fartbagxp fartbagxp

Semantic Versioning for IAC - `iacver`

When it comes to Infrastructure As Code, the software versioning system known as Semantic Versioning (semver.org) works from an API perspective but falls short elsewhere.

In short a semver is broken down into three "octets" and optional, additional information tagged to the end. Here are a few examples: v1.0.1, v3.1.1, v1.15.0-4. Each of these is a valid semver.

If we take the first example - v1.0.1 - and change the first octet, 1, to 2, we're saying the following:

There has been a change to this code and that change is not compatible with how you're using v1.0.1. The change is a breaking change. You should take care to introduce version v2.0.0 into your code or your environment.

Git Commit Freeze Due to GPG Lock Issues

If you encounter a problem where you cannot commit changes in Git – neither through the terminal nor via the GitHub Desktop application – the issue might be a freeze during the Git commit process. This is often caused by GPG lock issues. Below is a concise and step-by-step guide to resolve this problem.

Solution Steps

1. Check for GPG Lock Messages

Open your terminal and try to perform a GPG operation (like signing a test message). If you see repeated messages like gpg: waiting for lock (held by [process_id]) ..., it indicates a lock issue.

name	description
Pipeline Investigation	Debug GitLab CI/CD pipeline failures using glab CLI. Investigate failed jobs, analyze error logs, trace child pipelines, and compare Node version differences. Use for pipeline failures, job errors, build issues, or when the user mentions GitLab pipelines, CI/CD problems, specific pipeline IDs, failed builds, or job logs.

Investigating GitLab Pipelines

Use this skill when investigating GitLab CI/CD pipeline issues.

When to Use

SHA1Hulud Vulnerability Checker

Check all repositories in a GitHub organization for SHA1Hulud vulnerabilities by analyzing lock files via GitHub API (no cloning required).

Usage

export GITHUB_ORG=myorg
export GITHUB_TOKEN=ghp_xxx
curl -s https://gist.githubusercontent.com/Lp-Francois/cf203ef12ffd597dceb4716900e0dbe1/raw/392abd4bf134245085fb877ed837d47b5b60b487/check-github-org-sha1hulud.js | node

	# based on https://github.com/unicorn-engine/unicorn/blob/master/bindings/python/sample_arm.py

	from __future__ import print_function
	from unicorn import *
	from unicorn.arm_const import *

	# https://github.com/raspberrypi/pico-bootrom/blob/ef22cd8ede5bc007f81d7f2416b48db90f313434/bootrom/bootrom_rt0.S#L441-L445
	CODE = bytes.fromhex("""
	.byte 0x11, 0x38, 0xc0, 0x7a, 0x00, 0xbd, 0x00, 0xb5
	.byte 0x42, 0x40, 0x00, 0x2a, 0x00, 0xf0, 0x02, 0xf8

	FROM debian:latest

	# Install basic dev packages
	RUN apt-get clean && apt-get update && apt-get -y install --no-install-recommends \
	apt-utils \
	openssh-client \
	git \
	gnupg2 \
	dirmngr \
	iproute2 \

	// I'm tired of extensions that automatically:
	// - show welcome pages / walkthroughs
	// - show release notes
	// - send telemetry
	// - recommend things
	//
	// This disables all of that stuff.
	// If you have more config, leave a comment so I can add it!!

	{

	"""
	Script to automatically update uv.lock and then update pyproject.toml dependencies.

	Prerequisites:
	1. Python 3.11+ (for tomllib)
	2. tomli-w package (`pip install tomli-w`)
	3. uv installed and available in PATH

	Usage:
	Run this script: `python upgrade_pyproject.py`

	#cloud-config

	# Enable automatic package updates and upgrades during cloud-init execution
	package_update: true
	package_upgrade: true

	packages:
	# Security and Hardening
	- ufw
	- fail2ban