diff --git a/.gitattributes b/.gitattributes
index 7fb77a6..7d98a5e 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,3 +4,17 @@
 
 * text=auto eol=lf
 *.png binary
+
+# Left out of the release archive (scripts/release/build.sh): tests, CI and tool settings. The Ansible collection is a
+# release file of its own.
+/.github export-ignore
+/tests export-ignore
+/scripts/dev export-ignore
+/scripts/release export-ignore
+/ansible export-ignore
+/.editorconfig export-ignore
+/.gitattributes export-ignore
+/.gitignore export-ignore
+/.gitleaksignore export-ignore
+/.shellcheckrc export-ignore
+/.sonarcloud.properties export-ignore
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 100c218..7f16447 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -99,15 +99,17 @@ and checks it against this list before approving:
 4. **Security.** No weaker default than before; no path a local user controls is written, chowned or followed as
    root; settings are validated in `mod_check` before anything changes; nothing is downloaded without a check.
 5. **Lockout.** Changes to SSH, the firewall, PAM or sudo keep a way in and are covered by the lockout checks.
-6. **Compatibility.** A changed setting name or default is labelled `breaking-change` with migration notes, and
-   `lss update` migrates the state of existing installations.
+6. **Compatibility.** A changed setting name or default is labelled `breaking-change` with migration notes, and a
+   module of the new version takes over the state an older version left (installed after `lss update`, applied with
+   `lss configure`).
 7. **Documentation.** README, module guide, hardening guide and `CHANGELOG.md` match the change.
 
 ## Releases
 
-From 2.0.0 on, releases are built by the release workflow on `main`: it tags the version, attaches the archive with a
-signed build attestation and publishes the GitHub release. The version step comes from the pull request labels:
-`breaking-change` makes a major release, `enhancement` a minor one, anything else a patch.
+From 2.0.0 on, releases are built by the release workflow on `main`: it tags the version, attaches the archive,
+`bootstrap.sh`, the Ansible collection, the SBOM and `SHA256SUMS` with a signed build attestation and publishes the
+GitHub release. The version step comes from the pull request labels: `breaking-change` makes a major release,
+`enhancement` a minor one, anything else a patch. Details: [releasing](../docs/releasing.md).
 
 ## License
 
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index 29e55c0..8ce26d6 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -57,19 +57,21 @@ documented as an [OpenVEX](https://openvex.dev/) statement in `.vex/`, with the
 
 From 2.0.0 on, releases are built only by the release workflow of this repository, never from a laptop. Each release
 carries a signed build attestation (Sigstore, SLSA provenance) that names this repository, the workflow and the
-commit. Verify a downloaded archive with the GitHub CLI:
+commit. Verify a downloaded file with the GitHub CLI, naming the release workflow on `main` as the signer:
 
 ```bash
-gh attestation verify lss-<version>.tar.gz --repo VectoDE/Linux-Server-Setup-Script
+gh attestation verify lss-<version>.tar.gz --repo VectoDE/Linux-Server-Setup-Script \
+  --cert-identity https://github.com/VectoDE/Linux-Server-Setup-Script/.github/workflows/release.yml@refs/heads/main
 ```
 
-`lss update` checks the attestation of every version before it installs it and refuses an archive that does not
-verify.
+`bootstrap.sh` and `lss update` check the checksum and the attestation of every version before they install it and
+refuse a release that does not verify ([installing and upgrading](../docs/upgrading.md#what-gets-checked)).
 
 ## Secrets and credentials
 
-- The project keeps no stored secrets: workflows use the short-lived `GITHUB_TOKEN`, attestations use the workflow's
-  OIDC identity.
+- Workflows use the short-lived `GITHUB_TOKEN`, attestations the workflow's OIDC identity. The only stored secrets
+  are the deploy key and the SSH signing key of the release commit and tag, in the environment `release`, which only
+  `main` can use and only the job that commits and tags reads ([releasing](../docs/releasing.md)).
 - On a server, lss keeps generated secrets (passwords, 2FA enrolment) in `/etc/lss/secrets`, mode 0600 in a 0700 directory, and
   shows them only with `lss secrets show NAME`. They never go into logs.
 - Secrets are never committed. gitleaks in CI and GitHub secret scanning with push protection block leaks.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6bd8d85..0265a46 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -40,3 +40,16 @@ updates:
     groups:
       images:
         patterns: ['*']
+
+  # Python tools of the Ansible collection checks (tests/ansible/requirements.txt, pinned with hashes).
+  - package-ecosystem: pip
+    directory: /tests/ansible
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    labels: [dependencies, ci]
+    groups:
+      ansible:
+        patterns: ['*']
diff --git a/.github/workflows/distribution.yml b/.github/workflows/distribution.yml
new file mode 100644
index 0000000..5150e3c
--- /dev/null
+++ b/.github/workflows/distribution.yml
@@ -0,0 +1,175 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# How lss reaches servers, tested with real signatures: two test releases are built with scripts/release/build.sh,
+# exactly as the release workflow builds a release, and get a real build attestation (Sigstore) from this workflow.
+# bootstrap.sh and `lss update` then install, update, roll back and downgrade them on every supported system and
+# refuse tampered copies (tests/integration/update.sh); the Ansible collection is linted and installs and updates lss
+# over SSH (tests/integration/ansible.sh). Only the signer differs from a release: bootstrap.sh accepts these test
+# builds because the tests name this workflow and ref in LSS_RELEASE_WORKFLOW and LSS_RELEASE_REF.
+name: Release and update
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "47 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: distribution-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  VERSION_A: 2.0.0-ci.1
+  VERSION_B: 2.0.0-ci.2
+
+jobs:
+  build:
+    name: Build and sign test releases
+    # Pull requests from forks and Dependabot get no OIDC token to sign with; the release workflow is unaffected.
+    if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write # Sigstore signature for the test attestations
+      attestations: write # stores them with the repository, as a release does
+    steps:
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install ansible-core (hash-pinned)
+        run: |
+          python3 -m venv "$RUNNER_TEMP/venv"
+          "$RUNNER_TEMP/venv/bin/pip" install --quiet --require-hashes -r tests/ansible/requirements.txt
+          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"
+      - name: Build two releases
+        run: |
+          for version in "$VERSION_A" "$VERSION_B"; do
+            scripts/release/build.sh --version "$version" "$RUNNER_TEMP/release/download/v$version"
+          done
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        id: attest-a
+        with:
+          subject-path: ${{ runner.temp }}/release/download/v${{ env.VERSION_A }}/*
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        id: attest-b
+        with:
+          subject-path: ${{ runner.temp }}/release/download/v${{ env.VERSION_B }}/*
+      - name: Lay the releases out like GitHub releases
+        env:
+          BUNDLE_A: ${{ steps.attest-a.outputs.bundle-path }}
+          BUNDLE_B: ${{ steps.attest-b.outputs.bundle-path }}
+        run: |
+          cp "$BUNDLE_A" "$RUNNER_TEMP/release/download/v$VERSION_A/lss-$VERSION_A.intoto.jsonl"
+          cp "$BUNDLE_B" "$RUNNER_TEMP/release/download/v$VERSION_B/lss-$VERSION_B.intoto.jsonl"
+          mkdir -p "$RUNNER_TEMP/release/latest/download"
+          cp "$RUNNER_TEMP/release/download/v$VERSION_B/SHA256SUMS" "$RUNNER_TEMP/release/latest/download/SHA256SUMS"
+          find "$RUNNER_TEMP/release" -type f | sort
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: test-release
+          path: ${{ runner.temp }}/release/
+          retention-days: 3
+
+  lint:
+    name: Ansible collection lint
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install ansible-core and ansible-lint (hash-pinned)
+        run: |
+          python3 -m venv "$RUNNER_TEMP/venv"
+          "$RUNNER_TEMP/venv/bin/pip" install --quiet --require-hashes -r tests/ansible/requirements.txt
+          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"
+      - name: Build and install the collection, check the module documentation
+        run: |
+          scripts/release/build.sh "$RUNNER_TEMP/dist"
+          version="$(cat VERSION)"
+          ansible-galaxy collection install "$RUNNER_TEMP/dist/vectode-lss-$version.tar.gz" -p "$RUNNER_TEMP/collections"
+          echo "ANSIBLE_COLLECTIONS_PATH=$RUNNER_TEMP/collections" >> "$GITHUB_ENV"
+          ANSIBLE_COLLECTIONS_PATH="$RUNNER_TEMP/collections" ansible-doc vectode.lss.lss > /dev/null
+          ANSIBLE_COLLECTIONS_PATH="$RUNNER_TEMP/collections" ansible-doc -t role vectode.lss.lss > /dev/null
+          jq -e '.bomFormat == "CycloneDX" and (.components | length > 0)' "$RUNNER_TEMP/dist/lss-$version.cdx.json" > /dev/null
+      - name: ansible-lint
+        working-directory: ansible
+        run: ansible-lint --offline
+
+  update:
+    name: ${{ matrix.system }}${{ matrix.arch == 'arm64' && ' arm64' || '' }} / bootstrap and update
+    needs: build
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        system: [debian-12, debian-13, ubuntu-22.04, ubuntu-24.04, ubuntu-26.04, rocky-9, almalinux-10]
+        arch: [x64, arm64]
+    steps:
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: test-release
+          path: ${{ runner.temp }}/release
+      - name: Install, update, roll back, downgrade, refuse
+        env:
+          SYSTEM: ${{ matrix.system }}
+          LSS_RELEASE_WORKFLOW: distribution.yml
+          LSS_RELEASE_REF: ${{ github.ref }}
+        run: tests/integration/update.sh "$SYSTEM" "$RUNNER_TEMP/release" "$VERSION_A" "$VERSION_B"
+
+  ansible:
+    name: ${{ matrix.system }}${{ matrix.arch == 'arm64' && ' arm64' || '' }} / Ansible collection
+    needs: build
+    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        system: [debian-12, debian-13, ubuntu-22.04, ubuntu-24.04, ubuntu-26.04, rocky-9, almalinux-10]
+        arch: [x64, arm64]
+    steps:
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: test-release
+          path: ${{ runner.temp }}/release
+      - name: Install ansible-core (hash-pinned) and the collection
+        run: |
+          python3 -m venv "$RUNNER_TEMP/venv"
+          "$RUNNER_TEMP/venv/bin/pip" install --quiet --require-hashes -r tests/ansible/requirements.txt
+          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/venv/bin/ansible-galaxy" collection install \
+            "$RUNNER_TEMP/release/download/v$VERSION_A/vectode-lss-$VERSION_A.tar.gz" -p "$RUNNER_TEMP/collections"
+      - name: Install lss and modules with the role, update, remove
+        env:
+          SYSTEM: ${{ matrix.system }}
+          LSS_RELEASE_WORKFLOW: distribution.yml
+          LSS_RELEASE_REF: ${{ github.ref }}
+          ANSIBLE_COLLECTIONS_PATH: ${{ runner.temp }}/collections
+        run: tests/integration/ansible.sh "$SYSTEM" "$RUNNER_TEMP/release" "$VERSION_A" "$VERSION_B"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..c9446eb
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,278 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# Every push to main becomes a release (docs/releasing.md): scripts/release/prepare.sh picks the version from the
+# pull request labels, the signed release commit and tag go to main, and scripts/release/build.sh builds the release
+# once from the tagged commit:
+#   lss-V.tar.gz, bootstrap.sh, the Ansible collection vectode-lss-V.tar.gz, the CycloneDX SBOM lss-V.cdx.json and
+#   SHA256SUMS, all covered by one signed build attestation (Sigstore, SLSA provenance) kept as lss-V.intoto.jsonl.
+# bootstrap.sh and `lss update` install a version only when its checksum and this attestation verify, signed by this
+# workflow on refs/heads/main. Commits with "[skip release]" in the message are left out, and so is the release
+# commit itself.
+#
+# The deploy key that may push past the rulesets of main and of the version tags is only handed to the "Commit and
+# tag" job, which runs no code of the repository: it applies the version change prepared and checked without the key.
+# Run it by hand to pick the version step, with a pre-release name (rc.1) for a test release or a candidate, or with
+# "attach" to build and attach the files of an existing tag again.
+# Every step skips what already exists, so a rerun is safe.
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: Version step
+        type: choice
+        options: [auto, patch, minor, major, attach]
+        default: auto
+      prerelease:
+        description: Pre-release name such as rc.1 (a test of the release workflow or a candidate; empty for a release)
+        type: string
+        required: false
+      tag:
+        description: Existing tag for attach (default the version in VERSION)
+        type: string
+        required: false
+
+permissions:
+  contents: read
+
+# One release at a time; a run that waits behind another sees its release commit and starts from there.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    name: Pick the version and check
+    if: github.repository == 'VectoDE/Linux-Server-Setup-Script' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      pull-requests: read # labels that decide the version step
+    outputs:
+      release: ${{ steps.version.outputs.release }}
+      version: ${{ steps.version.outputs.version }}
+      tag: ${{ steps.version.outputs.tag }}
+      sha: ${{ steps.version.outputs.sha }}
+    steps:
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Skip when main moved on
+        id: current
+        run: |
+          main="$(git ls-remote origin refs/heads/main | cut -f1)"
+          if [ "$main" = "$GITHUB_SHA" ]; then
+            echo "current=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "main is at ${main:0:7}, this run is for ${GITHUB_SHA:0:7}; the newer run releases both."
+            echo "current=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Pick the version
+        id: version
+        if: steps.current.outputs.current == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BUMP: ${{ inputs.bump || 'auto' }}
+          RELEASE_PRERELEASE: ${{ inputs.prerelease }}
+          TAG: ${{ inputs.tag }}
+          RELEASE_NOTES: ${{ runner.temp }}/release/notes.md
+        run: |
+          mkdir -p "$RUNNER_TEMP/release"
+          if [ "$BUMP" = attach ]; then
+            tag="${TAG:-v$(cat VERSION)}"
+            if ! [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] ||
+              ! git rev-parse --verify --quiet "refs/tags/$tag" > /dev/null; then
+              echo "::error::$tag is not an existing version tag."
+              exit 1
+            fi
+            # Only released code: the tag must point to a commit on main. Later jobs build exactly this commit.
+            sha="$(git rev-parse --verify "refs/tags/$tag^{commit}")"
+            if ! git merge-base --is-ancestor "$sha" "$GITHUB_SHA"; then
+              echo "::error::$tag does not point to a commit on main."
+              exit 1
+            fi
+            git tag --list "$tag" --format='%(contents)' > "$RELEASE_NOTES"
+            printf 'release=true\nversion=%s\ntag=%s\nsha=%s\n' "${tag#v}" "$tag" "$sha" | tee -a "$GITHUB_OUTPUT"
+          else
+            RELEASE_BUMP="$BUMP" scripts/release/prepare.sh
+          fi
+          git diff --binary > "$RUNNER_TEMP/release/version.patch"
+      # Saved before the checks run, so nothing they do can change what gets committed.
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: steps.version.outputs.release == 'true'
+        with:
+          name: release
+          path: ${{ runner.temp }}/release/
+          retention-days: 7
+      - name: Check the release
+        if: steps.version.outputs.release == 'true' && inputs.bump != 'attach'
+        run: |
+          scripts/dev/install-bats.sh "$RUNNER_TEMP/bats"
+          "$RUNNER_TEMP/bats/bin/bats" tests/unit
+
+  commit:
+    name: Commit and tag
+    needs: prepare
+    if: needs.prepare.outputs.release == 'true' && inputs.bump != 'attach'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment: release # holds the deploy key and the signing key; only main can use it
+    permissions:
+      contents: read # the push uses the deploy key, not this token
+    outputs:
+      sha: ${{ steps.push.outputs.sha }}
+    steps:
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The deploy key is the only actor that may push past the rulesets of main and of the version tags. Its push
+          # starts this workflow again, which finds nothing new to release.
+          ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }}
+          persist-credentials: true
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release
+          path: ${{ runner.temp }}/release
+      - name: Commit and tag
+        id: push
+        env:
+          TAG: ${{ needs.prepare.outputs.tag }}
+          # SSH key registered as a signing key on the maintainer's GitHub account, so release commits and tags show as
+          # verified. The public half is in .github/allowed_signers.
+          SIGNING_KEY: ${{ secrets.RELEASE_SIGNING_KEY }}
+        run: |
+          patch="$RUNNER_TEMP/release/version.patch"
+          changed="$(git apply --numstat "$patch" | cut -f3 | LC_ALL=C sort | tr '\n' ' ')"
+          # A pre-release leaves CHANGELOG.md alone.
+          versioned="VERSION ansible/galaxy.yml ansible/roles/lss/defaults/main.yml "
+          if [ "$changed" != "CHANGELOG.md $versioned" ] && [ "$changed" != "$versioned" ]; then
+            echo "::error::The version change touches unexpected files: $changed"
+            exit 1
+          fi
+          git apply "$patch"
+          key="$RUNNER_TEMP/signing-key"
+          (umask 077 && printf '%s\n' "$SIGNING_KEY" > "$key")
+          git config user.name "VectoDE"
+          git config user.email "157636760+VectoDE@users.noreply.github.com"
+          git config gpg.format ssh
+          git config user.signingkey "$key"
+          git config gpg.ssh.allowedSignersFile .github/allowed_signers
+          git commit --quiet --all --gpg-sign --message "Release $TAG" --message "[skip release]"
+          git tag --sign "$TAG" --file "$RUNNER_TEMP/release/notes.md" --cleanup=verbatim
+          git tag --verify "$TAG"
+          rm -f "$key"
+          git push --atomic origin HEAD:main "refs/tags/$TAG"
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+  package:
+    name: Build and sign the release
+    needs: [prepare, commit]
+    if: always() && needs.prepare.outputs.release == 'true' && contains(fromJSON('["success", "skipped"]'), needs.commit.result)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write # Sigstore signature for the build attestation
+      attestations: write # stores the attestation with the repository
+    outputs:
+      sha: ${{ steps.source.outputs.sha }}
+    steps:
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+      - name: Pick the verified commit
+        id: source
+        env:
+          SHA: ${{ needs.commit.outputs.sha || needs.prepare.outputs.sha }}
+        run: |
+          if ! [[ "$SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::There is no verified commit to build."
+            exit 1
+          fi
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ steps.source.outputs.sha }}
+          persist-credentials: false
+      - name: Install ansible-core (hash-pinned)
+        run: |
+          python3 -m venv "$RUNNER_TEMP/venv"
+          "$RUNNER_TEMP/venv/bin/pip" install --quiet --require-hashes -r tests/ansible/requirements.txt
+          echo "$RUNNER_TEMP/venv/bin" >> "$GITHUB_PATH"
+      - name: Build
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: |
+          if [ "$(cat VERSION)" != "$VERSION" ]; then
+            echo "::error::The commit has version $(cat VERSION), the release is $VERSION."
+            exit 1
+          fi
+          scripts/release/build.sh "$RUNNER_TEMP/dist"
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        id: attest
+        with:
+          subject-path: ${{ runner.temp }}/dist/*
+      - name: Keep the attestation next to the files
+        env:
+          BUNDLE: ${{ steps.attest.outputs.bundle-path }}
+          VERSION: ${{ needs.prepare.outputs.version }}
+        run: cp "$BUNDLE" "$RUNNER_TEMP/dist/lss-$VERSION.intoto.jsonl"
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: ${{ runner.temp }}/dist/
+          retention-days: 7
+
+  github:
+    name: GitHub release
+    needs: [prepare, package]
+    if: always() && needs.package.result == 'success'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write # GitHub release and its files
+    steps:
+      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: release
+          path: ${{ runner.temp }}/release
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: ${{ runner.temp }}/dist
+      - name: Create the release or attach the signed files
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ needs.prepare.outputs.tag }}
+          SHA: ${{ needs.package.outputs.sha }}
+        run: |
+          # The tag must still point to the commit that was built and signed.
+          tagged="$(gh api "repos/$GITHUB_REPOSITORY/commits/refs/tags/$TAG" --jq .sha)"
+          if [ "$tagged" != "$SHA" ]; then
+            echo "::error::$TAG points to $tagged, but $SHA was built."
+            exit 1
+          fi
+          assets=("$RUNNER_TEMP"/dist/*)
+          if gh release view "$TAG" -R "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
+            gh release upload "$TAG" "${assets[@]}" -R "$GITHUB_REPOSITORY" --clobber
+            exit 0
+          fi
+          prerelease=""
+          case "$TAG" in *-*) prerelease="--prerelease" ;; esac
+          gh release create "$TAG" "${assets[@]}" -R "$GITHUB_REPOSITORY" --verify-tag --title "$TAG" \
+            --notes-file "$RUNNER_TEMP/release/notes.md" $prerelease
diff --git a/.sonarcloud.properties b/.sonarcloud.properties
index 21173e3..f78ebef 100644
--- a/.sonarcloud.properties
+++ b/.sonarcloud.properties
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: MIT
 
