improve README, linting

Author: tstromberg

README.md

@@ -1,148 +1,87 @@
-
-# gitMDM: The MDM that isn't a giant security hole
+# gitMDM: The MDM that isn't
 
 ![gitMDM Logo](media/logo_small.png)
 
-⚠️ **HIGHLY EXPERIMENTAL - IT MAY EAT YOUR CAT ** ⚠️
-
-## What Is This Thing?
-
-gitMDM is what happens when you need to pass a SOC 2 audit but refuse to sell your soul to the MDM industrial complex. It's a Mobile Device Management solution that stores everything in Git because, apparently, Git is the hammer and everything looks like a nail.
+⚠️ **HIGHLY EXPERIMENTAL - MAY EAT YOUR CAT** ⚠️
 
-## Why Does This Exist?
+## What
 
-Because I needed to prove my devices were "compliant" for SOC 2, but I'll be damned if I'm going to:
-- Install some bloated enterprise MDM that phones home every 5 seconds
-- Give some cloud service root access to my machines
-- Sacrifice my freedom of choice on the altar of compliance theater - if I want to run OpenBSD, I should be able to.
-- Trust my device security to a system that's one CVE away from being everyone's backdoor
+A "Mobile Device Management" solution that stores compliance checks in Git. Built to pass SOC 2 audits without installing actual MDM spyware.
 
-So I built this instead. It checks boxes. Literally. For auditors.
+## Why
 
-## Design Philosophy: Paranoia as a Service
+Because real MDMs are backdoors with compliance features. This just generates the reports auditors want without the ability to actually control your devices.
 
-- **No Remote Control**: This MDM can't actually manage your devices. It just tattles on them. To Git.
-- **No Backdoors**: The server can't execute commands on agents, or itself.
-- **No Cloud**: Your compliance data lives in a Git repo you control, not in someone else's computer. You can run it in the Cloud, though.
-- **No Privileges**: The agent runs with minimal permissions and couldn't compromise your system if it tried (which it won't, because it can't)
-- **No Dependencies**: Well, except for Git. And Go. And YAML. But who's counting?
-- **No Support**: You're on your own, friend. I built this for me.
+## Philosophy
 
-## How It "Works"
+- **Can't manage devices** - Only reports on them
+- **Can't execute commands** - Read-only by design  
+- **Can't phone home** - Your Git repo, your control
+- **Can't compromise systems** - No privileges, no access
 
-1. **Agent**: A tiny Go binary runs on your devices, executes read-only compliance checks, and sends reports to...
-2. **Server**: Another tiny Go binary that receives reports and commits them to...
-3. **Git**: Because if you're going to store compliance data somewhere, it might as well have version control
+## Architecture
 
 ```
-Your Device → Agent → Server → Git → Auditor's Spreadsheet → ✅ SOC 2 Compliant!
+Device → Agent (reads) → Server (receives) → Git (stores) → Auditor ✅
 ```
 
 ## Features
 
-- ✅ Proves your disk is encrypted (without being able to decrypt it)
-- ✅ Shows your firewall is on (without being able to turn it off)
-- ✅ Lists your users (without being able to delete them)
-- ✅ Reports installed updates (without being able to install them)
-- ✅ Demonstrates screensaver locks (without locking you out)
-- ✅ Makes auditors happy (without making you sad)
-- ✅ Supports pretty much any operating-system, from macOS to Linux to OpenBSD.
+Proves compliance without control:
+- Disk encryption status
+- Firewall configuration
+- User accounts
+- System updates
+- Screensaver locks
 
-## Security Through Inability
-
-Traditional MDMs are like giving someone the keys to your house so they can check if you locked the door. gitMDM is like having someone take a photo of your locked door from across the street. Sure, they can't verify the windows are locked, but they also can't break in.
+## Platform Support
 
-**Core Security Principles:**
-- **Read-Only**: Agents can look but can't touch
-- **One-Way Communication**: Agents report to server, server can't command agents
-- **Git-Based Audit Trail**: Every change is tracked, signed, and immutable
-- **Minimal Attack Surface**: ~1000 lines of Go and one YAML dependency
-- **Defense in Depth**: Even if compromised, the server can't compromise endpoints
+Linux, macOS, FreeBSD, OpenBSD, NetBSD, DragonFlyBSD, Solaris, illumos, Windows 11
 
