Skip to content

docs: prepare v2.1.0 publication #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RomeoRaven merged 5 commits into from
Jul 25, 2026
Merged

docs: prepare v2.1.0 publication #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c873385
docs: prepare v2.1.0 publication
RomeoRaven Jul 25, 2026
5656845
test: enforce canonical publication commands
RomeoRaven Jul 25, 2026
2bc6431
test: fail closed on checkout block
RomeoRaven Jul 25, 2026
6247585
docs: make verified checkout fail closed
RomeoRaven Jul 25, 2026
a98aab1
test: bind module commands to exact fences
RomeoRaven Jul 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 79 additions & 10 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,16 @@ Every module remains standalone: download only the check you need, verify its ch

## Master `onescript` CLI

The master requires a complete verified checkout containing `onescript`, `catalog.tsv`, `SHA256SUMS`, and `scripts/`. The launcher and Linux server diagnostics wave are v2.1.0 release candidates and are not part of the existing `v2.0.0` release; version-pinned installation commands will be added only when that release is approved and published.
The v2.1.0 release provides the complete verified catalog: `onescript`, `catalog.tsv`, `SHA256SUMS`, and all 14 standalone modules under `scripts/`. The four original v2.0.0 modules remain unchanged while the launcher and ten Linux server diagnostics are added in v2.1.0.

Version-pinned verified checkout:

```bash
git clone --depth 1 --branch v2.1.0 https://github.com/RomeoRaven/ONEScripts.git &&
cd ONEScripts &&
sha256sum -c --strict SHA256SUMS &&
./onescript doctor
```

Verify the installed catalog:

Expand Down Expand Up @@ -65,7 +74,7 @@ Collects a privacy-reduced profile covering OS, resources, filesystems, cPanel,
One-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/vps-profile.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.0.0/scripts/vps-profile.sh' && printf '%s %s\n' 'd260a50a2fb3fa0af09edf310da8006246924cf4319a05ad2935c19fd91911ed' "$tmp_dir/vps-profile.sh" | sha256sum -c - && chmod 700 "$tmp_dir/vps-profile.sh" && "$tmp_dir/vps-profile.sh" ./vps-profile.txt)
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/vps-profile.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/vps-profile.sh' && printf '%s %s\n' 'd260a50a2fb3fa0af09edf310da8006246924cf4319a05ad2935c19fd91911ed' "$tmp_dir/vps-profile.sh" | sha256sum -c - && chmod 700 "$tmp_dir/vps-profile.sh" && "$tmp_dir/vps-profile.sh" ./vps-profile.txt)
```

### `cpanel-followup-triage.sh`
Expand All @@ -75,7 +84,7 @@ Reports failed systemd units, privacy-safe Exim queue counts, and bind scope for
One-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/cpanel-followup-triage.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.0.0/scripts/cpanel-followup-triage.sh' && printf '%s %s\n' '5bb1e14491437c42cf6d5169186a2545176dcbbf5ba4367d84aabf0e851f0a23' "$tmp_dir/cpanel-followup-triage.sh" | sha256sum -c - && chmod 700 "$tmp_dir/cpanel-followup-triage.sh" && "$tmp_dir/cpanel-followup-triage.sh")
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/cpanel-followup-triage.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/cpanel-followup-triage.sh' && printf '%s %s\n' '5bb1e14491437c42cf6d5169186a2545176dcbbf5ba4367d84aabf0e851f0a23' "$tmp_dir/cpanel-followup-triage.sh" | sha256sum -c - && chmod 700 "$tmp_dir/cpanel-followup-triage.sh" && "$tmp_dir/cpanel-followup-triage.sh")
```

### `directory-sizes.sh`
Expand All @@ -85,7 +94,7 @@ Lists immediate subdirectories by allocated disk usage, largest first. Hidden di
One-line invocation for the current directory:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/directory-sizes.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.0.0/scripts/directory-sizes.sh' && printf '%s %s\n' '156ea405829ec5c27ed7a462a23e2fe9752704467c93fbc652aef205d24ca65d' "$tmp_dir/directory-sizes.sh" | sha256sum -c - && chmod 700 "$tmp_dir/directory-sizes.sh" && "$tmp_dir/directory-sizes.sh" .)
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/directory-sizes.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/directory-sizes.sh' && printf '%s %s\n' '156ea405829ec5c27ed7a462a23e2fe9752704467c93fbc652aef205d24ca65d' "$tmp_dir/directory-sizes.sh" | sha256sum -c - && chmod 700 "$tmp_dir/directory-sizes.sh" && "$tmp_dir/directory-sizes.sh" .)
```

### `exim-queue-health.sh`
Expand All @@ -95,12 +104,12 @@ Prints only total, frozen, older-than-one-hour, and older-than-one-day Exim queu
One-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/exim-queue-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.0.0/scripts/exim-queue-health.sh' && printf '%s %s\n' 'cf4606e3cd496dd9d8ca9db1281488507e3abeb2f45f460f1af070297a3fec22' "$tmp_dir/exim-queue-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/exim-queue-health.sh" && "$tmp_dir/exim-queue-health.sh")
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/exim-queue-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/exim-queue-health.sh' && printf '%s %s\n' 'cf4606e3cd496dd9d8ca9db1281488507e3abeb2f45f460f1af070297a3fec22' "$tmp_dir/exim-queue-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/exim-queue-health.sh" && "$tmp_dir/exim-queue-health.sh")
```

