Tsinghua mirror is configured in pyproject.toml:

2.2 Prepare asset config

Then update fleet.env with your real hosts and credentials.

2.3 Run

3. Project Layout

4. fleet.env Configuration Reference

Format is KEY=VALUE. Empty lines and # comments are ignored.

4.1 Global keys

MODE

• Runtime mode.
• Values:
  • audit: detect only, no remediation.
  • fix: detect and run remediation flow.
• Default: audit

AUTO_REBOOT

• Whether to reboot host automatically after successful remediation.
• Values: 0 or 1
• Default: 0
• Effective only when MODE=fix.

SSH_TIMEOUT

• SSH connect/auth timeout (seconds).
• Type: integer
• Default: 12

MAX_WORKERS

• Fleet concurrency size (thread pool workers).
• Type: integer
• Default: 8

REPORT_DIR

• Output directory for generated reports.
• Type: relative or absolute path
• Default: ./reports

PROGRESS_HEARTBEAT_SECONDS

• Heartbeat interval for real-time progress logs.
• Type: integer (seconds)
• Default: 5

DEVICE_MAX_DURATION_SECONDS

• Max total execution time per device before timeout/stall warnings.
• Type: integer (seconds)
• Default: 1800

PROGRESS_LOG_TO_FILE

• Whether to persist progress logs into REPORT_DIR.
• Values: 0 or 1
• Default: 1

FLEET_COUNT

• Device slot count. Loader parses 1..FLEET_COUNT.
• Type: integer
• If DEVICE_n_HOST is empty, that slot is skipped.

4.2 Per-device keys

Each host uses DEVICE_{n}_ prefix, such as DEVICE_1_*, DEVICE_2_*.

DEVICE_n_NAME

• Display name in reports.
• Optional. If empty, auto-fallback to device_n.

DEVICE_n_HOST

• Target host IP or DNS name.
• Required for that slot.

DEVICE_n_PORT

• SSH port.
• Default: 22

DEVICE_n_USER

• SSH username.
• Default: root

DEVICE_n_PASSWORD

• SSH password auth.
• Use with or instead of DEVICE_n_KEY.
• The script only uses credentials explicitly set in fleet.env.

DEVICE_n_KEY

• SSH private key path.
• Example: ./keys/node-1_ed25519
• If both DEVICE_n_PASSWORD and DEVICE_n_KEY are empty, the connection fails fast.

DEVICE_n_SUDO_PASSWORD

• Sudo password for non-root users.
• Used for remediation commands.

4.3 Full example

5. Run Modes

5.1 Audit mode (recommended first pass)

Behavior:

• Connect to hosts
• Collect kernel/module/patch hints
• Classify risk status
• Generate reports

5.2 Fix mode

Behavior:

• Apply temporary mitigation first:
  • write /etc/modprobe.d/disable-cve-2026-31431-algif-aead.conf
  • try to unload algif_aead
• Run distro-specific kernel update
• Optional reboot based on AUTO_REBOOT

6. Status Definitions

SAFE

• Patch hints found and algif_aead is not loaded.

MITIGATED

• Mitigation hints found while patch hints are still unclear.

NEEDS_PATCH

• algif_aead is available/loaded and patch hints are missing.

UNKNOWN

• Not enough evidence to classify.

FAILED

• SSH login/command execution failed.

7. Report Outputs

Each run generates 3 files in REPORT_DIR:

• cve_2026_31431_<timestamp>.json
• cve_2026_31431_<timestamp>.csv
• cve_2026_31431_<timestamp>.md
• progress_<timestamp>.log (real-time progress and heartbeat logs)

Core fields:

• name, host
• status
• kernel, os
• algif_loaded, algif_available
• patch_hint
• fixed, rebooted
• error

8. Security Notes

• Do not commit fleet.env or private keys.
• Use least-privileged operational accounts when possible.
• Take snapshots/backups before production remediation.
• Recommended rollout: audit -> fix -> re-audit.

9. Troubleshooting

ModuleNotFoundError: No module named 'paramiko'

• Run uv sync.

Many hosts are FAILED

• Check connectivity, SSH credentials, sudo permission, and host key state.

BadHostKeyException

• Host fingerprint conflicts with current known_hosts record.
• This is not system key auth fallback; auth still uses only fleet.env credentials.
• Verify host identity out-of-band, then update known_hosts:
  • ssh-keygen -R <host>
  • ssh-keyscan -H <host> >> $env:USERPROFILE\.ssh\known_hosts

Server ... not found in known_hosts

• Strict host-key mode is enabled, and host fingerprint is missing.
• Add host key to known_hosts, then rerun.

Kernel updated but status still risky

• Reboot may be required to boot into patched kernel.