Bor v0.8.0 brings GPO-style fleet policy management to Linux desktops

Bor, an open-source tool for centrally managing Linux desktop configuration the way Group Policy handles Windows fleets, shipped v0.8.0 with three new policy types. Admins can now push managed settings for Mozilla Thunderbird (via the same policies.json mechanism used for Firefox ESR, covering both Flatpak and RPM/DEB installs), Microsoft Edge for Business on Linux, and firewalld zones — the latter writing validated zone XML, checking it with firewall-cmd, and reloading. All managed files sit behind a tamper watcher that detects and reverts external edits, and the four browser/mail policy catalogues are now generated from a single protobuf source shared by server, agent, and frontend.

The release pairs those features with a substantial security hardening pass. Agent identity is now strictly bound to its mTLS client certificate, legacy SHA-256-encrypted TOTP secrets migrate transparently to HKDF-derived encryption, and the auto-generated initial admin password is written to a root-only file instead of being logged to journald. The team also closed several injection and SSRF gaps — redirect-based SSRF in the PPA/COPR import helpers, spreadsheet formula injection in audit-log CSV exports — and resolved all open Dependabot alerts, including a react-router CSRF advisory. RBAC moved from a single blanket admin permission to per-action controls.

Rounding it out is a full PatternFly 6 web UI overhaul: real URL routing with working back/forward and deep links, a routed full-page policy editor, server-side pagination for fleets with thousands of nodes, type-to-confirm dialogs on destructive actions, guards against deleting the last super admin, and WCAG 2.2 AA accessibility enforced by a CI lint gate. Upgrading requires bumping agents to v0.8.0 to enforce the new policy types; packages are available for Debian/Ubuntu, RHEL/Fedora/SUSE, Alpine, and Arch across x86_64, aarch64, and ppc64le.