 # SonarQube Cloud automatic analysis reads this file: https://sonarcloud.io/project/overview?id=VectoDE_Linux-Server-Setup-Script
-sonar.sources=lss,lib,libexec,modules,scripts,install-configure-script.bash
+sonar.sources=lss,bootstrap.sh,lib,libexec,modules,scripts,ansible
 sonar.tests=tests
 
 # Accepted findings, each with its reason.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e5aa3d0..e90e44c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,13 @@ now or later.
 
 ### Added
 
+- Signed releases: the release workflow builds `lss-<version>.tar.gz`, `bootstrap.sh`, the Ansible collection, a
+  CycloneDX SBOM and `SHA256SUMS` and covers them with one build attestation (Sigstore, SLSA provenance).
+  `bootstrap.sh` installs lss to `/opt/lss/<version>` behind the link `/opt/lss/current` only after the checksum and
+  the attestation verify; `lss update [VERSION]` updates, downgrades and, with `--rollback`, returns to the version
+  before, checked the same way ([installing and upgrading](docs/upgrading.md)).
+- Ansible collection `vectode.lss` with every release: the role `vectode.lss.lss` installs lss from a verified release
+  and sets up modules, the module `vectode.lss.lss` installs and removes modules with check mode.
 - `lss` command with an interactive menu and the commands `list`, `info`, `install`, `configure`, `verify`, `status`,
   `remove`, `audit`, `secrets` and `profiles`; `--dry-run`, `--set KEY=VALUE` and a settings file in
   `/etc/lss/lss.conf`.
@@ -91,7 +98,8 @@ now or later.
 
 ### Removed
 
-- `install-configure-script.bash` will be removed when 2.0.0 is released. Its features move into modules.
+- `install-configure-script.bash`, the 1.x install script. Its features are modules now; [upgrading from
+  1.x](docs/upgrading.md#from-1x) maps its options to them.
 
 ## [1.0.1] - 2025-10-22
 
diff --git a/README.md b/README.md
index 9c3ca81..4a3295f 100644
--- a/README.md
+++ b/README.md
@@ -10,8 +10,8 @@
 modules you need, and come back later to add, change or remove one. Every module checks its settings before it
 touches the system, restores its files when something fails, and can prove with `lss verify` that it still works.
 
-> Version 2.0 is in development on this branch. The 1.x install script (`install-configure-script.bash`) still works
-> and is replaced when 2.0.0 is released.
+> Version 2.0 is in development on this branch. It replaces the 1.x install script `install-configure-script.bash`;
+> see [upgrading from 1.x](docs/upgrading.md#from-1x).
 
 ## Supported systems
 
@@ -129,17 +129,20 @@ The integration jobs print these figures as `RESOURCES` lines, so every new modu
 ## Quick start
 
 ```bash
-git clone https://github.com/VectoDE/Linux-Server-Setup-Script.git /opt/lss
-sudo ln -s /opt/lss/lss /usr/local/sbin/lss
+gh release download -R VectoDE/Linux-Server-Setup-Script --pattern bootstrap.sh
+gh attestation verify bootstrap.sh --repo VectoDE/Linux-Server-Setup-Script \
+  --cert-identity https://github.com/VectoDE/Linux-Server-Setup-Script/.github/workflows/release.yml@refs/heads/main
+sudo bash bootstrap.sh
 
 sudo lss install --profile minimal-secure \
   --set LSS_ADMIN_USER_NAME=alice \
   --set LSS_ADMIN_USER_GITHUB_USER=alice-on-github
 ```
 
-That creates the administrator `alice` with the SSH keys of the GitHub account, switches SSH to keys only, turns on
-the firewall, fail2ban, kernel hardening, AppArmor or SELinux, auditing, automatic security updates, integrity checks
-and the daily guard. Keep a second SSH session open the first time.
+`bootstrap.sh` installs the latest release to `/opt/lss/<version>` once its checksum and its signed build
+attestation verify ([installing and upgrading](docs/upgrading.md)). Then `lss install` creates the administrator
+`alice` with the SSH keys of the GitHub account, switches SSH to keys only, turns on the firewall, fail2ban, kernel
+hardening, AppArmor or SELinux, auditing, automatic security updates, integrity checks and the daily guard. Keep a second SSH session open the first time.
 
 Without a command, `sudo lss` opens a menu. On the RHEL family, sudo looks for commands only in `/usr/sbin` and
 `/usr/bin` until the `admin-user` module has added `/usr/local/sbin`; call `sudo /usr/local/sbin/lss` until then.
@@ -158,6 +161,8 @@ Without a command, `sudo lss` opens a menu. On the RHEL family, sudo looks for c
 | `lss remove MODULE... [--purge]`     | Remove modules; `--purge` also deletes their data                                |
 | `lss audit`                          | Lynis audit with the hardening index                                             |
 | `lss secrets show NAME`              | Print a generated secret, such as `admin-user-password`                          |
+| `lss update [VERSION]`               | Install the latest (or the named) release of lss after checking its signature    |
+| `lss update --rollback`              | Switch back to the version of lss that was active before                         |
 
 Options: `--set KEY=VALUE` for one setting, `--config FILE` for another settings file, `--dry-run` to see what
 would happen, `--yes` for scripts, `--verbose` for more output.
@@ -422,6 +427,9 @@ well, where an alert rule picks it up.
 - [Troubleshooting](docs/troubleshooting.md): locked out, failed modules, common messages
 - [Assurance case](docs/assurance.md): threat model, trust boundaries and how lss counters common weaknesses
 - [Writing a module](docs/module-guide.md)
+- [Installing and upgrading](docs/upgrading.md): `bootstrap.sh`, `lss update`, rollback, upgrading from 1.x
+- [Ansible collection](ansible/README.md): the role and module `vectode.lss.lss`
+- [Releasing](docs/releasing.md): the release workflow, signatures and the SBOM
 - [Changelog](CHANGELOG.md)
 
 ## Contributing and security
diff --git a/REUSE.toml b/REUSE.toml
index cac0518..3a8303e 100644
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -12,14 +12,15 @@ path = [
   ".github/allowed_signers",
   "templates/**",
   "tests/fixtures/os-release/**",
+  "scripts/release/tag-ruleset.json",
 ]
 SPDX-FileCopyrightText = "2025-2026 VectoDE"
 SPDX-License-Identifier = "MIT"
 
-# The 1.x install script, kept until 2.0.0 replaces it.
+# Python requirements with hashes, generated by uv pip compile (the command is in the file); a header would be lost.
 [[annotations]]
-path = "install-configure-script.bash"
-SPDX-FileCopyrightText = "2025 VectoDE"
+path = "tests/ansible/requirements.txt"
+SPDX-FileCopyrightText = "2025-2026 VectoDE"
 SPDX-License-Identifier = "MIT"
 
