fix: harden Cloudflare Tunnel repository setup - #41

Merged

LucaLin233 merged 39 commits into

mainfrom

luno/fix-cloudflare-tunnel-source-security

Sep 8, 2026

Commits on Sep 6, 2026

fix: harden Cloudflare Tunnel repository setup
LucaLin233
committed
58b83fa
fix: close Cloudflare repository lifecycle gaps
LucaLin233
committed
88f6439
fix: close Cloudflare source and uninstall trust gaps
LucaLin233
committed
3e69c80
fix: serialize Cloudflare uninstall lifecycle
root
committed
623c557

Commits on Sep 7, 2026

fix: complete Cloudflare uninstall transaction safety
root
committed
12c7349
Merge remote-tracking branch 'origin/main' into luno/fix-cloudflare-tunnel-source-security
root
committed
681b562
fix: close Cloudflare uninstall snapshot lifecycle gaps
root
committed
7622f07
fix: make Cloudflare uninstall rollback verifiable
root
committed
efc4063
fix: close Cloudflare uninstall snapshot lifecycle gaps
root
committed
6c9c410
chore: sync Cloudflare branch with main
root
committed
0e64184
fix: harden Cloudflare uninstall evidence lifecycle
root
committed
efed291
fix: make Cloudflare uninstall evidence transactional
root
committed
c2789b6
fix: verify Cloudflare creation identity and failure journals
root
committed
142b3dc
chore: sync Cloudflare branch with CI selection rules
root
committed
323259c

Commits on Sep 8, 2026

Merge remote-tracking branch 'origin/main' into luno/fix-cloudflare-tunnel-source-security
root
committed
91140af
fix: revalidate published uninstall evidence and trap failures
root
committed
014230f
fix: seal uninstall archives and block interrupted finalization
root
committed
97da2a2
fix: stop install and upgrade after repository rejection
root
committed
84e34cd
fix: retain failed snapshots and clean only owned uninstall stages
root
committed
20deb4f
fix: guard uninstall publication against terminal signals
root
committed
0aea42c
test: verify every uninstall restore failure preserves the full snapshot
root
committed
30e2f0b
test: cover uninstall capture metadata and building signals
root
committed
72938d4
fix: complete all uninstall target verification before returning failure
root
committed
a6016da
fix: handle root anchors and record creation intent before publication
root
committed
0be0c3d
test: inject actual creation bookkeeping failures before linking
root
committed
afaec43
fix: use cloudflared APT repository rather than signing key URL
root
committed
4bf6e8f
fix: reject invalid repository sources before activating rollback
root
committed
85d14f7
fix: prevent repository rollback before verified snapshot completion
root
committed
381b560
test: verify complete snapshot group and failed build evidence
root
committed
4c4e12a
fix: verify repository restore stages and final restored generation
root
committed
64e6a65
Merge remote-tracking branch 'origin/main' into luno/fix-cloudflare-tunnel-source-security
root
committed
79edb6b
Merge remote-tracking branch 'origin/main' into luno/fix-cloudflare-tunnel-source-security
root
committed
9c207f3
fix: preserve updater policy and close reviewed lifecycle trust gaps
root
committed
a46c7ef
fix: track owned repository stages and isolate timer fixture state
root
committed
bd0f4d6
test: cover reviewed cleanup failures and document verified updater compatibility
root
committed
7848117
fix: serialize updater entrypoints and retain interrupted operation evidence
root
committed
e1517c8
test: verify partial disable failures and lock release evidence
root
committed
cbea652
test: cover uninstall lock contention and util-linux dependency failures
root
committed
40c17d8
Merge remote-tracking branch 'origin/main' into luno/fix-cloudflare-tunnel-source-security
root
committed
ea6f0b4