lzap

Gunicorn systemd socket-activation proof

This reproducer verifies that Gunicorn accepts a listener created by systemd without calling listen() on it again.

Requirements

• Linux with a running systemd --user manager
• Python and a checkout of Gunicorn containing the socket-activation fix

lzap

Sep 14 06:32:27 localhost kernel: Linux version 6.12.0-211.7.1.el10_2.x86_64 (mockbuild@0aa6f350df034311bd09c6808c685efb) (gcc (GCC) 14.3.1 20251022 (Red Hat 14.3.1-4), GNU ld version 2.41-63.el10) #1 SMP PREEMPT_DYNAMIC Wed Apr  1 08:43:43 EDT 2026
Sep 14 06:32:27 localhost kernel: Command line: BOOT_IMAGE=(hd0,gpt2)/vmlinuz-6.12.0-211.7.1.el10_2.x86_64 root=UUID=4db8bfe4-19a7-44e5-84cc-a364b901de64 ro console=tty0 rd_NO_PLYMOUTH crashkernel=2G-64G:256M,64G-:512M resume=UUID=f611791e-6040-4fdb-915c-7786c1cbc9fc console=ttyS0,115200
Sep 14 06:32:27 localhost kernel: x86/split lock detection: #DB: warning on user-space bus_locks
Sep 14 06:32:27 localhost kernel: BIOS-provided physical RAM map:
Sep 14 06:32:27 localhost kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
Sep 14 06:32:27 localhost kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
Sep 14 06:32:27 localhost kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
Sep 14 06:32:27 localhost kern

lzap

Sep 11 10:48:21 localhost kernel: Linux version 6.12.0-124.8.1.el10_1.x86_64 (mockbuild@462d16d0e38c4a9483d18c77366ae01b) (gcc (GCC) 14.3.1 20250617 (Red Hat 14.3.1-2), GNU ld version 2.41-58.el10) #1 SMP PREEMPT_DYNAMIC Fri Oct 17 13:03:58 EDT 2025
Sep 11 10:48:21 localhost kernel: Command line: BOOT_IMAGE=(hd0,gpt2)/vmlinuz-6.12.0-124.8.1.el10_1.x86_64 root=UUID=2d1abad2-e7ec-40ad-944c-ab916460bbc7 ro console=tty0 rd_NO_PLYMOUTH crashkernel=2G-64G:256M,64G-:512M resume=UUID=ce3d8702-f981-419d-a5ed-7e809ba2f5dd console=ttyS0,115200
Sep 11 10:48:21 localhost kernel: x86/split lock detection: #DB: warning on user-space bus_locks
Sep 11 10:48:21 localhost kernel: BIOS-provided physical RAM map:
Sep 11 10:48:21 localhost kernel: BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
Sep 11 10:48:21 localhost kernel: BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
Sep 11 10:48:21 localhost kernel: BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
Sep 11 10:48:21 localhost kern

lzap

diff --git a/app/models/operatingsystem.rb b/app/models/operatingsystem.rb
index c81cf7b06..0ba6f786d 100644
--- a/app/models/operatingsystem.rb
+++ b/app/models/operatingsystem.rb
@@ -267,7 +267,7 @@ class Operatingsystem < ApplicationRecord
     return default_boot_filename if host.nil? || host.pxe_loader.nil?
     return host.foreman_url('iPXE') if host.pxe_loader == 'iPXE Embedded'
     architecture = host.arch.nil? ? '' : host.arch.bootfilename_efi
-    if host.subnet&.httpboot? && host.pxe_loader =~ /UEFI HTTP/
+    filename = if host.subnet&.httpboot? && host.pxe_loader =~ /UEFI HTTP/

lzap

diff --git a/app/helpers/authorize_helper.rb b/app/helpers/authorize_helper.rb
index 000a8368f..252758cff 100644
--- a/app/helpers/authorize_helper.rb
+++ b/app/helpers/authorize_helper.rb
@@ -21,6 +21,12 @@ module AuthorizeHelper
     if object.nil?
       user.allowed_to?({ :controller => controller_name, :action => action, :id => id, :user_id => user_id }) rescue false
     else
+      if params.has_key?(:include_permissions)
+        Foreman::Logging.logger('permissions').debug do

lzap

#!/usr/bin/env bash
#
# git-configure: set up a repo the way I like it.
#
#   1. If the repo lives on github.com, make sure the remotes follow my
#      convention:
#        upstream -> the canonical project
#        origin   -> git@github.com:lzap/<repo>.git   (my fork; created via gh
#                    if it does not exist yet)
#   2. Rename a local "develop" or "master" branch to "main" and point it at

lzap

#!/usr/bin/env ruby
# Reproducer: net-ssh 7.3.3 vs RHEL10 (OpenSSH 9.9)
#
# Run with: bundle exec ruby rhel10_ssh_reproducer.rb [host] [user]

require "bundler/setup"
require "net/ssh"

HOST = ARGV[0] || "192.168.122.73"
USER = ARGV[1] || "lzap"

lzap

{
  "profiles": [
    {
      "id": "xccdf_org.ssgproject.content_profile_cis_server_l1",
      "base_profile_id": "xccdf_org.ssgproject.content_profile_cis_server_l1",
      "title": "CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server",
      "groups": {},
      "rules": {
        "xccdf_org.ssgproject.content_rule_file_permissions_unauthorized_world_writable": {
          "evaluate": false

lzap

diff --git a/generate_rebuild.py b/generate_rebuild.py
index 1458206..269e29d 100755
--- a/generate_rebuild.py
+++ b/generate_rebuild.py
@@ -150,6 +150,8 @@ def main() -> int:
     """Main entry point."""
     jira = get_jira_client()
 
+    print("TIP: You can now use interactive version of this tool at")
+    print("     https://osbuild.pages.redhat.com/status-dashboard/#cve")

lzap

Get-AppxPackage *ShellExperienceHost* | % {Add-AppxPackage -Register "$($_.InstallLocation)\AppXManifest.xml" -DisableDevelopmentMode}