 # Public signing keys of vendor package repositories, copied unchanged from the vendor so lss can check its packages.
diff --git a/ansible/.ansible-lint b/ansible/.ansible-lint
new file mode 100644
index 0000000..f99c9f1
--- /dev/null
+++ b/ansible/.ansible-lint
@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+---
+# The strictest profile; CI runs ansible-lint in this directory (.github/workflows/distribution.yml).
+profile: production
diff --git a/ansible/CHANGELOG.md b/ansible/CHANGELOG.md
new file mode 100644
index 0000000..26a7301
--- /dev/null
+++ b/ansible/CHANGELOG.md
@@ -0,0 +1,4 @@
+# Changelog
+
+The collection `vectode.lss` is released together with lss and has its version. Its changes are listed in the
+[changelog of lss](https://github.com/VectoDE/Linux-Server-Setup-Script/blob/main/CHANGELOG.md).
diff --git a/ansible/README.md b/ansible/README.md
new file mode 100644
index 0000000..0325530
--- /dev/null
+++ b/ansible/README.md
@@ -0,0 +1,64 @@
+# Ansible collection vectode.lss
+
+Sets up hardened Linux servers with [lss](https://github.com/VectoDE/Linux-Server-Setup-Script) from Ansible. The
+collection is built and attached with every release of lss and has its version: collection 2.0.1 installs lss 2.0.1.
+
+- Role `vectode.lss.lss`: installs lss on the target, writes `/etc/lss/lss.conf` and installs or removes modules.
+- Module `vectode.lss.lss`: `lss install` and `lss remove` as a task, with check mode and a change only when lss
+  changed something.
+
+## Install
+
+Download `vectode-lss-<version>.tar.gz` from the [release](https://github.com/VectoDE/Linux-Server-Setup-Script/releases),
+check it, and install it:
+
+```bash
+gh attestation verify vectode-lss-2.0.1.tar.gz --repo VectoDE/Linux-Server-Setup-Script \
+  --cert-identity https://github.com/VectoDE/Linux-Server-Setup-Script/.github/workflows/release.yml@refs/heads/main
+ansible-galaxy collection install vectode-lss-2.0.1.tar.gz
+```
+
+The role copies `bootstrap.sh` to the target, which installs lss only after the SHA-256 and the GitHub build
+attestation of the release verify (it downloads the GitHub CLI at a pinned version and checksum for that). Targets
+need Python 3, `curl` and access to github.com. Supported: Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04, RHEL,
+Rocky Linux and AlmaLinux 9 and 10, on x86_64 and aarch64.
+
+## Use
+
+```yaml
+- name: Hardened web server
+  hosts: web
+  become: true
+  roles:
+    - role: vectode.lss.lss
+      vars:
+        lss_profile: minimal-secure
+        lss_modules: [nginx, tls, vhost]
+        lss_settings:
+          LSS_ADMIN_USER_NAME: alice
+          LSS_ADMIN_USER_GITHUB_USER: alice-on-github
+          LSS_TLS_DOMAINS: www.example.com
+          LSS_VHOST_SITES: "site:static:www.example.com"
+```
+
+| Variable             | Default                   | Meaning                                                       |
+| -------------------- | ------------------------- | ------------------------------------------------------------- |
+| `lss_version`        | version of the collection | lss version to install; a different one updates or downgrades |
+| `lss_settings`       | `{}`                      | `/etc/lss/lss.conf` as `KEY: value` (mode 0600)               |
+| `lss_profile`        | `""`                      | profile to install                                            |
+| `lss_modules`        | `[]`                      | modules to install                                            |
+| `lss_modules_absent` | `[]`                      | modules to remove                                             |
+| `lss_mode`           | `""`                      | `native` or `docker` for services that support both           |
+
+The module on its own, once lss is installed:
+
+```yaml
+- name: Remove Adminer and its data
+  vectode.lss.lss:
+    modules: [adminer]
+    state: absent
+    purge: true
+```
+
+`ansible-doc vectode.lss.lss` describes every option. A second run with the same settings reports no change; check
+mode runs `lss --dry-run install`, which checks every setting without changing anything.
diff --git a/ansible/galaxy.yml b/ansible/galaxy.yml
new file mode 100644
index 0000000..ec5bed1
--- /dev/null
+++ b/ansible/galaxy.yml
@@ -0,0 +1,32 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# The collection vectode.lss. scripts/release/build.sh builds it with every release, at the version of lss it
+# installs; the release workflow raises "version" here together with VERSION.
+---
+namespace: vectode
+name: lss
+version: "2.0.0-dev"
+readme: README.md
+authors:
+  - VectoDE <157636760+VectoDE@users.noreply.github.com>
+description: Installs lss from a verified release and sets up hardened Linux servers with its modules.
+license:
+  - MIT
+tags:
+  - linux
+  - security
+  - hardening
+  - server
+  - infrastructure
+dependencies: {}
+repository: https://github.com/VectoDE/Linux-Server-Setup-Script
+documentation: https://github.com/VectoDE/Linux-Server-Setup-Script/blob/main/ansible/README.md
+homepage: https://github.com/VectoDE/Linux-Server-Setup-Script
+issues: https://github.com/VectoDE/Linux-Server-Setup-Script/issues
+build_ignore:
+  - .ansible
+  - .ansible-lint
+  - "*.pyc"
+  - __pycache__
diff --git a/ansible/meta/runtime.yml b/ansible/meta/runtime.yml
new file mode 100644
index 0000000..b5de753
--- /dev/null
+++ b/ansible/meta/runtime.yml
@@ -0,0 +1,5 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+---
+requires_ansible: ">=2.18.0"
diff --git a/ansible/plugins/modules/lss.py b/ansible/plugins/modules/lss.py
new file mode 100644
index 0000000..4603835
--- /dev/null
+++ b/ansible/plugins/modules/lss.py
@@ -0,0 +1,224 @@
+#!/usr/bin/python
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+"""Ansible module vectode.lss.lss: installs and removes lss modules through the lss command."""
+
+from __future__ import annotations
+
+import os
+import re
+
+from ansible.module_utils.basic import AnsibleModule
+
+DOCUMENTATION = r"""
+---
+module: lss
+short_description: Install and remove lss modules
+version_added: "2.0.0"
+description:
+  - Runs C(lss install) or C(lss remove) on the target, the command that sets up and hardens the server.
+  - Install lss first with the role M(vectode.lss.lss) or with C(bootstrap.sh), both of which verify the release.
+  - A module counts as changed when lss reports changes for it, so a second run with the same settings reports no change.
+author:
+  - VectoDE (@VectoDE)
+options:
+  modules:
+    description:
+      - lss modules to install or remove, such as V(nginx) or V(ssh-hardening). C(lss list) shows them all.
+      - Modules they require are installed with them.
+    type: list
+    elements: str
+    default: []
+  profile:
+    description:
+      - Profile to install, such as V(minimal-secure). Only with O(state=present).
+    type: str
+  state:
+    description:
+      - V(present) installs the modules and applies their settings, V(absent) removes them.
+    type: str
+    choices: [present, absent]
+    default: present
+  settings:
+    description:
+      - Settings for this run, each passed as C(--set KEY=VALUE), on top of C(/etc/lss/lss.conf).
+      - Keys are named C(LSS_<MODULE>_<OPTION>); C(lss info MODULE) lists them.
+    type: dict
+    default: {}
+  mode:
+    description:
+      - How services that support both are installed.
+    type: str
+    choices: [native, docker]
+  purge:
+    description:
+      - With O(state=absent), also delete the data of the modules.
+    type: bool
+    default: false
+  executable:
+    description:
+      - Path of the lss command.
+    type: path
+    default: /usr/local/sbin/lss
+attributes:
+  check_mode:
+    support: full
+    description: Runs C(lss --dry-run install), which checks every setting, and reports a change for each module that is not installed yet.
+  diff_mode:
+    support: none
+notes:
+  - Runs as root on the target (C(become=true)).
+"""
+
+EXAMPLES = r"""
+- name: Harden the server
+  vectode.lss.lss:
+    profile: minimal-secure
+    settings:
+      LSS_ADMIN_USER_NAME: alice
+      LSS_ADMIN_USER_GITHUB_USER: alice-on-github
+
+- name: Web server with certificates
+  vectode.lss.lss:
+    modules: [nginx, tls, vhost]
+    settings:
+      LSS_TLS_DOMAINS: www.example.com
+      LSS_VHOST_SITES: "site:static:www.example.com"
+
+- name: Remove Adminer and its data
+  vectode.lss.lss:
+    modules: [adminer]
+    state: absent
+    purge: true
+"""
+
+RETURN = r"""
+changed_modules:
+  description: Modules that were installed, changed or removed (in check mode, that would be).
+  returned: always
+  type: list
+  elements: str
+  sample: [nginx, tls]
+stdout_lines:
+  description: Output of the lss runs.
+  returned: always
+  type: list
+  elements: str
+"""
+
+NAME_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
+KEY_RE = re.compile(r"^LSS_[A-Z0-9_]+$")
+DONE_RE = re.compile(r"^OK +([a-z0-9-]+): done", re.MULTILINE)
+ORDER_RE = re.compile(r"Modules in order: ([a-z0-9 -]+)$", re.MULTILINE)
+
+
+def lss_command(module, *args):
+    """Runs lss without prompts and colours with the global options of this task; fails the task on an error."""
+    params = module.params
+    command = [params["executable"], "--yes", "--no-color"]
+    if params["mode"]:
+        command += ["--mode", params["mode"]]
+    for key, value in sorted(params["settings"].items()):
+        command += ["--set", f"{key}={value_text(value)}"]
+    command += list(args)
+    rc, stdout, stderr = module.run_command(command)
+    output = stdout + stderr
+    if rc != 0:
+        module.fail_json(msg=f"lss {' '.join(args)} failed (exit status {rc})", rc=rc, stdout_lines=output.splitlines())
+    return output
+
+
+def value_text(value):
+    """Booleans as lss reads them (true/false), everything else as text."""
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    return str(value)
+
+
+def installed_modules(module):
+    """Names of the modules lss lists as installed."""
+    output = lss_command(module, "status")
+    names = set()
+    for line in output.splitlines():
+        if not line.strip() or line.startswith("Failed services"):
+            break
+        fields = line.split()
+        if len(fields) >= 2 and fields[1] == "installed":
+            names.add(fields[0])
+    return names
+
+
+def check_params(module):
+    params = module.params
+    for name in params["modules"] + ([params["profile"]] if params["profile"] else []):
+        if not NAME_RE.match(name):
+            module.fail_json(msg=f"'{name}' is a module or profile name like nginx or minimal-secure.")
+    for key, value in params["settings"].items():
+        if not KEY_RE.match(key):
+            module.fail_json(msg=f"'{key}' is a setting name like LSS_NGINX_MAX_BODY.")
+        if "\n" in value_text(value):
+            module.fail_json(msg=f"The value of {key} spans more than one line.")
+    if params["state"] == "present" and not params["modules"] and not params["profile"]:
+        module.fail_json(msg="Name modules or a profile to install.")
+    if params["state"] == "absent" and params["profile"]:
+        module.fail_json(msg="state=absent removes modules; name them in modules, not as a profile.")
+
+
+def present(module):
+    params = module.params
+    target = ["--profile", params["profile"]] if params["profile"] else []
+    target += params["modules"]
+    if module.check_mode:
+        output = lss_command(module, "--dry-run", "install", *target)
+        order = ORDER_RE.search(output)
+        wanted = order.group(1).split() if order else params["modules"]
+        installed = installed_modules(module)
+        return [name for name in wanted if name not in installed], output
+    output = lss_command(module, "install", *target)
+    return DONE_RE.findall(output), output
+
+
+def absent(module):
+    params = module.params
+    installed = installed_modules(module)
+    removed = []
+    output = ""
+    for name in reversed(params["modules"]):
+        if name not in installed:
+            continue
+        removed.append(name)
+        if not module.check_mode:
+            output += lss_command(module, "remove", name, *(["--purge"] if params["purge"] else []))
+    return removed, output
+
+
+def main():
+    module = AnsibleModule(
+        argument_spec={
+            "modules": {"type": "list", "elements": "str", "default": []},
+            "profile": {"type": "str"},
+            "state": {"type": "str", "choices": ["present", "absent"], "default": "present"},
+            "settings": {"type": "dict", "default": {}},
+            "mode": {"type": "str", "choices": ["native", "docker"]},
+            "purge": {"type": "bool", "default": False},
+            "executable": {"type": "path", "default": "/usr/local/sbin/lss"},
+        },
+        supports_check_mode=True,
+    )
+    check_params(module)
+    if not os.access(module.params["executable"], os.X_OK):
+        if module.check_mode:
+            module.exit_json(changed=True, changed_modules=module.params["modules"], stdout_lines=[],
+                             msg="lss is not installed yet; the role vectode.lss.lss installs it first.")
+        module.fail_json(msg=f"{module.params['executable']} is missing; install lss first (role vectode.lss.lss).")
+    if module.params["state"] == "present":
+        changed, output = present(module)
+    else:
+        changed, output = absent(module)
+    module.exit_json(changed=bool(changed), changed_modules=changed, stdout_lines=output.splitlines())
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ansible/roles/lss/defaults/main.yml b/ansible/roles/lss/defaults/main.yml
new file mode 100644
index 0000000..50c115e
--- /dev/null
+++ b/ansible/roles/lss/defaults/main.yml
@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+---
+# Version of lss to install: by default the one this collection was released with. The release workflow raises it
+# together with VERSION.
+lss_version: "2.0.0-dev"
+# Settings written to /etc/lss/lss.conf (mode 0600), as KEY: value. Names follow LSS_<MODULE>_<OPTION>; `lss info
+# MODULE` lists them. Booleans become true and false.
+lss_settings: {}
+# Profile to install (minimal-secure, webhosting, ...), modules to install, and modules to remove.
+lss_profile: ""
+lss_modules: []
+lss_modules_absent: []
+# native or docker for services that support both; empty keeps the setting or default.
+lss_mode: ""
diff --git a/ansible/roles/lss/meta/argument_specs.yml b/ansible/roles/lss/meta/argument_specs.yml
new file mode 100644
index 0000000..6ff1a3a
--- /dev/null
+++ b/ansible/roles/lss/meta/argument_specs.yml
@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+---
+argument_specs:
+  main:
+    short_description: Install lss from a verified release and set up the server with its modules.
+    description:
+      - Runs bootstrap.sh of this collection on the target, which installs lss to /opt/lss/<version> only after the