## Linux server diagnostics wave (v2.1.0 candidate)
## Linux server diagnostics wave (v2.1.0)

These modules are available from the current checkout. Findings use concise `key=value` output. A successful collection returns `0` even when `status=warning|critical|stale`; usage errors return `2`, and collection failures return `1`.
These modules are published in v2.1.0. Findings use concise `key=value` output. A successful collection returns `0` even when `status=warning|critical|stale`; usage errors return `2`, and collection failures return `1`.

### `filesystem-health.sh`

Expand All @@ -110,6 +119,12 @@ Reports mounted-filesystem capacity and inode pressure by index, without device
./scripts/filesystem-health.sh
```

Version-pinned one-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/filesystem-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/filesystem-health.sh' && printf '%s %s\n' '0b4608698315cf1ed19b532e453ff08fe9aeab93a0a8492793217c9002c5a12f' "$tmp_dir/filesystem-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/filesystem-health.sh" && "$tmp_dir/filesystem-health.sh")
```

### `memory-pressure.sh`

Reports memory and swap use, one-minute load normalized by online CPU count, and Linux PSI values when available. It does not list processes or command lines.
Expand All @@ -118,6 +133,12 @@ Reports memory and swap use, one-minute load normalized by online CPU count, and
./scripts/memory-pressure.sh
```

Version-pinned one-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/memory-pressure.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/memory-pressure.sh' && printf '%s %s\n' '859fcefc6b631f9b63e28db8c2f58372e55adfe567e70c3d2317e609b5543d59' "$tmp_dir/memory-pressure.sh" | sha256sum -c - && chmod 700 "$tmp_dir/memory-pressure.sh" && "$tmp_dir/memory-pressure.sh")
```

### `service-health.sh`

Reports aggregate systemd state and failed-unit count. Unit names remain omitted unless `--show-units` is explicitly supplied.
Expand All @@ -126,6 +147,12 @@ Reports aggregate systemd state and failed-unit count. Unit names remain omitted
./scripts/service-health.sh
```

Version-pinned one-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/service-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/service-health.sh' && printf '%s %s\n' 'c35c04f1f5f54eb945b46cbd6ebecb05146f02baf8f7de5bbe967c494ec5bb56' "$tmp_dir/service-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/service-health.sh" && "$tmp_dir/service-health.sh")
```

### `listener-exposure.sh`

Lists listener protocol, port, and bind scope (`loopback`, `specific-address`, or `all-interfaces`) without displaying literal addresses or process details.
Expand All @@ -134,6 +161,12 @@ Lists listener protocol, port, and bind scope (`loopback`, `specific-address`, o
./scripts/listener-exposure.sh
```

Version-pinned one-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/listener-exposure.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/listener-exposure.sh' && printf '%s %s\n' 'a12029e59604066a57edf0bd12668a34031779d59838957d7991973580ea8c2f' "$tmp_dir/listener-exposure.sh" | sha256sum -c - && chmod 700 "$tmp_dir/listener-exposure.sh" && "$tmp_dir/listener-exposure.sh")
```

### `update-posture.sh`

Counts updates visible in existing APT or DNF metadata, reports deferred/kept-back APT candidates as a privacy-safe aggregate, and checks the reboot-required marker. It never refreshes metadata, lists package names, installs updates, or reboots.
Expand All @@ -142,6 +175,12 @@ Counts updates visible in existing APT or DNF metadata, reports deferred/kept-ba
./scripts/update-posture.sh
```

Version-pinned one-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/update-posture.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/update-posture.sh' && printf '%s %s\n' '2bcf1ab868d6055c61b507407b424cd753894bc8d0b190e06c9a156281dbeb59' "$tmp_dir/update-posture.sh" | sha256sum -c - && chmod 700 "$tmp_dir/update-posture.sh" && "$tmp_dir/update-posture.sh")
```

