jochen d0a3784be2 only-office: bar every account but the converter from the state root (issue 1843) ...

lib (bind-mounted into the container at /var/lib/onlyoffice) was 0711 so
nginx inside the container could reach App_Data/cache, and the module
root above it stayed 0711 too, so any account on the machine could walk
through the root into lib's 0755 directories and 0644 files to read
converted documents. The container never passes through the root — only
the converter process does, to read jwt.secret and
broker-converter.secret — so the root is now 0710, owned by the
converter account: only that account and root pass through it. lib
stays 0711 (1837/AC3).

2026-10-22 16:34:06 +02:00

..

adwaita

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

artifact-store-tools

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

asus-zephyrus-g14

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

audit-logger

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

avahi

avahi: the discovery daemon declared, and why it hears nothing reported

2026-10-04 12:50:20 +02:00

baserow

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

betterbird

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

blueman

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

bluetooth

Add nextcloud-client and blueman: the two tray apps get an owner and tools, each with one start

2026-10-05 11:47:38 +02:00

brother

Give the Service its own fetch client and open-document waits instead of reading package variables from background goroutines, which a test or reload changed meanwhile: data races under -race (issue 1601)

2026-10-21 18:03:58 +02:00

buildah

Add the buildah module and the check that only it provides rootless-image-build (issues 1702, 1704)

2026-10-22 10:27:01 +02:00

ca-trust

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

claude-code

Stop writing an empty refusal-counter file on every stop of every session (issue 1749)

2026-10-21 19:41:05 +02:00

claude-licence-manager

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

clipmenu

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

confluence

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

cups

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

dbus

dbus: hold node-message-bus, and never restart the bus live (hq ADR 0215)

2026-10-05 11:50:52 +02:00

desk-channel

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

dev-tools

Check that only the go and nodejs modules declare the toolchain packages (issue 1573)

2026-10-21 09:50:14 +00:00

disk-load

disk_folders: answer said as a list (issue 1804)

2026-10-22 01:13:35 +02:00

distribution

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

dmenu

dmenu: the package, which makes the notifier's menu work, and a menu tool (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

dnsmasq

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

docker

Count volumes a half-done batch already removed as removed, and test the batching (issue 1796)

2026-10-22 00:23:21 +02:00

docker-compose

docker-compose: the package, and its projects as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

dunst

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

fail2ban

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

feh

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

flatpak

flatpak: the package, Flathub with it, and the installations as tools (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

fonts

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

forticlient

forticlient: hand the client's resolver file to the machine's own resolver (hq ADR 0247)

2026-10-07 21:35:50 +02:00

gitea

Let gitea read the image build module's keys, so its key is the builders' (issue 1703f)

2026-10-22 10:27:01 +02:00

gitlab

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

gnome-keyring

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

go

Say in the go and nodejs READMEs that they are now the only declarers (issue 1573)

2026-10-21 09:51:22 +00:00

grafana

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

hello-web

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

home-assistant

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

hostname

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

i3

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

i3status-rust

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

icecast

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

influxdb

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

invoicing

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

jira

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

kernel

issue 1838: refuse a node name of this mesh in the pacman and kernel modules

2026-10-22 14:15:53 +02:00

keycloak

Pin gitea, keycloak, mesh-provisioner-client, postgres and route-adapter to a commit of mesh-sdk main, since the pinned one is on a feature branch only (issue 1663)

2026-10-21 14:07:01 +02:00

lab

Check that only the go and nodejs modules declare the toolchain packages (issue 1573)

2026-10-21 09:50:14 +00:00

lemurs

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

letta

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

local-model-consumer

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

localization

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

logrotate

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

mailu

Check an image's Dockerfile place instead of refusing the image kind (ADR 0487 clause 13)

2026-10-22 11:44:45 +02:00

marrytts

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

matrix

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

memory-pressure

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mesh-build-go

Leave the go.mod fixtures under testdata out of the build module's tests and digests, so the checker stops running a fixture as a module (issue 1810)

2026-10-22 01:22:31 +02:00

mesh-build-image

Give mesh-build-image the registry's address as the seat's reach, which the provisioner's client fills (issue 1703)

2026-10-22 11:07:50 +02:00

mesh-build-node

Drop the unused imports from the Node fetch preview

2026-10-21 21:24:44 +02:00

mesh-catalog

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mesh-cli

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mesh-config

mesh-config: read the pull request's commit from head_sha (issue 1826)

2026-10-22 11:09:48 +02:00

mesh-delivery-gate

Never hold a message past its first hold's limit, so a fault on a machine walk after walk touches still reaches the operator (ADR 0505 §7)

2026-10-22 14:36:35 +02:00

mesh-files

Bound an upload and a download to 25 s, so a tool call is never cut while the transfer goes on (issue 1597)

2026-10-21 15:21:56 +02:00

mesh-issues

List mesh-build-image among the issue tracker's owners

2026-10-22 10:51:40 +02:00

mesh-knowledge

Take the ask back on the router when withdrawing a record (issue 1081, review round 1)

2026-10-18 00:09:16 +02:00

mesh-mail

Declare the seat mail-reading and the module mesh-mail-reader's skeleton (issue 1426)

2026-10-20 23:50:02 +02:00

mesh-mail-notifier

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mesh-mail-reader

Fix the try on 8000b637 and review round 2: RunBatches takes its gap as a parameter instead of reading the var BatchGap, and no tell while unhealthy is checked as an exact count, not a before/after that a same-pass tell could hide behind (issue 1520, 1524)