+        SHA-256 and the GitHub build attestation of the release verify.
+      - Writes /etc/lss/lss.conf and installs or removes modules with the module vectode.lss.lss.
+    options:
+      lss_version:
+        type: str
+        description: Version of lss to install; by default the version of this collection.
+      lss_settings:
+        type: dict
+        default: {}
+        description: Settings for /etc/lss/lss.conf, as a mapping from setting name to value.
+      lss_profile:
+        type: str
+        default: ""
+        description: Profile to install.
+      lss_modules:
+        type: list
+        elements: str
+        default: []
+        description: Modules to install.
+      lss_modules_absent:
+        type: list
+        elements: str
+        default: []
+        description: Modules to remove.
+      lss_mode:
+        type: str
+        default: ""
+        choices: ["", native, docker]
+        description: native or docker for services that support both.
diff --git a/ansible/roles/lss/meta/main.yml b/ansible/roles/lss/meta/main.yml
new file mode 100644
index 0000000..80db951
--- /dev/null
+++ b/ansible/roles/lss/meta/main.yml
@@ -0,0 +1,17 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+---
+galaxy_info:
+  author: VectoDE
+  description: Installs lss from a verified release, writes its settings and installs or removes its modules.
+  license: MIT
+  min_ansible_version: "2.18"
+  platforms:
+    - name: Debian
+      versions: [all]
+    - name: Ubuntu
+      versions: [all]
+    - name: EL
+      versions: [all]
+dependencies: []
diff --git a/ansible/roles/lss/tasks/main.yml b/ansible/roles/lss/tasks/main.yml
new file mode 100644
index 0000000..421d278
--- /dev/null
+++ b/ansible/roles/lss/tasks/main.yml
@@ -0,0 +1,53 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+---
+- name: Check the settings
+  ansible.builtin.assert:
+    that:
+      - lss_version is match('^[0-9]+[.][0-9]+[.][0-9]+(-[0-9A-Za-z.-]+)?$')
+      - lss_settings.keys() | reject('match', '^LSS_[A-Z0-9_]+$') | list | length == 0
+      - lss_settings.values() | map('string') | select('search', '\n') | list | length == 0
+    fail_msg: lss_version is a version like 2.0.1, and lss_settings maps names like LSS_NGINX_MAX_BODY to one-line values.
+    quiet: true
+
+- name: Read the active lss version
+  ansible.builtin.stat:
+    path: /opt/lss/current
+    follow: false
+  register: lss_current
+
+- name: Install the verified release of lss {{ lss_version }}
+  ansible.builtin.script:
+    cmd: bootstrap.sh {{ lss_version | quote }}
+  when: not lss_current.stat.exists or lss_current.stat.lnk_target | default('') != lss_version
+  changed_when: true
+
+- name: Create /etc/lss
+  ansible.builtin.file:
+    path: /etc/lss
+    state: directory
+    owner: root
+    group: root
+    mode: "0750"
+
+- name: Write /etc/lss/lss.conf
+  ansible.builtin.template:
+    src: lss.conf.j2
+    dest: /etc/lss/lss.conf
+    owner: root
+    group: root
+    mode: "0600"
+
+- name: Install the modules
+  vectode.lss.lss:
+    profile: "{{ lss_profile | default(omit, true) }}"
+    modules: "{{ lss_modules }}"
+    mode: "{{ lss_mode | default(omit, true) }}"
+  when: lss_profile | length > 0 or lss_modules | length > 0
+
+- name: Remove modules
+  vectode.lss.lss:
+    modules: "{{ lss_modules_absent }}"
+    state: absent
+  when: lss_modules_absent | length > 0
diff --git a/ansible/roles/lss/templates/lss.conf.j2 b/ansible/roles/lss/templates/lss.conf.j2
new file mode 100644
index 0000000..6bf3b9f
--- /dev/null
+++ b/ansible/roles/lss/templates/lss.conf.j2
@@ -0,0 +1,7 @@
+{# SPDX-FileCopyrightText: 2025-2026 VectoDE
+
+   SPDX-License-Identifier: MIT #}
+# Managed by Ansible (role vectode.lss.lss). Changes here are overwritten on the next run.
+{% for key, value in lss_settings | dictsort %}
+{{ key }}={{ (value | string | lower) if value is boolean else value }}
+{% endfor %}
diff --git a/bootstrap.sh b/bootstrap.sh
new file mode 100755
index 0000000..0c884ff
--- /dev/null
+++ b/bootstrap.sh
@@ -0,0 +1,534 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# bootstrap.sh: installs lss from a signed release, and is what `lss update` runs.
+#
+#   sudo bash bootstrap.sh [VERSION]       install VERSION (default: the latest release) and make it the active one
+#   sudo bash bootstrap.sh --rollback      switch back to the version that was active before
+#   sudo bash bootstrap.sh --dry-run [V]   download and verify only
+#
+# Nothing from a download runs before two checks pass: the SHA-256 of the archive matches SHA256SUMS of the release,
+# and the GitHub build attestation (Sigstore, SLSA provenance) of both files proves that the release workflow of
+# VectoDE/Linux-Server-Setup-Script built them from main on a GitHub-hosted runner. The attestation is checked with
+# the GitHub CLI, downloaded at a pinned version and checked against its pinned SHA-256 first.
+#
+# Layout: every version in /opt/lss/<version> (root-owned, not writable for others), the active one behind the
+# symbolic link /opt/lss/current, the one before it behind /opt/lss/previous, and /usr/local/sbin/lss pointing to
+# /opt/lss/current/lss. Links are replaced with rename(2), so a reader sees the old or the new version, never none.
+# Older versions than these two are deleted.
+
+set -Eeuo pipefail
+shopt -s inherit_errexit
+
+BS_REPO=VectoDE/Linux-Server-Setup-Script
+# GitHub CLI used to check attestations. A new version needs both checksums from its gh_<version>_checksums.txt.
+BS_GH_VERSION=2.102.0
+BS_GH_SHA256_AMD64=bb766f710eef8ede859c18578c72c327597cd4c8a85b06001b1f3843c6019386
+BS_GH_SHA256_ARM64=7862c86c72f43df3a2d93ddde6f473285b4e2af61b494849846827e513ef6484
+BS_VERSION_RE='^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'
+
+LSS_PREFIX=${LSS_PREFIX:-/opt/lss}
+LSS_BIN_LINK=${LSS_BIN_LINK:-/usr/local/sbin/lss}
+LSS_LOCK=${LSS_LOCK:-/run/lss.lock}
+# Where releases come from: https:// (the GitHub releases of this repository, or a mirror of them) or file:// (a
+# directory with the same layout, used by the tests). The files are checked the same way wherever they come from.
+LSS_RELEASE_URL=${LSS_RELEASE_URL:-https://github.com/${BS_REPO}/releases}
+# The workflow and git ref that must have signed a release. The tests of this repository sign test builds with their
+# own workflow on the pull request ref and set these two; releases are signed by release.yml on main.
+LSS_RELEASE_WORKFLOW=${LSS_RELEASE_WORKFLOW:-release.yml}
+LSS_RELEASE_REF=${LSS_RELEASE_REF:-refs/heads/main}
+LSS_DRY_RUN=${LSS_DRY_RUN:-0}
+
+# --- output -------------------------------------------------------------------------------------------------------
+
+# Same format as lss itself: terminal, the run log of `lss update` and the journal (identifier "lss").
+bs_log() {
+	local level=$1
+	shift
+	printf '%-5s %s\n' "${level}" "$*" >&2
+	if [[ -n ${LSS_LOG_FILE:-} ]]; then
+		printf '%s %-5s %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "${level}" "$*" >>"${LSS_LOG_FILE}" 2>/dev/null || true
+	fi
+	if [[ ${LSS_JOURNAL:-1} == 1 ]] && command -v logger >/dev/null 2>&1; then
+		logger -t lss -- "${level} $*" 2>/dev/null || true
+	fi
+	return
+}
+
+bs_info() {
+	bs_log INFO "$*"
+	return
+}
+
+bs_ok() {
+	bs_log OK "$*"
+	return
+}
+
+bs_warn() {
+	bs_log WARN "$*"
+	return
+}
+
+bs_die() {
+	bs_log ERROR "$*"
+	exit 1
+}
+
+# --- versions -----------------------------------------------------------------------------------------------------
+
+bs_valid_version() {
+	local version=$1
+	[[ ${version} =~ ${BS_VERSION_RE} ]]
+	return
+}
+
+# _bs_ident_cmp A B: compares two pre-release identifiers by SemVer rules (numbers numerically and below words).
+_bs_ident_cmp() {
+	local a=$1 b=$2
+	if [[ ${a} =~ ^[0-9]+$ && ${b} =~ ^[0-9]+$ ]]; then
+		if ((10#${a} > 10#${b})); then
+			printf '1'
+		elif ((10#${a} < 10#${b})); then
+			printf -- '-1'
+		else
+			printf '0'
+		fi
+	elif [[ ${a} =~ ^[0-9]+$ ]]; then
+		printf -- '-1'
+	elif [[ ${b} =~ ^[0-9]+$ ]]; then
+		printf '1'
+	elif [[ ${a} > "${b}" ]]; then
+		printf '1'
+	elif [[ ${a} < "${b}" ]]; then
+		printf -- '-1'
+	else
+		printf '0'
+	fi
+	return
+}
+
+# bs_version_cmp A B: prints 1, 0 or -1 when version A is newer than, equal to or older than B (SemVer precedence:
+# 2.1.0 > 2.1.0-rc.2 > 2.1.0-rc.1 > 2.0.9).
+bs_version_cmp() {
+	local a=$1 b=$2 a_pre='' b_pre='' i result
+	local -a x=() y=()
+	[[ ${a} != *-* ]] || a_pre=${a#*-}
+	[[ ${b} != *-* ]] || b_pre=${b#*-}
+	IFS=. read -ra x <<<"${a%%-*}"
+	IFS=. read -ra y <<<"${b%%-*}"
+	for i in 0 1 2; do
+		result=$(_bs_ident_cmp "${x[i]}" "${y[i]}")
+		if [[ ${result} != 0 ]]; then
+			printf '%s' "${result}"
+			return 0
+		fi
+	done
+	if [[ -z ${a_pre} || -z ${b_pre} ]]; then
+		# A release ranks above its own pre-releases.
+		if [[ -z ${a_pre} && -n ${b_pre} ]]; then
+			printf '1'
+		elif [[ -n ${a_pre} && -z ${b_pre} ]]; then
+			printf -- '-1'
+		else
+			printf '0'
+		fi
+		return 0
+	fi
+	IFS=. read -ra x <<<"${a_pre}"
+	IFS=. read -ra y <<<"${b_pre}"
+	for ((i = 0; i < ${#x[@]} || i < ${#y[@]}; i++)); do
+		if ((i >= ${#x[@]})); then
+			printf -- '-1'
+			return 0
+		fi
+		if ((i >= ${#y[@]})); then
+			printf '1'
+			return 0
+		fi
+		result=$(_bs_ident_cmp "${x[i]}" "${y[i]}")
+		if [[ ${result} != 0 ]]; then
+			printf '%s' "${result}"
+			return 0
+		fi
+	done
+	printf '0'
+	return
+}
+
+# --- downloads and checks -----------------------------------------------------------------------------------------
+
+# bs_fetch URL DEST: HTTPS only (redirects included), or file:// for a local release directory.
+bs_fetch() {
+	local url=$1 dest=$2 proto
+	case ${url} in
+	https://*) proto='=https' ;;
+	file://*) proto='=file' ;;
+	*) bs_die "Refusing ${url}: releases are downloaded over HTTPS." ;;
+	esac
+	# 9>&- here and for gh: helpers must not inherit the run lock (fd 9 of lss and bootstrap.sh). A helper process that
+	# outlives the run would keep the lock and refuse the next lss run.
+	curl --proto "${proto}" --proto-redir "${proto}" --tlsv1.2 -fsSL --retry 3 --retry-delay 2 -o "${dest}" -- "${url}" 9>&- ||
+		bs_die "Download failed: ${url}"
+	return
+}
+
+# bs_sum_of SUMS NAME: the SHA-256 that a SHA256SUMS file lists for NAME.
+bs_sum_of() {
+	local sums=$1 name=$2
+	awk -v name="${name}" '$2 == name || $2 == "*" name { print $1; exit }' "${sums}"
+	return
+}
+
+# bs_check_sum FILE SUMS: the file's SHA-256 must be the one SHA256SUMS lists for its name.
+bs_check_sum() {
+	local file=$1 sums=$2 expected actual
+	expected=$(bs_sum_of "${sums}" "${file##*/}")
+	[[ ${expected} =~ ^[0-9a-f]{64}$ ]] || bs_die "SHA256SUMS lists ${file##*/} without a SHA-256; the release is incomplete."
+	actual=$(sha256sum -- "${file}" | cut -d ' ' -f 1)
+	[[ ${actual} == "${expected}" ]] ||
+		bs_die "Checksum mismatch for ${file##*/}: SHA256SUMS lists ${expected}, the download has ${actual}."
+	return
+}
+
+# bs_latest_version DIR: the version of the latest release, read from the file list in its SHA256SUMS.
+bs_latest_version() {
+	local dir=$1 version
+	bs_fetch "${LSS_RELEASE_URL}/latest/download/SHA256SUMS" "${dir}/latest.sums"
+	version=$(sed -nE 's/^[0-9a-f]{64} [ *]lss-(.+)\.tar\.gz$/\1/p' "${dir}/latest.sums")
+	bs_valid_version "${version}" || bs_die "The latest release at ${LSS_RELEASE_URL} names its version unclearly ('${version}')."
+	printf '%s' "${version}"
+	return
+}
+
+bs_arch() {
+	local machine
+	machine=$(uname -m)
+	case ${machine} in
+	x86_64 | amd64) printf 'amd64' ;;
+	aarch64 | arm64) printf 'arm64' ;;
+	*) bs_die "lss runs on x86_64 and aarch64; this machine is ${machine}." ;;
+	esac
+	return
+}
+
+# bs_fetch_gh DIR: downloads the pinned GitHub CLI, checks its SHA-256 and prints the path of the gh binary.
+bs_fetch_gh() {
+	local dir=$1 arch name sum actual
+	arch=$(bs_arch)
+	name="gh_${BS_GH_VERSION}_linux_${arch}"
+	if [[ ${arch} == arm64 ]]; then sum=${BS_GH_SHA256_ARM64}; else sum=${BS_GH_SHA256_AMD64}; fi
+	bs_fetch "https://github.com/cli/cli/releases/download/v${BS_GH_VERSION}/${name}.tar.gz" "${dir}/gh.tar.gz"
+	actual=$(sha256sum -- "${dir}/gh.tar.gz" | cut -d ' ' -f 1)
+	[[ ${actual} == "${sum}" ]] ||
+		bs_die "Checksum mismatch for the GitHub CLI ${BS_GH_VERSION}: expected ${sum}, got ${actual}."
+	mkdir -p "${dir}/gh"
+	tar -xzf "${dir}/gh.tar.gz" -C "${dir}/gh" --strip-components=2 "${name}/bin/gh"
+	printf '%s' "${dir}/gh/gh"
+	return
+}
+
+# bs_signer: the certificate identity a release must be signed with (the workflow file and the ref it ran on).
+bs_signer() {
+	[[ ${LSS_RELEASE_WORKFLOW} =~ ^[A-Za-z0-9._-]+\.ya?ml$ ]] ||
+		bs_die "LSS_RELEASE_WORKFLOW '${LSS_RELEASE_WORKFLOW}' is a workflow file name like release.yml."
+	[[ ${LSS_RELEASE_REF} =~ ^refs/(heads|tags|pull)/[A-Za-z0-9._/-]+$ && ${LSS_RELEASE_REF} != *..* ]] ||
+		bs_die "LSS_RELEASE_REF '${LSS_RELEASE_REF}' is a git ref like refs/heads/main."
+	printf 'https://github.com/%s/.github/workflows/%s@%s' "${BS_REPO}" "${LSS_RELEASE_WORKFLOW}" "${LSS_RELEASE_REF}"
+	return
+}
+
+# bs_check_attestation GH FILE BUNDLE: the Sigstore bundle must hold a valid SLSA provenance attestation for the
+# file, signed for the release workflow of this repository on a GitHub-hosted runner.
+bs_check_attestation() {
+	local gh=$1 file=$2 bundle=$3 dir output signer
+	dir=$(dirname -- "${bundle}")
+	signer=$(bs_signer)
+	output=$(
+		GH_CONFIG_DIR="${dir}/.gh" XDG_CACHE_HOME="${dir}/.cache" XDG_STATE_HOME="${dir}/.state" \
+			XDG_DATA_HOME="${dir}/.data" GH_NO_UPDATE_NOTIFIER=1 GH_PROMPT_DISABLED=1 NO_COLOR=1 \
+			"${gh}" attestation verify "${file}" --bundle "${bundle}" --repo "${BS_REPO}" \
+			--cert-identity "${signer}" --source-ref "${LSS_RELEASE_REF}" --deny-self-hosted-runners 2>&1 9>&-
+	) || {
+		printf '%s\n' "${output}" | tail -n 5 | sed 's/^/  gh: /' >&2
+		bs_die "The attestation of ${file##*/} does not verify; it was not built by ${BS_REPO} (${LSS_RELEASE_WORKFLOW} on ${LSS_RELEASE_REF}). Nothing was installed."
+	}
+	return
+}
+
+# bs_download VERSION DIR: downloads and checks one release; prints the path of its verified archive.
+bs_download() {
+	local version=$1 dir=$2 base archive gh
+	base="${LSS_RELEASE_URL}/download/v${version}"
+	archive="${dir}/lss-${version}.tar.gz"
+	bs_info "Downloading lss ${version}"
+	bs_fetch "${base}/SHA256SUMS" "${dir}/SHA256SUMS"
+	bs_fetch "${base}/lss-${version}.tar.gz" "${archive}"
+	bs_fetch "${base}/lss-${version}.intoto.jsonl" "${dir}/lss-${version}.intoto.jsonl"
+	bs_check_sum "${archive}" "${dir}/SHA256SUMS"
+	gh=$(bs_fetch_gh "${dir}")
+	bs_check_attestation "${gh}" "${dir}/SHA256SUMS" "${dir}/lss-${version}.intoto.jsonl"
+	bs_check_attestation "${gh}" "${archive}" "${dir}/lss-${version}.intoto.jsonl"
+	bs_ok "lss ${version}: checksum and build attestation verified"
+	printf '%s' "${archive}"
+	return
+}
+
+# --- installed versions -------------------------------------------------------------------------------------------
+
+# bs_link_target LINK: the version a link in the prefix points to, or nothing.
