Add domain controller policies - #134
Merged
silug merged 4 commits intoJul 21, 2026
Merged
Conversation
CLAUDE.md is a gitignored local symlink to it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds lsp_mapping entries and unit tests for: - Domain controller: Allow server operators to schedule tasks - Domain controller: Allow vulnerable Netlogon secure channel connections - Domain controller: LDAP server channel binding token requirements - Domain controller: LDAP server signing requirements - Domain controller: Refuse machine account password changes Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR extends the module’s SecurityPolicy.lsp_mapping to support additional Windows “Domain controller” security options, and adds unit tests and release metadata updates to validate and publish the new support.
Changes:
- Add five new “Domain controller:” registry-value mappings in
SecurityPolicy.lsp_mapping. - Add unit specs covering mapping lookup/reverse-lookup and REG_DWORD/REG_SZ value conversions for the new policies.
- Bump module version to
1.2.0and document the change inCHANGELOG.md(plus addAGENTS.mdguidance).
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| spec/unit/puppet/type/local_security_policy/local_security_policy_spec.rb | Adds type-level spec coverage to ensure DC policies derive registry setting and convert values correctly. |
| spec/unit/puppet/provider/local_security_policy/security_policy_spec.rb | Adds mapping and registry-value conversion specs for the new DC policy entries. |
| lib/puppet_x/lsp/security_policy.rb | Adds the new “Domain controller” policy mappings to the core lookup table. |
| metadata.json | Bumps module version to 1.2.0 for release. |
| CHANGELOG.md | Documents the new 1.2.0 release and policy support additions. |
| AGENTS.md | Adds contributor/assistant guidance on architecture and test commands. |
| .gitignore | Ignores /CLAUDE.md. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The syntax and parallel_spec jobs only need the default group, but bundler-cache installs every group by default. That pulled in the beaker acceptance-test chain (beaker-puppet_install_helper -> beaker-pe -> beaker-abs -> vmfloaty -> faraday-patron -> patron), whose native patron gem fails to build on the runner because libcurl/curl.h isn't present, breaking the syntax job. Acceptance tests already aren't run in CI, so skip installing those groups. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Excluding the acceptance/system_tests groups wasn't enough: the :development group's puppet-module-posix-dev-r2.7 pulls in dependency_checker -> puppet_forge -> faraday_middleware -> faraday, and faraday 1.9.0's gemspec hard-depends on every adapter gem (including faraday-patron) regardless of which adapter is actually used at runtime. faraday-patron requires the native patron gem, which needs libcurl/curl.h to compile. Install libcurl4-openssl-dev before bundle install so that native extension can build. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
silug
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.