2026-10-21 01:52:58 +02:00

mesh-mail-web

Review round 1: an unset mail-reading verb answers unavailable not unknown, cache the index instead of leaking a pool per call, a gone mail leaves the queue without going unhealthy, sort the judge's own cause by its words, drive RunBatches itself for its pacing test, and prove no tell while unhealthy against a genuinely untold mail (issues 1430, 1523, 1517, 1518, 1520, 1519, 1524)

2026-10-21 01:48:23 +02:00

mesh-provisioner

Pin mesh-provisioner, mesh-vault and rofi to a commit of mesh-sdk main, since the pinned one is on no branch and no fetch can resolve it (issue 1659)

2026-10-21 13:14:57 +02:00

mesh-provisioner-client

Move the socket-return fill tests (issue 1165) to the integration level: they make a real socket and watch its directory

2026-10-21 21:57:53 +02:00

mesh-reads

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mesh-vault

Pin mesh-provisioner, mesh-vault and rofi to a commit of mesh-sdk main, since the pinned one is on no branch and no fetch can resolve it (issue 1659)

2026-10-21 13:14:57 +02:00

mesh-watcher

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

messenger

Format the ADR 0505 test file, so the repository check passes

2026-10-22 15:00:37 +02:00

minio

Make link-key secrets 40 characters and keep every mc argument's secret out of its errors (issue 1766)

2026-10-21 20:21:56 +02:00

model-usage

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mongodb

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mosquitto

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mounts

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

mssql

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

n8n

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

nats

Verify the bus's snapshot with a tool, sharing the snapshot program's archive code (issue 1842)

2026-10-22 14:24:25 +02:00

netcheck

Refuse a host in a short or legacy numeric form (127.1, 2130706433, 0x7f.0.0.1) in netcheck_request before any lookup, so the refusal does not depend on the resolver

2026-10-21 13:07:08 +02:00

networkmanager

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

nextcloud

nextcloud: keep checking onlyoffice's connection while the last check failed (issue 1832)

2026-10-22 16:28:35 +02:00

nextcloud-client

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

nfs-server

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

nftables

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

nm-applet

Give the remaining tray applets their modules, each with one start

2026-10-05 15:10:30 +02:00

node-env

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

nodejs

Say in the go and nodejs READMEs that they are now the only declarers (issue 1573)

2026-10-21 09:51:22 +00:00

nodered

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

ollama

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

only-office

only-office: bar every account but the converter from the state root (issue 1843)

2026-10-22 16:34:06 +02:00

openai-consumer

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

openrazer

Declare the operator's account in the openrazer group (hq ADR 0252, issue 247)

2026-10-08 12:04:08 +02:00

pacman

Say a weekly upgrade that hangs past two hours, so a stuck pacman lock is loud (issue 1574, ADR 0477)

2026-10-21 08:08:04 +00:00

photos-eef

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

photos-filip

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

picom

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

polychromatic

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

postgres

Pin gitea, keycloak, mesh-provisioner-client, postgres and route-adapter to a commit of mesh-sdk main, since the pinned one is on a feature branch only (issue 1663)

2026-10-21 14:07:01 +02:00

power

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

powerlevel10k

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

records

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

redis

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

restic

Record a backup that cannot start as the module's last night (issue 1067)

2026-10-17 22:42:21 +02:00

rofi

Pin mesh-provisioner, mesh-vault and rofi to a commit of mesh-sdk main, since the pinned one is on no branch and no fetch can resolve it (issue 1659)

2026-10-21 13:14:57 +02:00

route-adapter

Pin gitea, keycloak, mesh-provisioner-client, postgres and route-adapter to a commit of mesh-sdk main, since the pinned one is on a feature branch only (issue 1663)

2026-10-21 14:07:01 +02:00

screen-lock

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

searxng

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

sensors

sensors: take a SAS drive's standby, whose mode holds spaces

2026-10-08 15:04:02 +02:00

showcase

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

slack

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

snapd

snapd: tools for the snaps, the package blocked on the mesh's AUR repository (hq to-be 42 phase 2.9)

2026-10-04 13:02:23 +02:00

ssh-client

Review round 1 for the checks, ssh-client and the Go build module: sshdir (1484), socket path (1486), over_bound (1290, 1486), toolchain.reported and streams (1483), re-pin to mesh-sdk 36d6f774; delta part 2 of 4

2026-10-20 21:09:36 +00:00

sshd

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

step-ca

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

sudo

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

supabase

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

systemd

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

systemd-networkd

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

systemd-resolved

systemd-resolved: say when a route's domains do cross the bus

2026-10-07 21:35:49 +02:00

telegram

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

time-sync

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

triggerhappy

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

umami

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

unifi

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

website

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

xclip

xclip: the package, and the operator's clipboard from the mesh (hq to-be 42 phase 2.7)

2026-10-04 13:02:23 +02:00

xdg

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

xorg

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

xterm

Make every xterm resource a config value with today's value as default; tools read the rendered resources (issue 1656)

2026-10-21 12:51:40 +02:00

zfs

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

zsh

Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

2026-10-17 16:23:03 +00:00

zsh-autosuggestions

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00

zsh-syntax-highlighting

Feature 57 (config and provisioning): release the catalogue, the reviewed release branch merged with main, on top of main

2026-10-16 09:42:45 +00:00