+bs_link_target() {
+	local link="${LSS_PREFIX}/$1" target
+	[[ -L ${link} ]] || return 0
+	target=$(readlink -- "${link}")
+	if bs_valid_version "${target}" && [[ -d ${LSS_PREFIX}/${target} ]]; then
+		printf '%s' "${target}"
+	fi
+	return
+}
+
+# bs_set_link TARGET LINK: points LINK to TARGET in one rename, so the link is never missing.
+bs_set_link() {
+	local target=$1 link=$2 next
+	next="$(dirname -- "${link}")/.${link##*/}.next"
+	rm -f -- "${next}"
+	ln -s -- "${target}" "${next}"
+	mv -fT -- "${next}" "${link}"
+	return
+}
+
+# bs_write_manifest DIR: SHA-256 of every file of an installed version, checked again before a rollback.
+bs_write_manifest() {
+	local dir=$1
+	(
+		cd -- "${dir}"
+		find . -type f -print0 | LC_ALL=C sort -z | xargs -0 sha256sum >"../.manifest.$$"
+	)
+	mv -f -- "${dir}/../.manifest.$$" "${dir}/.lss-manifest"
+	chmod 0644 "${dir}/.lss-manifest"
+	return
+}
+
+bs_check_manifest() {
+	local dir=$1
+	[[ -f ${dir}/.lss-manifest ]] || bs_die "${dir} has lost its file list (.lss-manifest); install that version again."
+	(cd -- "${dir}" && sha256sum --quiet --strict -c .lss-manifest >/dev/null 2>&1) ||
+		bs_die "Files in ${dir} changed after it was installed; install that version again instead of switching to it."
+	return
+}
+
+# bs_unpack ARCHIVE VERSION: unpacks a verified archive into LSS_PREFIX/VERSION, replacing an earlier copy.
+bs_unpack() {
+	local archive=$1 version=$2 stage tree old
+	mkdir -p -- "${LSS_PREFIX}"
+	chmod 0755 "${LSS_PREFIX}"
+	stage=$(mktemp -d "${LSS_PREFIX}/.stage-${version}.XXXXXX")
+	tar -xzf "${archive}" -C "${stage}" --no-same-owner --no-same-permissions
+	tree="${stage}/lss-${version}"
+	[[ -f ${tree}/lss && -f ${tree}/VERSION ]] || bs_die "The archive of ${version} holds no lss-${version}/ directory with lss in it."
+	[[ $(<"${tree}/VERSION") == "${version}" ]] ||
+		bs_die "The archive of ${version} contains version $(<"${tree}/VERSION"); refusing to install it under the wrong name."
+	if [[ ${EUID} -eq 0 ]]; then
+		chown -R 0:0 -- "${tree}"
+	fi
+	chmod -R u+rwX,go+rX,go-w -- "${tree}"
+	chmod 0755 "${tree}/lss"
+	bs_write_manifest "${tree}"
+	if [[ -e ${LSS_PREFIX}/${version} ]]; then
+		old=$(mktemp -d "${LSS_PREFIX}/.old-${version}.XXXXXX")
+		mv -- "${LSS_PREFIX}/${version}" "${old}/"
+		rm -rf -- "${old}"
+	fi
+	mv -T -- "${tree}" "${LSS_PREFIX}/${version}"
+	rm -rf -- "${stage}"
+	return
+}
+
+# bs_activate VERSION: makes an installed version the active one and keeps the one before as "previous". The new
+# version must answer `lss version` with its own version, or the links go back to what they were.
+bs_activate() {
+	local version=$1 current previous answer
+	current=$(bs_link_target current)
+	previous=$(bs_link_target previous)
+	if [[ -n ${current} && ${current} != "${version}" ]]; then
+		bs_set_link "${current}" "${LSS_PREFIX}/previous"
+	fi
+	bs_set_link "${version}" "${LSS_PREFIX}/current"
+	mkdir -p -- "$(dirname -- "${LSS_BIN_LINK}")"
+	bs_set_link "${LSS_PREFIX}/current/lss" "${LSS_BIN_LINK}"
+	answer=$("${LSS_PREFIX}/current/lss" version 2>&1) || true
+	if [[ ${answer} != "lss ${version}" ]]; then
+		if [[ -n ${current} ]]; then
+			bs_set_link "${current}" "${LSS_PREFIX}/current"
+		fi
+		if [[ -n ${previous} ]]; then
+			bs_set_link "${previous}" "${LSS_PREFIX}/previous"
+		else
+			rm -f -- "${LSS_PREFIX}/previous"
+		fi
+		bs_die "lss ${version} does not start ('${answer}'); ${current:-the earlier state} stays active."
+	fi
+	return
+}
+
+# bs_prune: deletes versions other than the active and the previous one, and leftovers of interrupted runs.
+bs_prune() {
+	local current previous dir name
+	current=$(bs_link_target current)
+	previous=$(bs_link_target previous)
+	for dir in "${LSS_PREFIX}"/* "${LSS_PREFIX}"/.stage-* "${LSS_PREFIX}"/.old-*; do
+		[[ -d ${dir} && ! -L ${dir} ]] || continue
+		name=${dir##*/}
+		case ${name} in
+		.stage-* | .old-*) ;;
+		*)
+			bs_valid_version "${name}" || continue
+			[[ ${name} != "${current}" && ${name} != "${previous}" ]] || continue
+			bs_info "Removing lss ${name}"
+			;;
+		esac
+		rm -rf -- "${dir}"
+	done
+	return
+}
+
+# --- commands -----------------------------------------------------------------------------------------------------
+
+bs_require() {
+	local tool
+	local -a missing=()
+	if [[ ${EUID} -ne 0 ]]; then
+		bs_die "bootstrap.sh installs lss for the whole system and must run as root (sudo bash bootstrap.sh)."
+	fi
+	for tool in curl tar gzip sha256sum flock mktemp readlink awk sed find xargs; do
+		command -v "${tool}" >/dev/null 2>&1 || missing+=("${tool}")
+	done
+	[[ ${#missing[@]} -eq 0 ]] ||
+		bs_die "bootstrap.sh needs ${missing[*]}; install them with apt-get or dnf first."
+	return
+}
+
+# bs_check_layout: an lss checkout in the prefix (the way 2.0 development versions were installed) must move first.
+bs_check_layout() {
+	if [[ -e ${LSS_PREFIX}/lss && ! -L ${LSS_PREFIX}/current ]]; then
+		bs_die "${LSS_PREFIX} holds an lss checkout, where releases go now. Move it away (mv ${LSS_PREFIX} ${LSS_PREFIX}.checkout) and run this again; /etc/lss and /var/lib/lss stay as they are."
+	fi
+	return
+}
+
+bs_lock() {
+	# `lss update` holds the lock already and runs this script with LSS_LOCK_HELD=1.
+	[[ ${LSS_LOCK_HELD:-0} != 1 ]] || return 0
+	exec 9>"${LSS_LOCK}"
+	flock -w 5 9 || bs_die "Another lss run is in progress."
+	return
+}
+
+bs_install() {
+	local requested=$1 dir=$2 version current archive order
+	current=$(bs_link_target current)
+	if [[ -n ${requested} ]]; then
+		version=${requested#v}
+		bs_valid_version "${version}" || bs_die "'${requested}' is a version like 2.0.1."
+	else
+		version=$(bs_latest_version "${dir}")
+		if [[ -n ${current} && $(bs_version_cmp "${version}" "${current}") == -1 ]]; then
+			bs_ok "lss ${current} is newer than the latest release ${version} and stays active."
+			return 0
+		fi
+	fi
+	if [[ ${version} == "${current}" ]]; then
+		bs_ok "lss ${version} is installed and active."
+		return 0
+	fi
+	if [[ -n ${current} ]]; then
+		order=$(bs_version_cmp "${version}" "${current}")
+		if [[ ${order} == -1 ]]; then
+			bs_warn "Going back from ${current} to the older ${version}; settings that only ${current} knows produce a warning."
+		fi
+	fi
+	archive=$(bs_download "${version}" "${dir}")
+	if [[ ${LSS_DRY_RUN} == 1 ]]; then
+		bs_ok "Dry run: lss ${version} verified; nothing was changed."
+		return 0
+	fi
+	bs_unpack "${archive}" "${version}"
+	bs_activate "${version}"
+	bs_prune
+	if [[ -n ${current} ]]; then
+		bs_ok "lss ${version} is active (was ${current}; 'lss update --rollback' goes back)."
+		bs_info "Run 'lss verify' now, and 'lss configure MODULE...' to apply what the new version changes in a module."
+	else
+		bs_ok "lss ${version} is installed: ${LSS_PREFIX}/${version}, command ${LSS_BIN_LINK}."
+		bs_info "Next: sudo lss install --profile minimal-secure (see 'lss --help')."
+	fi
+	return
+}
+
+bs_rollback() {
+	local current previous
+	current=$(bs_link_target current)
+	previous=$(bs_link_target previous)
+	[[ -n ${previous} ]] || bs_die "There is only one installed version of lss; rollback needs the one before it."
+	bs_check_manifest "${LSS_PREFIX}/${previous}"
+	if [[ ${LSS_DRY_RUN} == 1 ]]; then
+		bs_ok "Dry run: lss ${previous} is intact; nothing was changed."
+		return 0
+	fi
+	bs_activate "${previous}"
+	bs_ok "lss ${previous} is active again (was ${current}; 'lss update ${current}' returns to it)."
+	return
+}
+
+bs_usage() {
+	cat <<EOF
+Usage: sudo bash bootstrap.sh [--dry-run] [VERSION]
+       sudo bash bootstrap.sh [--dry-run] --rollback
+
+Installs lss VERSION (default: the latest release) from a release whose checksum and GitHub build attestation
+verify, and makes it the active version: ${LSS_PREFIX}/VERSION, ${LSS_PREFIX}/current, ${LSS_BIN_LINK}.
+--rollback switches back to the version that was active before.
+EOF
+	return
+}
+
+bs_main() {
+	local version='' rollback=0 dir arg
+	while [[ $# -gt 0 ]]; do
+		arg=$1
+		case ${arg} in
+		--rollback) rollback=1 ;;
+		--dry-run) LSS_DRY_RUN=1 ;;
+		-h | --help)
+			bs_usage
+			return 0
+			;;
+		-*) bs_die "Unknown option '${arg}'. See 'bootstrap.sh --help'." ;;
+		*)
+			[[ -z ${version} ]] || bs_die "Name one version, not '${version}' and '${arg}'."
+			version=${arg}
+			;;
+		esac
+		shift
+	done
+	[[ ${rollback} == 0 || -z ${version} ]] || bs_die "--rollback goes back to the previous version; it takes a version of its own."
+	umask 022
+	bs_require
+	bs_check_layout
+	bs_lock
+	if [[ ${rollback} == 1 ]]; then
+		bs_rollback
+		return 0
+	fi
+	dir=$(mktemp -d)
+	# shellcheck disable=SC2064 # the directory is fixed now
+	trap "rm -rf -- '${dir}'" EXIT
+	bs_install "${version}" "${dir}"
+	return
+}
+
+if [[ ${BASH_SOURCE[0]} == "$0" ]]; then
+	bs_main "$@"
+fi
diff --git a/docs/architecture.md b/docs/architecture.md
index d1f0c5f..34f4e25 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -28,8 +28,14 @@ data/repos data/keys    vendor repositories and their public keys
 profiles/               module sets with settings
 libexec/lss-guard       the daily check of the guard module
 libexec/lss-container-firewall   nftables rules for published container ports
+bootstrap.sh            installs, updates and rolls back lss from verified releases (`lss update` runs it)
+ansible/                the Ansible collection vectode.lss
+scripts/release/        version, build, SBOM and checksums of a release (used by the release workflow)
 ```
 
+lss itself is installed in `/opt/lss/<version>`, with `/opt/lss/current` pointing to the active version and
+`/usr/local/sbin/lss` to `/opt/lss/current/lss` ([installing and upgrading](upgrading.md#where-lss-lives)).
+
 ## A run
 
 `lss install fail2ban` goes through these stages:
@@ -104,5 +110,7 @@ refused.
 - As root, lss refuses symbolic links where it writes, and runs commands inside home directories as that user.
 - Vendor repositories are added only when the key matches a fingerprint pinned in the repository; downloads only
   when their SHA-256 matches.
+- lss itself is installed and updated only from releases whose SHA-256 and signed build attestation verify; the code
+  in `/opt/lss` belongs to root and nobody else can write it.
 - Secrets are generated with the kernel's random source, stored with mode 0600, masked in logs, and passed to
   programs through files or standard input, never on the command line.
diff --git a/docs/releasing.md b/docs/releasing.md
new file mode 100644
index 0000000..db9bd59
--- /dev/null
+++ b/docs/releasing.md
@@ -0,0 +1,86 @@
+# Releasing
+
+Releases are made by the [release workflow](../.github/workflows/release.yml), never from a laptop. Every push to
+`main` (a merged pull request) becomes a release:
+
+1. **Pick the version and check.** `scripts/release/prepare.sh` reads the commits since the last version tag and the
+   labels of their pull requests: `breaking-change` (or `type!:`, `BREAKING CHANGE`) makes a major release,
+   `enhancement` (or `feat:`) a minor one, everything else a patch. While `VERSION` carries a pre-release suffix such
+   as `2.0.0-dev`, the release is that version without the suffix. The script writes the version to `VERSION`,
+   `ansible/galaxy.yml` and the default of the role `vectode.lss.lss`, and turns `## Unreleased` in `CHANGELOG.md`
+   into the section of the release. The unit tests run on the result.
+2. **Commit and tag.** A job without any code of the repository applies exactly that change (it refuses a change to
+   any other file), signs the commit and the tag with the release SSH key and pushes both with the deploy key, the
+   only actor allowed past the rulesets of `main` and of the tags.
+3. **Build and sign.** `scripts/release/build.sh` builds `lss-<version>.tar.gz`, `bootstrap.sh`, the Ansible
+   collection `vectode-lss-<version>.tar.gz`, the CycloneDX SBOM `lss-<version>.cdx.json` and `SHA256SUMS` from the
+   tagged commit. `actions/attest-build-provenance` signs one SLSA provenance attestation for all of them with the
+   workflow's OIDC identity (Sigstore, no stored key) and keeps it as `lss-<version>.intoto.jsonl`.
+4. **Publish.** The GitHub release gets the six files and the notes from the changelog.
+
+`bootstrap.sh` and `lss update` accept only releases whose attestation was signed by `release.yml` on
+`refs/heads/main` ([upgrading](upgrading.md#what-gets-checked)). A commit message containing `[skip release]` leaves a
+push out; the release commit carries it, so it does not release itself.
+
+The workflow can be started by hand on `main`: with a version step, with a pre-release name such as `rc.1` (makes
+`2.0.0-rc.1` without touching the changelog; a test of the workflow or a release candidate), or with `attach` to
+build and attach the files of an existing tag again. Each step skips what exists already, so a rerun is safe.
+
+The same build runs on every pull request: `.github/workflows/distribution.yml` builds two test releases with
+`scripts/release/build.sh`, attests them with its own identity and installs, updates, rolls back and downgrades them
+with `bootstrap.sh` on every supported system, refuses tampered copies, and runs the Ansible collection against the
+same systems.
+
+## Setting up the repository (owner)
+
+These settings are needed once, before the first release. They are not in the repository and change who can push,
+so only the owner applies them.
+
+1. **Environment `release`**, usable from `main` only:
+
+   ```bash
+   gh api -X PUT repos/VectoDE/Linux-Server-Setup-Script/environments/release \
+     -F 'deployment_branch_policy[protected_branches]=false' -F 'deployment_branch_policy[custom_branch_policies]=true'
+   gh api -X POST repos/VectoDE/Linux-Server-Setup-Script/environments/release/deployment-branch-policies \
+     -f name=main -f type=branch
+   ```
+
+2. **Deploy key** with write access, its private half as the environment secret `RELEASE_DEPLOY_KEY`:
+
+   ```bash
+   ssh-keygen -t ed25519 -N '' -C 'lss release workflow' -f release-deploy-key
+   gh repo deploy-key add release-deploy-key.pub -R VectoDE/Linux-Server-Setup-Script --allow-write \
+     --title 'Release workflow'
+   gh secret set RELEASE_DEPLOY_KEY -R VectoDE/Linux-Server-Setup-Script --env release < release-deploy-key
+   rm release-deploy-key release-deploy-key.pub
+   ```
+
+3. **Signing key**: the private half of the SSH key in `.github/allowed_signers` (registered as a signing key on the
+   maintainer's account, the same key as in Self-Updater) as the environment secret `RELEASE_SIGNING_KEY`:
+   `gh secret set RELEASE_SIGNING_KEY -R VectoDE/Linux-Server-Setup-Script --env release < <private key file>`.
+
+4. **Tag ruleset**: only the deploy key may create, move or delete tags. The ruleset "Protect tags" exists and
+   already blocks moving and deleting; [`scripts/release/tag-ruleset.json`](../scripts/release/tag-ruleset.json) adds
+   creation:
+
+   ```bash
+   id=$(gh api repos/VectoDE/Linux-Server-Setup-Script/rulesets --jq '.[] | select(.name == "Protect tags") | .id')
