2808f78c51a'/>
<id>e5ef12ccd01f8ec6c519bf2a56cac2808f78c51a</id>
<content type='text'>
Suggested by:	kevans
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Suggested by:	kevans
</pre>
</div>
</content>
</entry>
<entry>
<title>nuageinit: update documentation for phone_home and final_message</title>
<updated>2026-06-06T06:17:04+00:00</updated>
<author>
<name>Baptiste Daroussin</name>
<email>bapt@FreeBSD.org</email>
</author>
<published>2026-06-06T06:17:04+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=bad3c15dffea69ea84f95489d26a86ad0498d942'/>
<id>bad3c15dffea69ea84f95489d26a86ad0498d942</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>nuageinit: expose decode_base64 to fix tests</title>
<updated>2026-06-06T06:05:50+00:00</updated>
<author>
<name>Baptiste Daroussin</name>
<email>bapt@FreeBSD.org</email>
</author>
<published>2026-06-06T06:05:50+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=68e60bb8b6c968fe615f81ccc8afd2a30ff78003'/>
<id>68e60bb8b6c968fe615f81ccc8afd2a30ff78003</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>nuageinit: implement phone_home support</title>
<updated>2026-06-05T21:28:25+00:00</updated>
<author>
<name>Baptiste Daroussin</name>
<email>bapt@FreeBSD.org</email>
</author>
<published>2026-06-05T21:28:25+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=58653bf4d0fb8ccd5de146d671ec101a1df0ede0'/>
<id>58653bf4d0fb8ccd5de146d671ec101a1df0ede0</id>
<content type='text'>
Posts instance data (hostname, instance_id, public keys) to a URL
using fetch(1). Supports:
- url: target URL
- post: list of data items to send, or 'all'
- tries: number of retry attempts (default 1)
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Posts instance data (hostname, instance_id, public keys) to a URL
using fetch(1). Supports:
- url: target URL
- post: list of data items to send, or 'all'
- tries: number of retry attempts (default 1)
</pre>
</div>
</content>
</entry>
<entry>
<title>nuageinit: implement final_message support</title>
<updated>2026-06-05T21:03:45+00:00</updated>
<author>
<name>Baptiste Daroussin</name>
<email>bapt@FreeBSD.org</email>
</author>
<published>2026-06-05T21:03:45+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=e01f202ecf9344bd6658869a869f36c5b3790384'/>
<id>e01f202ecf9344bd6658869a869f36c5b3790384</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
</feed>