### `backup-freshness.sh`

Finds the newest regular file among explicit files and immediate directory entries. It does not recurse and reports age/count only; use `--show-names` or `--show-paths` explicitly for local diagnosis.
Expand All @@ -150,6 +189,12 @@ Finds the newest regular file among explicit files and immediate directory entri
./scripts/backup-freshness.sh --max-hours 24 /srv/backups
```

Version-pinned one-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/backup-freshness.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/backup-freshness.sh' && printf '%s %s\n' 'fe3e47781e5694ebcc2c260df97bb3421fa5e13fa353c0e25e00c9ecffaf2a8b' "$tmp_dir/backup-freshness.sh" | sha256sum -c - && chmod 700 "$tmp_dir/backup-freshness.sh" && "$tmp_dir/backup-freshness.sh" /srv/backups)
```

### `endpoint-health.sh`

Probes explicit HTTP(S) endpoints and reports status and latency by input index. URLs, query strings, headers, and response bodies are omitted.
Expand All @@ -158,6 +203,12 @@ Probes explicit HTTP(S) endpoints and reports status and latency by input index.
./scripts/endpoint-health.sh https://example.com/health
```

Version-pinned one-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/endpoint-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/endpoint-health.sh' && printf '%s %s\n' '46d3961f9364b9ccf7cda154dcef52810855aaf6040ac08a416d641b014e84fb' "$tmp_dir/endpoint-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/endpoint-health.sh" && "$tmp_dir/endpoint-health.sh" https://example.com/health)
```

### `tls-expiry.sh`

Verifies explicit TLS targets and reports certificate lifetime by input index. Hostnames, addresses, subjects, and issuers are omitted.
Expand All @@ -166,6 +217,12 @@ Verifies explicit TLS targets and reports certificate lifetime by input index. H
./scripts/tls-expiry.sh example.com:443
```

Version-pinned one-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/tls-expiry.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/tls-expiry.sh' && printf '%s %s\n' 'ea624496235f3d78cd38be3173f6bb18d898d7cc25b71fe36d678459691b61f0' "$tmp_dir/tls-expiry.sh" | sha256sum -c - && chmod 700 "$tmp_dir/tls-expiry.sh" && "$tmp_dir/tls-expiry.sh" example.com:443)
```

### `container-health.sh`

Reports aggregate Docker or Podman running, stopped, and unhealthy counts. Names, images, IDs, ports, labels, and commands are omitted. If Docker is installed but unavailable, a usable Podman runtime is tried.
Expand All @@ -174,6 +231,12 @@ Reports aggregate Docker or Podman running, stopped, and unhealthy counts. Names
./scripts/container-health.sh
```

Version-pinned one-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/container-health.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/container-health.sh' && printf '%s %s\n' '6166f768a4f242db8e077438ebdc2736ffbafd5306dd0d1adbb1da7b0b75b26b' "$tmp_dir/container-health.sh" | sha256sum -c - && chmod 700 "$tmp_dir/container-health.sh" && "$tmp_dir/container-health.sh")
```

### `log-storage.sh`

Measures allocated size for explicit log directories, defaulting to `/var/log`, without reading log contents. Paths are omitted unless `--show-paths` is supplied. If permissions hide a child directory but `du` still returns a numeric total, the result is retained and marked `collection_complete=no`.
Expand All @@ -182,14 +245,20 @@ Measures allocated size for explicit log directories, defaulting to `/var/log`,
./scripts/log-storage.sh
```

These modules intentionally have no remote one-line invocation until the v2.1.0 tag and release checksums are approved and published.
Version-pinned one-line invocation:

```bash
(tmp_dir="$(mktemp -d)" && chmod 700 "$tmp_dir" && trap 'rm -rf "$tmp_dir"' EXIT && curl -fsSLo "$tmp_dir/log-storage.sh" 'https://raw.githubusercontent.com/RomeoRaven/ONEScripts/v2.1.0/scripts/log-storage.sh' && printf '%s %s\n' '3eb2acfbbaf9643ebf50b7822fa6e6d7908f421abb7edfc2521ac5ebafa0422a' "$tmp_dir/log-storage.sh" | sha256sum -c - && chmod 700 "$tmp_dir/log-storage.sh" && "$tmp_dir/log-storage.sh" /var/log)
```

Each version-pinned command downloads into a private temporary directory, verifies the exact v2.1.0 checksum, and executes only after verification succeeds.

## Direct module use

Clone the repository and run a script directly:
After completing the version-pinned verified checkout above, run a script directly:

```bash
git clone https://github.com/RomeoRaven/ONEScripts.git && cd ONEScripts && ./scripts/vps-profile.sh ./vps-profile.txt
./scripts/vps-profile.sh ./vps-profile.txt
```

Every module supports `--help` and `--version` and remains directly executable without the master.
Expand Down
Loading
Loading