+   gh api -X PUT "repos/VectoDE/Linux-Server-Setup-Script/rulesets/$id" --input scripts/release/tag-ruleset.json
+   ```
+
+   The ruleset of `main` lets the deploy key push past the pull request rule already.
+
+5. **Test release**: run the workflow on `main` with the pre-release name `rc.1` (Actions, Release, Run workflow) and
+   check the result with `bootstrap.sh 2.0.0-rc.1` on a test server or VM. The release `2.0.0` follows from the next
+   merge.
+
+## Verifying a release by hand
+
+```bash
+gh release download v2.0.1 -R VectoDE/Linux-Server-Setup-Script
+sha256sum --check SHA256SUMS
+gh attestation verify lss-2.0.1.tar.gz --bundle lss-2.0.1.intoto.jsonl --repo VectoDE/Linux-Server-Setup-Script \
+  --cert-identity https://github.com/VectoDE/Linux-Server-Setup-Script/.github/workflows/release.yml@refs/heads/main
+```
+
+The same works for every other file of the release. Without `--bundle`, `gh` fetches the attestation from GitHub.
diff --git a/docs/upgrading.md b/docs/upgrading.md
new file mode 100644
index 0000000..2f83d12
--- /dev/null
+++ b/docs/upgrading.md
@@ -0,0 +1,131 @@
+# Installing and upgrading lss
+
+lss is installed from signed releases. `bootstrap.sh` puts the first version on a server, `lss update` brings later
+ones, goes back to an older one or rolls back to the version before. Both check every release the same way before any
+of its code runs.
+
+## What gets checked
+
+Each release on GitHub carries these files:
+
+| File                           | What it is                                                                          |
+| ------------------------------ | ----------------------------------------------------------------------------------- |
+| `lss-<version>.tar.gz`         | lss itself, unpacked to `/opt/lss/<version>`                                        |
+| `bootstrap.sh`                 | the installer                                                                       |
+| `vectode-lss-<version>.tar.gz` | the [Ansible collection](../ansible/README.md) of that version                      |
+| `lss-<version>.cdx.json`       | software bill of materials (CycloneDX): lss and everything it downloads by checksum |
+| `SHA256SUMS`                   | SHA-256 of the files above                                                          |
+| `lss-<version>.intoto.jsonl`   | the signed build attestation of all of them (Sigstore bundle, SLSA provenance)      |
+
+Before it installs a version, `bootstrap.sh` (and `lss update`, which runs the `bootstrap.sh` of the installed
+version):
+
+1. downloads `SHA256SUMS`, the archive and the attestation over HTTPS;
+2. compares the SHA-256 of the archive with `SHA256SUMS`;
+3. downloads the GitHub CLI at a pinned version and checks it against the SHA-256 written into `bootstrap.sh`;
+4. checks with `gh attestation verify` that the attestation covers `SHA256SUMS` and the archive, was signed by the
+   workflow `.github/workflows/release.yml` of `VectoDE/Linux-Server-Setup-Script` running on `refs/heads/main`, on a
+   GitHub-hosted runner, and is logged in the public Sigstore transparency log.
+
+If any step fails, nothing is unpacked and the active version stays as it is. The checks need no GitHub account or
+token.
+
+## First installation
+
+Download `bootstrap.sh` from the [latest release](https://github.com/VectoDE/Linux-Server-Setup-Script/releases/latest)
+and check it before you run it as root. With the GitHub CLI on any machine:
+
+```bash
+gh release download -R VectoDE/Linux-Server-Setup-Script --pattern bootstrap.sh
+gh attestation verify bootstrap.sh --repo VectoDE/Linux-Server-Setup-Script \
+  --cert-identity https://github.com/VectoDE/Linux-Server-Setup-Script/.github/workflows/release.yml@refs/heads/main
+sudo bash bootstrap.sh
+```
+
+Without the GitHub CLI, compare `sha256sum bootstrap.sh` with the line for `bootstrap.sh` in the release's
+`SHA256SUMS`, which the release page shows. `sudo bash bootstrap.sh 2.0.1` installs a given version instead of the
+latest. The server needs `curl`, `tar` and access to github.com.
+
+## Where lss lives
+
+| Path                       | Content                                                                          |
+| -------------------------- | -------------------------------------------------------------------------------- |
+| `/opt/lss/<version>`       | one directory per installed version, owned by root, writable only by root        |
+| `/opt/lss/current`         | symbolic link to the active version                                              |
+| `/opt/lss/previous`        | symbolic link to the version that was active before, for `lss update --rollback` |
+| `/usr/local/sbin/lss`      | symbolic link to `/opt/lss/current/lss`                                          |
+| `/etc/lss`, `/var/lib/lss` | settings, secrets and state; an update or rollback leaves them as they are       |
+
+The links are replaced with a single rename, so at every moment `lss` is either the old or the new version. Versions
+other than the active and the previous one are deleted after an update. Each version directory has a file list
+(`.lss-manifest`, SHA-256 of every file), and a rollback refuses a version whose files changed since it was installed.
+
+## lss update
+
+| Command                      | What it does                                                      |
+| ---------------------------- | ----------------------------------------------------------------- |
+| `sudo lss update`            | installs the latest release; never goes back to an older version  |
+| `sudo lss update 2.1.0`      | installs exactly this version, newer or older than the active one |
+| `sudo lss update --rollback` | switches back to the previous version, without a download         |
+| `sudo lss --dry-run update`  | downloads and checks the release, changes nothing                 |
+
+After the new version is active, lss starts it once (`lss version`); if it does not answer with its version, the
+links go back to the version before. Then run `sudo lss verify`. A new version can harden a module further; `sudo lss
+configure MODULE...` applies the new configuration to modules that are installed already. Read the release notes for
+settings that changed: a renamed setting is listed under "Breaking changes", and lss warns about every setting that no
+module reads.
+
+A downgrade (`lss update` with an older version) keeps the state and settings of the newer one. lss warns about
+settings the older version does not know; modules the older version does not have stay installed but are no longer
+managed by it (no verify, no removal) until you update again.
+
+## From a 2.0 development checkout
+
+Servers that ran a development version of 2.0 from a git checkout in `/opt/lss` move it away first, then install the
+release; settings and state stay:
+
+```bash
+sudo mv /opt/lss /opt/lss.checkout
+sudo bash bootstrap.sh
+sudo lss verify
+sudo rm -rf /opt/lss.checkout
+```
+
+## From 1.x
+
+The 1.x script `install-configure-script.bash` is gone with 2.0.0. It set up one web stack in a single run and kept no
+state that lss could take over, so the upgrade is a fresh setup with lss on top of the existing server. Plan for a
+maintenance window and a backup first; keep a second SSH session open while the SSH and firewall modules run.
+
+1. Back up the databases and the web roots: `mysqldump --defaults-file=/root/.my.cnf --all-databases`, and
+   `/var/www`.
+2. Install lss with `bootstrap.sh` (above).
+3. Write `/etc/lss/lss.conf` with what the 1.x options did, and install the modules:
+
+| 1.x option or feature                                | lss 2.0                                                                                                           |
+| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `--domains "a.com,www.a.com;b.com"`                  | `LSS_VHOST_SITES=a:php:a.com,www.a.com b:php:b.com` and `LSS_TLS_DOMAINS`; modules `nginx`, `php`, `tls`, `vhost` |
+| `--email`                                            | `LSS_TLS_EMAIL`                                                                                                   |
+| `--php 8.2`                                          | `LSS_PHP_VERSION=8.2`                                                                                             |
+| MariaDB with a root password in `/root/.my.cnf`      | module `mariadb`: root logs in through the Unix socket; application users with `LSS_MARIADB_USERS`                |
+| phpMyAdmin under `/phpmyadmin`                       | module `phpmyadmin` on the admin port of the web server (127.0.0.1:8090 by default)                               |
+| Node.js                                              | module `node`                                                                                                     |
+| Fail2Ban (`/etc/fail2ban/jail.d/hardening.conf`)     | module `fail2ban`                                                                                                 |
+| UFW or firewalld                                     | module `firewall`                                                                                                 |
+| `ENABLE_AUTO_UPDATES`                                | module `auto-updates`                                                                                             |
+| `ENABLE_SSH_HARDENING`                               | modules `ssh-hardening` and `admin-user`                                                                          |
+| daily MariaDB dump (`/etc/cron.d/mariadb-backup`)    | modules `db-dumps` and `restic`                                                                                   |
+| `--mode docker` (`/opt/<domain>/docker-compose.yml`) | `--mode docker` where a module supports it; lss does not take over the 1.x stacks                                 |
+
+   For a typical 1.x server: `sudo lss install --profile webhosting`, or the modules from the table.
+
+4. lss writes its own nginx configuration; the 1.x sites in `/etc/nginx/sites-available` and `/etc/nginx/conf.d` are
+   no longer included. Recreate each one as an entry of `LSS_VHOST_SITES`, pointing at the same document root.
+5. Remove what 1.x left behind once the modules run: `/etc/ssh/sshd_config.d/99-enterprise-hardening.conf`,
+   `/etc/fail2ban/jail.d/hardening.conf`, `/etc/cron.d/mariadb-backup`, `/usr/local/sbin/backup-mariadb.sh`, the
+   state in `/var/local/enterprise-server-setup` and the log `/var/log/enterprise-server-setup.log`. Keep
+   `/root/.my.cnf` until the `mariadb` module is installed, then delete it: root no longer needs a password.
+6. `sudo lss verify` checks every module; `sudo lss audit` shows the Lynis hardening index.
+
+Docker stacks that 1.x wrote to `/opt/<domain>` keep running; move them to modules (`docker`, `vhost` as a reverse
+proxy) when convenient.
diff --git a/install-configure-script.bash b/install-configure-script.bash
deleted file mode 100644
index 7673c37..0000000
--- a/install-configure-script.bash
+++ /dev/null
@@ -1,789 +0,0 @@
-#!/usr/bin/env bash
-# Automated Linux Server Setup - Enterprise Edition
-# Supports: Debian (12+), Ubuntu (20.04+), CentOS (7+), RHEL (7+)
-# Installs and configures: Nginx, PHP-FPM, MariaDB (MySQL-compatible), phpMyAdmin,
-# Node.js, Fail2Ban, firewall (UFW or firewalld), Certbot (Let's Encrypt)
-# Optional Docker stack deployment.
-
-set -euo pipefail
-IFS=$'\n\t'
-
-SCRIPT_NAME=$(basename "$0")
-LOG_FILE="/var/log/enterprise-server-setup.log"
-STATE_DIR="/var/local/enterprise-server-setup"
-# Downloads accept only HTTPS with TLS 1.2 or later, also after a redirect.
-CURL_HTTPS=(--proto =https --tlsv1.2 -fsSL)
-mkdir -p "$(dirname "$LOG_FILE")" "$STATE_DIR"
-touch "$LOG_FILE"
-chmod 600 "$LOG_FILE"
-
-exec > >(tee -a "$LOG_FILE") 2>&1
-
-log(){
-  local level=$1; shift
-  printf '[%s] [%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$level" "$*"
-  return
-}
-
-die(){
-  log "ERROR" "$*"
-  exit 1
-}
-
-trap 'handle_error $? ${LINENO}' ERR
-handle_error(){
-  local exit_code=$1
-  local line=$2
-  log "ERROR" "Script failed at line ${line} with exit code ${exit_code}. Review ${LOG_FILE}."
-  exit "$exit_code"
-}
-
-cleanup(){
-  log "INFO" "${SCRIPT_NAME} finished. Review ${LOG_FILE} for a persistent record."
-  return
-}
-trap cleanup EXIT
-
-# --------------------------- CONFIG (env vars or args) ---------------------------
-DOMAINS_RAW=${DOMAINS_RAW:-""}
-MODE=${MODE:-native}
-EMAIL=${EMAIL:-""}
-DB_ROOT_PASS=${DB_ROOT_PASS:-""}
-PHP_VERSION=${PHP_VERSION:-"8.2"}
-FORCE=${FORCE:-false}
-ENABLE_SSH_HARDENING=${ENABLE_SSH_HARDENING:-false}
-ENABLE_AUTO_UPDATES=${ENABLE_AUTO_UPDATES:-true}
-WEB_USER=""
-WEB_GROUP=""
-PRIMARY_DOMAIN=""
-declare -a DOMAIN_GROUPS=()
-
-usage(){
-  cat <<EOF
-Usage: sudo ${SCRIPT_NAME} [options]
-
-Options:
-  --domains           Domain definitions. Use comma-separated values per vhost.
-                      Multiple vhosts can be separated by semicolons, e.g.
-                      "example.com,www.example.com;api.example.com".
-  --mode              Deployment mode: native | docker (default: native).
-  --email             Administrator email used for Let's Encrypt registration.
-  --db-root-pass      MariaDB root password. Generated if omitted.
-  --php               PHP version (default: 8.2). Use format 8.2, 8.1, etc.
-  --force             Continue even if potential conflicts are detected.
-  --help              Show this help message.
-
-Environment variables mirror the CLI arguments. Additional toggles:
-  ENABLE_SSH_HARDENING=true   Apply conservative SSH configuration.
-  ENABLE_AUTO_UPDATES=false   Skip unattended upgrades setup.
-EOF
-  return
-}
-
-while [[ "$#" -gt 0 ]]; do
-  case "$1" in
-    --domains) DOMAINS_RAW="$2"; shift 2;;
-    --mode) MODE="$2"; shift 2;;
-    --email) EMAIL="$2"; shift 2;;
-    --db-root-pass) DB_ROOT_PASS="$2"; shift 2;;
-    --php) PHP_VERSION="$2"; shift 2;;
-    --force) FORCE=true; shift 1;;
-    --help) usage; exit 0;;
-    *) die "Unknown arg: $1";;
-  esac
-done
-
-if [[ -n "${DOMAIN-}" ]] && [[ -z "$DOMAINS_RAW" ]]; then
-  DOMAINS_RAW="$DOMAIN"
-fi
-if [[ -n "${DOMAINS-}" ]] && [[ -z "$DOMAINS_RAW" ]]; then
-  DOMAINS_RAW="$DOMAINS"
-fi
-if [[ -z "$DOMAINS_RAW" ]]; then
-  die "No domains provided. Supply via --domains or DOMAINS environment variable."
-fi
-
-if [[ -z "$DB_ROOT_PASS" ]]; then
-  command -v openssl >/dev/null 2>&1 || die "openssl is required to generate a database password. Install it first."
-  DB_ROOT_PASS=$(openssl rand -base64 24)
-  log "WARN" "No DB root password provided; generated a secure password automatically."
-fi
-
-# --------------------------- UTILS ---------------------------
-detect_os(){
-  . /etc/os-release || true
-  OS_ID=${ID,,}
-  OS_LIKE=${ID_LIKE,,}
-  OS_VERSION=${VERSION_ID,,}
-  log "INFO" "Detected OS: $OS_ID (like: $OS_LIKE) version: $OS_VERSION"
-  return
-}
-
-require_root(){
