Harden security: name validation, scoped sudoers, safe.directory

- Add ValidateName() enforcing ^[a-z][a-z0-9-]{0,62}$ on all entry points
- Tighten sudoers to restrict cp sources/destinations and chown targets
- Scope git safe.directory to www-data user only (preserves CVE-2022-24765)
- Add www-data to git group and caddy to www-data group for fcgiwrap
- Fix vanity import template to use orig_uri placeholder
- Restart (not reload) services after group changes
- Add name validation to env subcommands and deploy_cmd

1 files changed, 3 insertions, 0 deletions

diff --git a/cmd/ship/env/unset.go b/cmd/ship/env/unset.go
index 7d9a141..8292f42 100644
--- a/cmd/ship/env/unset.go
+++ b/cmd/ship/env/unset.go
@@ -18,6 +18,9 @@ var unsetCmd = &cobra.Command{
 
 func runUnset(cmd *cobra.Command, args []string) error {
         name := args[0]
+        if err := state.ValidateName(name); err != nil {
+                return err
+        }
         keys := args[1:]
 
         st, err := state.Load()