 ## Installation
 
 ```bash
-# Clone it
-git clone https://github.com/you/gitMDM.git
-
-# Build it
+# Build
 make build
 
-# Run it (server) - pick your storage poison:
-
-# Option 1: Clone a remote/local repo to temp directory (will push/pull)
-./gitmdm-server -git https://github.com/you/compliance-data.git -port 8080
-
-# Option 2: Use an existing local git clone (will push/pull if remote configured)
-./gitmdm-server -clone /path/to/your/compliance-repo -port 8080
+# Server (pick one)
+./gitmdm-server -git https://github.com/you/compliance.git  # Clone & push
+./gitmdm-server -clone /path/to/repo                        # Use existing
 
-# Deploy it (agent)
+# Agent
 ./gitmdm-agent -server http://your-server:8080
 
-# Forget about it
+# Deploy
 echo "gitmdm-agent -server http://your-server:8080" | crontab -
 ```
 
-### Git Storage Options
-
-The server needs somewhere to store your compliance data. You have options:
-
-**`-git <url>`** - Clones a repository to a temporary directory
-- Works with GitHub/GitLab/Bitbucket: `https://github.com/user/repo.git`
-- Works with local repos: `/path/to/repo.git` or `../my-repo`
-- Will push/pull changes with the remote
-- Fresh clone each time the server starts
-
-**`-clone <path>`** - Uses an existing local git clone
-- Works directly in your existing repository
-- Will push/pull if the clone has a remote configured
-- Useful for testing or when you need specific git configurations
-- No temp directory shenanigans
-
-### GitHub Authentication (Because Security Theater Needs Credentials)
-
-If you're using GitHub for your compliance data:
+## GitHub Auth
 
 ```bash
-# Option 1: GitHub CLI (easiest)
-gh auth setup-git
-
-# Option 2: SSH keys (most reliable)
-# Add your SSH key to GitHub, then:
-./gitmdm-server -git [email protected]:you/compliance-data.git
+# Use SSH (recommended)
+./gitmdm-server -git [email protected]:you/compliance.git
 
-# Option 3: Personal Access Token (for HTTPS)
-# Create a PAT on GitHub, then:
-./gitmdm-server -git https://[email protected]/you/compliance-data.git
+# Or GitHub CLI
+gh auth setup-git
 ```
 
-**Pro tip**: Don't commit your tokens. Use SSH keys like a civilized person.
-
 ## Configuration
 
-Edit `checks.yaml` to define what compliance theater you want to perform. The default checks should satisfy most auditors who've never actually used a computer.
+Edit `checks.yaml` to define compliance checks. Default config satisfies most auditors.
 
-## Platform Support
+## Security
 
-- macOS: Where I live
-- Linux: Where servers live
-- OpenBSD: Where the paranoid live
-- FreeBSD: Where the... uh... FreeBSD people live
-- Windows: LOL no
+Traditional MDMs: Give someone your house keys to check if the door is locked.  
+gitMDM: Someone photographs your locked door from across the street.
 
-## Known Issues
+**Result**: Compliance without compromise.
 
-- May not actually eat your cat, but no promises
-- Definitely won't manage your mobile devices despite the name
-- Auditors might ask "is this really an MDM?" (Answer: "It's better, it's *compliant*")
-- You might be the second user, which would break our metrics
+**Note**: The server accepts reports without authentication by default. While this means anyone could submit false compliance data, they still can't access or control your actual devices. Enable API key authentication (`-api-key`) or use network-level controls if you need to verify report sources.
 
 ## Disclaimer
 
-This software is provided "as is" without warranty of any kind. It probably won't eat your cat, compromise your devices, or make you fail your audit. But if it does, you can keep both pieces.
-
-**Remember**: The 'M' in MDM stands for 'Minimal' (in this case).
+This software proves compliance. It doesn't actually manage devices. That's the point.
 
 ---
 
-*Built with ❤️ and spite by someone who just wanted to pass an audit with their OpenBSD laptop.*
+*Built with spite by someone who wanted to pass SOC 2 with OpenBSD.*

internal/types/types.go

@@ -19,11 +19,11 @@ type Device struct {
 
 // Check represents a single compliance check result.
 type Check struct {
+	Timestamp time.Time `json:"-"` // Not stored in JSON, set from file mtime
 	Command   string    `json:"command"`
 	Stdout    string    `json:"stdout"`
 	Stderr    string    `json:"stderr"`
 	ExitCode  int       `json:"exit_code"`
-	Timestamp time.Time `json:"-"` // Not stored in JSON, set from file mtime
 }
 
 // DeviceReport represents a compliance report sent by an agent.