-  if [[ "$EUID" -ne 0 ]]; then
-    die "This script must be run as root. Retry with sudo."
-  fi
-  return
-}
-
-verify_prerequisites(){
-  local required_cmds=(curl wget tar systemctl)
-  for bin in "${required_cmds[@]}"; do
-    command -v "$bin" >/dev/null 2>&1 || die "Required command '$bin' not found. Install it and retry."
-  done
-  return
-}
-
-parse_domain_groups(){
-  local raw="$1"
-  local sanitized
-  IFS=';' read -ra sanitized <<< "$raw"
-  DOMAIN_GROUPS=()
-  for entry in "${sanitized[@]}"; do
-    local trimmed=${entry//[[:space:]]/}
-    [[ -n "$trimmed" ]] || continue
-    DOMAIN_GROUPS+=("$trimmed")
-  done
-  if [[ "${#DOMAIN_GROUPS[@]}" -eq 0 ]]; then
-    die "Unable to parse provided domains."
-  fi
-  PRIMARY_DOMAIN=$(printf '%s' "${DOMAIN_GROUPS[0]}" | awk -F',' '{print $1}')
-  log "INFO" "Primary domain resolved as: ${PRIMARY_DOMAIN}"
-  return
-}
-
-determine_web_user(){
-  case "$OS_ID" in
-    ubuntu|debian)
-      WEB_USER=${WEB_USER:-www-data}
-      WEB_GROUP=${WEB_GROUP:-www-data}
-      ;;
-    centos|rhel)
-      WEB_USER=${WEB_USER:-nginx}
-      WEB_GROUP=${WEB_GROUP:-nginx}
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  return
-}
-
-check_system_resources(){
-  local mem_required=1000
-  local mem_available
-  mem_available=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
-  if (( mem_available < mem_required )); then
-    log "WARN" "Less than ${mem_required}MB RAM detected (${mem_available}MB). Installation may fail."
-    if ! $FORCE; then
-      die "Insufficient memory. Rerun with --force if you want to continue regardless."
-    fi
-  fi
-  return
-}
-
-update_system_packages(){
-  log "INFO" "Updating base operating system packages"
-  case "$OS_ID" in
-    ubuntu|debian)
-      apt-get update
-      apt-get -y upgrade
-      apt-get -y dist-upgrade
-      apt-get -y autoremove
-      ;;
-    centos|rhel)
-      yum -y update
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  return
-}
-
-ensure_state_marker(){
-  echo "mode=${MODE}" > "${STATE_DIR}/last-run"
-  return
-}
-
-# --------------------------- INSTALL COMMON TOOLS ---------------------------
-install_common(){
-  log "INFO" "Installing base packages"
-  case "$OS_ID" in
-    ubuntu|debian)
-      export DEBIAN_FRONTEND=noninteractive
-      apt-get update
-      apt-get install -y ca-certificates curl wget gnupg lsb-release software-properties-common unzip git openssh-server rsync cron
-      ;;
-    centos|rhel)
-      yum install -y epel-release yum-utils curl wget unzip git openssh-server rsync cronie
-      systemctl enable --now sshd || true
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  return
-}
-
-# --------------------------- PACKAGE INSTALLERS ---------------------------
-install_node(){
-  local node_version=20
-  log "INFO" "Installing Node.js ${node_version}.x"
-  case "$OS_ID" in
-    ubuntu|debian)
-      curl "${CURL_HTTPS[@]}" https://deb.nodesource.com/setup_${node_version}.x | bash -
-      apt-get install -y nodejs build-essential
-      ;;
-    centos|rhel)
-      curl "${CURL_HTTPS[@]}" https://rpm.nodesource.com/setup_${node_version}.x | bash -
-      yum install -y nodejs gcc-c++ make
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  return
-}
-
-install_php(){
-  log "INFO" "Installing PHP ${PHP_VERSION}"
-  case "$OS_ID" in
-    ubuntu|debian)
-      export DEBIAN_FRONTEND=noninteractive
-      apt-get install -y lsb-release ca-certificates apt-transport-https gnupg
-      if [[ ! -f /etc/apt/sources.list.d/php.list ]]; then
-        curl "${CURL_HTTPS[@]}" https://packages.sury.org/php/apt.gpg | gpg --dearmor -o /etc/apt/trusted.gpg.d/sury-php.gpg
-        echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" > /etc/apt/sources.list.d/php.list
-      fi
-      apt-get update
-      apt-get install -y php${PHP_VERSION} php${PHP_VERSION}-fpm php${PHP_VERSION}-mysql php${PHP_VERSION}-cli \
-        php${PHP_VERSION}-curl php${PHP_VERSION}-gd php${PHP_VERSION}-mbstring php${PHP_VERSION}-xml php${PHP_VERSION}-zip php${PHP_VERSION}-bcmath
-      ;;
-    centos|rhel)
-      yum install -y https://rpms.remirepo.net/enterprise/remi-release-${OS_VERSION%%.*}.rpm || true
-      yum install -y yum-utils
-      local remi_stream=${PHP_VERSION//./}
-      yum-config-manager --enable remi-php${remi_stream} || true
-      yum install -y php php-fpm php-mysqlnd php-cli php-curl php-gd php-mbstring php-xml php-zip php-bcmath
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  return
-}
-
-install_database(){
-  log "INFO" "Installing MariaDB server"
-  case "$OS_ID" in
-    ubuntu|debian)
-      export DEBIAN_FRONTEND=noninteractive
-      apt-get install -y mariadb-server mariadb-client
-      systemctl enable --now mariadb
-      ;;
-    centos|rhel)
-      yum install -y mariadb-server mariadb
-      systemctl enable --now mariadb
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  mysql --user=root <<MYSQL_SECURE
-ALTER USER 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASS}';
-DELETE FROM mysql.user WHERE User='';
-DROP DATABASE IF EXISTS test;
-DELETE FROM mysql.db WHERE Db='test' OR Db='test\_%';
-FLUSH PRIVILEGES;
-MYSQL_SECURE
-  log "INFO" "MariaDB configured with provided root password"
-  return
-}
-
-install_nginx(){
-  log "INFO" "Installing Nginx"
-  case "$OS_ID" in
-    ubuntu|debian)
-      apt-get install -y nginx
-      ;;
-    centos|rhel)
-      yum install -y nginx
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  systemctl enable --now nginx
-  return
-}
-
-install_phpmyadmin_native(){
-  log "INFO" "Installing phpMyAdmin"
-  case "$OS_ID" in
-    ubuntu|debian)
-      export DEBIAN_FRONTEND=noninteractive
-      echo "phpmyadmin phpmyadmin/reconfigure-webserver multiselect none" | debconf-set-selections
-      echo "phpmyadmin phpmyadmin/dbconfig-install boolean false" | debconf-set-selections
-      apt-get install -y phpmyadmin
-      ;;
-    centos|rhel)
-      local php_myadmin_dir=/usr/share/phpmyadmin
-      mkdir -p "$php_myadmin_dir"
-      curl "${CURL_HTTPS[@]}" https://files.phpmyadmin.net/phpMyAdmin/latest/phpMyAdmin-latest-all-languages.tar.gz | \
-        tar xz --strip-components=1 -C "$php_myadmin_dir"
-      mkdir -p /var/lib/phpmyadmin/tmp
-      chown -R root:root "$php_myadmin_dir"
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  return
-}
-
-install_fail2ban(){
-  log "INFO" "Installing Fail2Ban"
-  case "$OS_ID" in
-    ubuntu|debian)
-      apt-get install -y fail2ban
-      ;;
-    centos|rhel)
-      yum install -y fail2ban
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  mkdir -p /etc/fail2ban/jail.d
-  cat >/etc/fail2ban/jail.d/hardening.conf <<'JAIL'
-[sshd]
-enabled = true
-port    = ssh
-maxretry = 5
-findtime = 600
-bantime = 3600
-
-[nginx-http-auth]
-enabled = true
-JAIL
-  systemctl enable --now fail2ban
-  return
-}
-
-install_certbot(){
-  log "INFO" "Installing Certbot"
-  case "$OS_ID" in
-    ubuntu|debian)
-      apt-get install -y certbot python3-certbot-nginx
-      ;;
-    centos|rhel)
-      yum install -y certbot python3-certbot-nginx
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  return
-}
-
-configure_firewall(){
-  log "INFO" "Configuring firewall"
-  case "$OS_ID" in
-    ubuntu|debian)
-      apt-get install -y ufw
-      ufw default deny incoming
-      ufw default allow outgoing
-      ufw allow OpenSSH
-      ufw allow 'Nginx Full'
-      ufw allow 8080/tcp
-      ufw --force enable
-      ;;
-    centos|rhel)
-      yum install -y firewalld || true
-      systemctl enable --now firewalld
-      firewall-cmd --permanent --add-service=http
-      firewall-cmd --permanent --add-service=https
-      firewall-cmd --permanent --add-service=ssh
-      firewall-cmd --permanent --add-port=8080/tcp
-      firewall-cmd --reload
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  return
-}
-
-
-# --------------------------- SECURITY & MAINTENANCE ---------------------------
-configure_mysql_root_client(){
-  cat >/root/.my.cnf <<MYSQLCNF
-[client]
-user=root
-password=${DB_ROOT_PASS}
-MYSQLCNF
-  chmod 600 /root/.my.cnf
-  return
-}
-
-enable_automatic_updates(){
-  if ! $ENABLE_AUTO_UPDATES; then
-    log "INFO" "Skipping automatic OS update configuration (ENABLE_AUTO_UPDATES=false)"
-    return
-  fi
-  case "$OS_ID" in
-    ubuntu|debian)
-      apt-get install -y unattended-upgrades apt-listchanges
-      dpkg-reconfigure -f noninteractive unattended-upgrades
-      ;;
-    centos|rhel)
-      if command -v dnf >/dev/null 2>&1; then
-        yum install -y dnf-automatic || true
-        systemctl enable --now dnf-automatic.timer || true
-      else
-        yum install -y yum-cron || true
-        systemctl enable --now yum-cron || true
-      fi
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  log "INFO" "Automatic security updates configured"
-}
-
-apply_ssh_hardening(){
-  if ! $ENABLE_SSH_HARDENING; then
-    log "INFO" "SSH hardening disabled (ENABLE_SSH_HARDENING=false)"
-    return
-  fi
-  local config_dir=/etc/ssh/sshd_config.d
-  mkdir -p "$config_dir"
-  cat >${config_dir}/99-enterprise-hardening.conf <<'SSH'
-PasswordAuthentication no
-PermitRootLogin prohibit-password
-ClientAliveInterval 300
-ClientAliveCountMax 2
-SSH
-  systemctl reload sshd 2>/dev/null || systemctl reload ssh 2>/dev/null || true
-  log "INFO" "Applied conservative SSH hardening profile"
-}
-
-create_backup_tooling(){
-  local backup_dir=/var/backups/mariadb
-  local backup_script=/usr/local/sbin/backup-mariadb.sh
-  mkdir -p "$backup_dir"
-  cat >$backup_script <<'BACKUP'
-#!/usr/bin/env bash
-set -euo pipefail
-STAMP=$(date +%F)
-DEST=/var/backups/mariadb
-mkdir -p "$DEST"
-mysqldump --defaults-file=/root/.my.cnf --single-transaction --quick --lock-tables=false --all-databases > "$DEST/all-${STAMP}.sql"
-find "$DEST" -type f -mtime +14 -delete
-BACKUP
-  chmod 700 $backup_script
-  cat >/etc/cron.d/mariadb-backup <<CRON
-0 2 * * * root $backup_script
-CRON
-  log "INFO" "Automated MariaDB backup job installed (daily 02:00)"
-  return
-}
-
-configure_php(){
-  local php_ini
-  if [[ "$OS_ID" =~ (ubuntu|debian) ]]; then
-    php_ini=/etc/php/${PHP_VERSION}/fpm/php.ini
-  else
-    php_ini=/etc/php.ini
-  fi
-  if [[ -f "$php_ini" ]]; then
-    sed -i "s/^;*cgi.fix_pathinfo=.*/cgi.fix_pathinfo=0/" "$php_ini"
-    sed -i "s/^;*date.timezone.*/date.timezone = UTC/" "$php_ini"
-  fi
-  local php_service
-  if [[ "$OS_ID" =~ (ubuntu|debian) ]]; then
-    php_service=php${PHP_VERSION}-fpm
-  else
-    php_service=php-fpm
-  fi
-  systemctl enable --now "$php_service"
-  systemctl restart "$php_service"
-  log "INFO" "PHP-FPM configured and restarted ($php_service)"
-  return
-}
-
-verify_services(){
-  local services=(nginx mariadb fail2ban)
-  local php_service
-  if [[ "$OS_ID" =~ (ubuntu|debian) ]]; then
-    php_service=php${PHP_VERSION}-fpm
-  else
-    php_service=php-fpm
-  fi
-  services+=("$php_service")
-  for svc in "${services[@]}"; do
-    if systemctl is-active --quiet "$svc"; then
-      log "INFO" "Service '$svc' is active"
-    else
-      log "WARN" "Service '$svc' is not running. Check logs."
-    fi
-  done
-  return
-}
-
-summary(){
-  local mode=${MODE}
-  local stack_id=$(echo "${PRIMARY_DOMAIN}" | tr '.' '_')
-  log "INFO" "Setup complete (mode: ${mode}). MariaDB root password stored securely in /root/.my.cnf"
-  log "INFO" "Primary domain: ${PRIMARY_DOMAIN}"
-  if [[ "$mode" = "docker" ]]; then
-    cat <<EOF
-NEXT STEPS:
- - Change directory to /opt/${stack_id}
- - Start the stack: docker compose up -d
- - Access phpMyAdmin via http://<server_ip>:8080
-EOF
-  else
-    cat <<EOF
-NEXT STEPS:
- - Place your website files into the web root(s): /var/www/<domain_group>/html
- - Check nginx config: nginx -t
- - Check php-fpm: systemctl status php${PHP_VERSION}-fpm
- - Manage MariaDB: mysql --defaults-file=/root/.my.cnf
- - Access phpMyAdmin at https://<your-domain>/phpmyadmin
-EOF
-  fi
-  return
-}
-# --------------------------- NGINX VHOST GENERATOR ---------------------------
-generate_nginx_vhost(){
-  local server_names="$1"
-  local site_name
-  local root_dir
-  local fastcgi_block
-  local has_sites_enabled=0
-
-  site_name=$(echo "$server_names" | tr ' ' '_' | tr ',' '_')
-  root_dir="/var/www/${site_name}/html"
-  mkdir -p "$root_dir"
-  chown -R "$WEB_USER":"$WEB_GROUP" "$root_dir" || true
-
-  if [[ "$OS_ID" =~ (ubuntu|debian) ]]; then
-    fastcgi_block=$'        include snippets/fastcgi-php.conf;\n        fastcgi_pass unix:/var/run/php/php'"${PHP_VERSION}"$'-fpm.sock;'
-  else
-    fastcgi_block=$'        include fastcgi_params;\n        fastcgi_pass unix:/run/php-fpm/www.sock;\n        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;'
-  fi
-
-  if [[ -d /etc/nginx/sites-enabled ]]; then
-    has_sites_enabled=1
-  fi
-  mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled
-  cat > /etc/nginx/sites-available/${site_name}.conf <<NGINXCONF
-server {
-    listen 80;
-    listen [::]:80;
-    server_name ${server_names};
-
-    root ${root_dir};
-    index index.php index.html index.htm;
-
-    access_log /var/log/nginx/${site_name}.access.log;
-    error_log /var/log/nginx/${site_name}.error.log;
-
-    location / {
-        try_files \${uri} \${uri}/ =404;
-    }
-
-    location ~ \.php$ {
-${fastcgi_block}
-    }
-
-    location ~ /\.ht {
-        deny all;
-    }
-}
-NGINXCONF
-
-  if [[ "$has_sites_enabled" -eq 1 ]]; then
-    ln -sf /etc/nginx/sites-available/${site_name}.conf /etc/nginx/sites-enabled/${site_name}.conf
-  else
-    mkdir -p /etc/nginx/conf.d
-    cp /etc/nginx/sites-available/${site_name}.conf /etc/nginx/conf.d/${site_name}.conf
-  fi
-
-  if nginx -t; then
-    systemctl reload nginx || true
-    log "INFO" "Generated Nginx vhost for: ${server_names} at ${root_dir}"
-  else
-    log "WARN" "nginx -t failed; review configuration for ${server_names}"
-  fi
-  return
-}
-
-# --------------------------- SSL (Let’s Encrypt) ---------------------------
-obtain_ssl(){
-  local domains_str="$1"
-  local primary
-  primary=$(echo "$domains_str" | awk -F',' '{print $1}')
-  if [[ -z "${EMAIL}" ]]; then
-    EMAIL="admin@${primary}"
-    log "WARN" "No email provided for Let's Encrypt; defaulting to ${EMAIL}"
-  fi
-  if ! command -v certbot >/dev/null 2>&1; then
-    log "WARN" "Certbot not installed; skipping SSL issuance for ${domains_str}"
-    return 0
-  fi
-  local cert_args
-  cert_args=$(echo "$domains_str" | tr ',' ' ')
-  if certbot --nginx --keep-until-expiring --redirect --non-interactive --agree-tos --email "${EMAIL}" $(printf ' -d %s' $cert_args); then
-    log "INFO" "SSL certificate issued for: ${domains_str}"
-  else
-    log "WARN" "Certbot failed for ${domains_str}. Review ${LOG_FILE}"
-  fi
-}
-# --------------------------- DOCKER MODE: write docker-compose.yml ---------------------------
-write_docker_compose(){
-  local site_tag=$(echo "${PRIMARY_DOMAIN}" | tr '.' '_')
-  local stack_dir=/opt/${site_tag}
-  local owner=${SUDO_USER:-root}
-  local domain_csv="${DOMAIN_GROUPS[0]}"
-  local domain_space=$(echo "$domain_csv" | tr ',' ' ')
-  mkdir -p "${stack_dir}/nginx/conf.d" "${stack_dir}/www"
-  cat >"${stack_dir}/docker-compose.yml" <<DOCKER
-version: "3.8"
-services:
-  db:
-    image: mariadb:11
-    restart: unless-stopped
-    environment:
-      MARIADB_ROOT_PASSWORD: "${DB_ROOT_PASS}"
-    volumes:
-      - db_data:/var/lib/mysql
-
-  phpmyadmin:
-    image: phpmyadmin:latest
-    restart: unless-stopped
-    environment:
-      PMA_HOST: db
-      MYSQL_ROOT_PASSWORD: "${DB_ROOT_PASS}"
-    ports:
-      - "8080:80"
-
-  web:
-    image: nginx:stable
-    restart: unless-stopped
-    volumes:
-      - ./www:/var/www/html:delegated
-      - ./nginx/conf.d:/etc/nginx/conf.d:ro
-    ports:
-      - "80:80"
-      - "443:443"
-    depends_on:
-      - php
-      - db
-
-  php:
-    image: php:${PHP_VERSION}-fpm
-    restart: unless-stopped
-    volumes:
-      - ./www:/var/www/html
-
-volumes:
-  db_data:
-DOCKER
-  cat >"${stack_dir}/nginx/conf.d/${site_tag}.conf" <<NGINXDC
-server {
-  listen 80;
-  server_name ${domain_space};
-  root /var/www/html;
-  index index.php index.html;
-
-  location / {
-    try_files \$uri \$uri/ =404;
-  }
-
-  location ~ \.php$ {
-    fastcgi_pass php:9000;
-    include fastcgi_params;
-    fastcgi_param SCRIPT_FILENAME /var/www/html\$fastcgi_script_name;
-  }
-}
-NGINXDC
-  cat >"${stack_dir}/www/index.php" <<'PHP'
-<?php phpinfo();
-PHP
-  chown -R "$owner":"$owner" "${stack_dir}"
-  log "INFO" "Docker compose stack written to ${stack_dir}"
-  log "INFO" "Run: cd ${stack_dir} && docker compose up -d"
-  return
-}
-# --------------------------- MAIN FLOW ---------------------------
-require_root
-parse_domain_groups "$DOMAINS_RAW"
-detect_os
-determine_web_user
-check_system_resources
-install_common
-verify_prerequisites
-update_system_packages
-enable_automatic_updates
-
-case "$MODE" in
-  native|docker)
-    ;;
-  *)
-    die "Unsupported mode: $MODE"
-    ;;
-esac
-
-if [[ "$MODE" = "docker" ]]; then
-  log "INFO" "Setting up Docker mode"
-  case "$OS_ID" in
-    ubuntu|debian)
-      apt-get remove -y docker docker-engine docker.io containerd runc || true
-      curl "${CURL_HTTPS[@]}" https://get.docker.com | sh
-      apt-get install -y docker-compose-plugin
-      systemctl enable --now docker
-      ;;
-    centos|rhel)
-      curl "${CURL_HTTPS[@]}" https://get.docker.com | sh
-      yum install -y docker-compose-plugin || true
-      systemctl enable --now docker
-      ;;
-    *)
-      die "Unsupported OS: $OS_ID"
-      ;;
-  esac
-  install_node
-  write_docker_compose
-  configure_firewall
-  apply_ssh_hardening
-  summary
-  ensure_state_marker
-  exit 0
-fi
-
-install_nginx
-install_php
-configure_php
-install_database
-configure_mysql_root_client
-create_backup_tooling
-install_phpmyadmin_native
-install_node
-install_fail2ban
-install_certbot
-configure_firewall
-apply_ssh_hardening
-
-for domain_csv in "${DOMAIN_GROUPS[@]}"; do
-  log "INFO" "Configuring domain group: ${domain_csv}"
-  generate_nginx_vhost "$domain_csv"
-  obtain_ssl "$domain_csv"
-done
-
-verify_services
-summary
-ensure_state_marker
diff --git a/lss b/lss
index 532763c..8fcfce5 100755
--- a/lss
+++ b/lss
@@ -37,6 +37,8 @@ Commands:
   remove MODULE... [--purge]     remove modules (--purge also deletes their data)
   audit                          Lynis audit with hardening index
   secrets show NAME              print a generated secret
+  update [VERSION]               install the latest (or the named) verified release of lss
+  update --rollback              switch back to the version of lss that was active before
   profiles                       list profiles
   version                        print the version
 
@@ -56,6 +58,7 @@ EOF
 LSS_DRY_RUN=0
 LSS_YES=0
 LSS_PURGE=0
+LSS_ROLLBACK=0
 LSS_PROFILE=''
 CONFIG_FILE=''
 COMMAND=''
@@ -96,6 +99,10 @@ parse_args() {
 			LSS_PURGE=1
 			shift
 			;;
+		--rollback)
+			LSS_ROLLBACK=1
+			shift
+			;;
 		-v | --verbose)
 			LSS_VERBOSE=1
 			shift
@@ -149,7 +156,8 @@ start_run() {
 	export LSS_LOG_FILE
 	local lock=/run/lss.lock
 	exec 9>"${lock}"
-	flock -n 9 || die "Another lss run is in progress."
+	# A few seconds of patience: a helper of the run before may still be exiting with the lock inherited.
+	flock -w 5 9 || die "Another lss run is in progress."
 	log_info "lss ${LSS_VERSION} on ${OS_NAME} (${OS_ARCH}), run ${LSS_RUN_ID}"
 	return
 }
@@ -330,6 +338,22 @@ cmd_secrets() {
 	return
 }
 
+# lss update [VERSION] | --rollback: bootstrap.sh of the running version downloads the release, checks its checksum
+# and build attestation, and switches /opt/lss/current to it (see docs/upgrading.md). This run holds the lock.
+cmd_update() {
+	local -a args=()
+	[[ ${#ARGS[@]} -le 1 ]] || die "Usage: lss update [VERSION] | lss update --rollback"
+	if [[ ${LSS_ROLLBACK} == 1 ]]; then
+		args+=(--rollback)
+	fi
+	if [[ ${LSS_DRY_RUN} == 1 ]]; then
+		args+=(--dry-run)
+	fi
+	args+=("${ARGS[@]}")
+	LSS_LOCK_HELD=1 bash "${LSS_ROOT}/bootstrap.sh" "${args[@]}"
+	return
+}
+
 cmd_profiles() {
 	local file
 	for file in "${LSS_ROOT}"/profiles/*.conf; do
@@ -373,8 +397,12 @@ main() {
 	remove) cmd_remove ;;
 	audit) cmd_audit ;;
 	secrets) cmd_secrets ;;
+	update) cmd_update ;;
 	*) die "Unknown command '${COMMAND}'. See 'lss --help'." ;;
 	esac
 }
 
-main "$@"
+# Sourcing lss (the unit tests do) defines its functions without running it.
+if [[ ${BASH_SOURCE[0]} == "$0" ]]; then
+	main "$@"
+fi
diff --git a/scripts/release/build.sh b/scripts/release/build.sh
new file mode 100755
index 0000000..316f0ce
--- /dev/null
+++ b/scripts/release/build.sh
@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# Builds the files of a release: scripts/release/build.sh [--version VERSION] OUT_DIR
+#
+#   lss-V.tar.gz           lss itself (the committed tree of HEAD without tests and CI files), unpacked to /opt/lss/V
+#   bootstrap.sh           the installer, which verifies a release before it installs it
+#   vectode-lss-V.tar.gz   the Ansible collection vectode.lss, installing exactly this version
+#   lss-V.cdx.json         CycloneDX SBOM: lss and everything it downloads onto a server by a fixed checksum
+#   SHA256SUMS             SHA-256 of the four files above
+#
+# The release workflow attests all five files. --version builds a test release under another version (the CI tests
+# install one version and update to the next); a real release uses VERSION, which must match ansible/galaxy.yml.
+# Archive order, owners and times come from the commit, so the same commit gives the same lss archive.
+set -Eeuo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/../.."
+
+REPOSITORY=VectoDE/Linux-Server-Setup-Script
+VERSION_RE='^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'
+
+usage() {
+	echo "usage: scripts/release/build.sh [--version VERSION] OUT_DIR" >&2
+	exit 2
+}
+
+version=$(<VERSION)
+release=1
+if [[ ${1:-} == --version ]]; then
+	[[ $# -ge 2 ]] || usage
+	version=$2
+	release=0
+	shift 2
+fi
+[[ $# -eq 1 ]] || usage
+out=$1
+[[ ${version} =~ ${VERSION_RE} ]] || {
+	echo "'${version}' is a version like 2.0.1." >&2
+	exit 2
+}
+command -v ansible-galaxy >/dev/null 2>&1 || {
+	echo "ansible-galaxy (ansible-core) builds the collection; install tests/ansible/requirements.txt first." >&2
+	exit 1
+}
+mkdir -p "${out}"
+out=$(cd "${out}" && pwd)
+stage=$(mktemp -d)
+# shellcheck disable=SC2064 # the directory is fixed now
+trap "rm -rf -- '${stage}'" EXIT
+commit_time=$(git log -1 --format=%ct HEAD)
+
+# yaml_value FILE KEY: a top-level "key: value" of a YAML file, without quotes.
+yaml_value() {
+	local file=$1 key=$2
+	sed -nE "s/^${key}: *\"?([^\"]*)\"? *$/\1/p" "${file}"
+	return
+}
+
+# set_yaml_value FILE KEY VALUE
+set_yaml_value() {
+	local file=$1 key=$2 value=$3
+	sed -i -E "s/^${key}: .*/${key}: \"${value}\"/" "${file}"
+	return
+}
+
+check_versions() {
+	local galaxy role
+	galaxy=$(yaml_value ansible/galaxy.yml version)
+	role=$(yaml_value ansible/roles/lss/defaults/main.yml lss_version)
+	if [[ ${galaxy} != "${version}" || ${role} != "${version}" ]]; then
+		echo "VERSION is ${version}, but ansible/galaxy.yml has ${galaxy} and the role default ${role}." >&2
+		exit 1
+	fi
+	return
+}
+
+build_archive() {
+	local tree="${stage}/lss-${version}"
+	git archive --format=tar --prefix="lss-${version}/" HEAD | tar -x -C "${stage}"
+	printf '%s\n' "${version}" >"${tree}/VERSION"
+	tar --sort=name --owner=0 --group=0 --numeric-owner --mtime="@${commit_time}" \
+		--pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime \
+		-C "${stage}" -cf - "lss-${version}" | gzip -n -9 >"${out}/lss-${version}.tar.gz"
+	cp bootstrap.sh "${out}/bootstrap.sh"
+	chmod 0755 "${out}/bootstrap.sh"
+	return
+}
+
+build_collection() {
+	local collection="${stage}/collection"
+	cp -R ansible "${collection}"
+	cp LICENSE "${collection}/LICENSE"
+	mkdir -p "${collection}/roles/lss/files"
+	cp bootstrap.sh "${collection}/roles/lss/files/bootstrap.sh"
+	set_yaml_value "${collection}/galaxy.yml" version "${version}"
+	set_yaml_value "${collection}/roles/lss/defaults/main.yml" lss_version "${version}"
+	ansible-galaxy collection build "${collection}" --output-path "${out}" --force >/dev/null
+	[[ -f ${out}/vectode-lss-${version}.tar.gz ]] || {
+		echo "ansible-galaxy built no vectode-lss-${version}.tar.gz." >&2
+		exit 1
+	}
+	return
+}
+
+# sbom_components: one JSON object per line for every file lss downloads by checksum (data/checksums.txt), every
+# container image it pins by digest, and the GitHub CLI bootstrap.sh uses to check attestations.
+sbom_components() {
+	local name arch sum url image gh_version
+	while read -r name arch sum url; do
+		[[ -n ${name} && ${name} != \#* ]] || continue
+		jq -cn --arg name "${name}" --arg arch "${arch}" --arg sum "${sum}" --arg url "${url}" '{
+			type: "file", "bom-ref": "download:\($name):\($arch)", name: $name,
+			hashes: [{ alg: "SHA-256", content: $sum }],
+			externalReferences: [{ type: "distribution", url: $url }],
+			properties: [{ name: "lss:architecture", value: $arch }]
+		}'
+	done <data/checksums.txt
+	while read -r image; do
+		jq -cn --arg image "${image}" '($image | split("@sha256:")) as [$name, $digest] | {
+			type: "container", "bom-ref": "image:\($image)", name: $name,
+			hashes: [{ alg: "SHA-256", content: $digest }],
+			purl: "pkg:oci/\($name | split("/") | last)@sha256%3A\($digest)?repository_url=\($name | split("/") | .[:-1] | join("/"))"
+		}'
+	done < <(grep -rhoE '[a-z0-9.-]+(/[a-z0-9._-]+)+@sha256:[0-9a-f]{64}' modules lib data profiles 2>/dev/null | sort -u)
+	gh_version=$(sed -n 's/^BS_GH_VERSION=//p' bootstrap.sh)
+	for arch in AMD64 ARM64; do
+		sum=$(sed -n "s/^BS_GH_SHA256_${arch}=//p" bootstrap.sh)
+		jq -cn --arg version "${gh_version}" --arg arch "${arch,,}" --arg sum "${sum}" '{
+			type: "application", "bom-ref": "gh:\($arch)", name: "gh", version: $version,
+			purl: "pkg:github/cli/cli@v\($version)",
+			hashes: [{ alg: "SHA-256", content: $sum }],
+			externalReferences: [{ type: "distribution",
+				url: "https://github.com/cli/cli/releases/download/v\($version)/gh_\($version)_linux_\($arch).tar.gz" }],
+			properties: [{ name: "lss:architecture", value: $arch }, { name: "lss:used-by", value: "bootstrap.sh" }]
+		}'
+	done
+	return
+}
+
+build_sbom() {
+	local serial timestamp
+	serial=$(printf 'lss-%s' "${version}" | sha256sum | cut -c 1-32)
+	serial="${serial:0:8}-${serial:8:4}-5${serial:13:3}-a${serial:17:3}-${serial:20:12}"
+	timestamp=$(date -u -d "@${commit_time}" +%Y-%m-%dT%H:%M:%SZ)
+	sbom_components | jq -s --arg version "${version}" --arg serial "${serial}" --arg timestamp "${timestamp}" \
+		--arg repo "${REPOSITORY}" '{
+		bomFormat: "CycloneDX", specVersion: "1.6", serialNumber: "urn:uuid:\($serial)", version: 1,
+		metadata: {
+			timestamp: $timestamp,
+			tools: { components: [{ type: "application", name: "scripts/release/build.sh" }] },
+			component: {
+				type: "application", "bom-ref": "lss", name: "lss", version: $version,
+				purl: "pkg:github/\($repo | ascii_downcase)@v\($version)",
+				licenses: [{ license: { id: "MIT" } }],
+				externalReferences: [{ type: "vcs", url: "https://github.com/\($repo)" }]
+			}
+		},
+		components: .,
+		dependencies: [{ ref: "lss", dependsOn: [.[]."bom-ref"] }]
+	}' >"${out}/lss-${version}.cdx.json"
+	return
+}
+
+[[ ${release} == 0 ]] || check_versions
+build_archive
+build_collection
+build_sbom
+(
+	cd "${out}"
+	sha256sum -- "lss-${version}.tar.gz" bootstrap.sh "vectode-lss-${version}.tar.gz" "lss-${version}.cdx.json" >SHA256SUMS
+)
+echo "Built lss ${version} in ${out}:"
+cat "${out}/SHA256SUMS"
diff --git a/scripts/release/prepare.sh b/scripts/release/prepare.sh
new file mode 100755
index 0000000..a4c7571
--- /dev/null
+++ b/scripts/release/prepare.sh
@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# Prepares the next release from the commits on main since the last version tag: picks the version, writes it to
+# VERSION, ansible/galaxy.yml and the default of the role vectode.lss.lss, turns "## Unreleased" in CHANGELOG.md
+# into the section of the release and writes its notes.
+#
+# RELEASE_BUMP=auto|patch|minor|major (default auto). In auto mode a pull request labelled breaking-change (or a
+# commit marked "type!:" or "BREAKING CHANGE") makes a major release, the label enhancement (or a "feat:" commit) a
+# minor one, anything else a patch. While VERSION carries a pre-release suffix (2.0.0-dev), the release is that
+# version without the suffix: the suffix says which release is being prepared. Commits whose message contains
+# "[skip release]" are left out. Results go to $GITHUB_OUTPUT (release, version, tag), the notes to $RELEASE_NOTES
+# (default release-notes.md). RELEASE_PRERELEASE=rc.1 makes the pre-release 2.1.0-rc.1 of the version picked, for
+# a test of the release workflow or a release candidate; it leaves CHANGELOG.md as it is.
+set -Eeuo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/../.."
+
+REPOSITORY=VectoDE/Linux-Server-Setup-Script
+VERSION_RE='^([0-9]+)\.([0-9]+)\.([0-9]+)(-[0-9A-Za-z.-]+)?$'
+
+output() {
+	local line
+	for line in "$@"; do
+		printf '%s\n' "${line}"
+		if [[ -n ${GITHUB_OUTPUT:-} ]]; then
+			printf '%s\n' "${line}" >>"${GITHUB_OUTPUT}"
+		fi
+	done
+	return
+}
+
+# labels SHA: labels of the pull request a commit came from; none without the GitHub CLI or for direct pushes.
+labels() {
+	local sha=$1
+	gh api "repos/${REPOSITORY}/commits/${sha}/pulls" --jq '.[].labels[].name' 2>/dev/null || true
+	return
+}
+
+# bump_of SUBJECT BODY LABELS
+bump_of() {
+	local subject=$1 body=$2 labels=$3
+	if [[ $'\n'${labels}$'\n' == *$'\n'breaking-change$'\n'* || ${body} =~ BREAKING[\ -]CHANGE ||
+		${subject} =~ ^[a-z]+(\(.*\))?!: ]]; then
+		printf 'major'
+	elif [[ $'\n'${labels}$'\n' == *$'\n'enhancement$'\n'* || ${subject} =~ ^feat(\(.*\))?: ]]; then
+		printf 'minor'
+	else
+		printf 'patch'
+	fi
+	return
+}
+
+rank() {
+	case $1 in
+	major) printf '2' ;;
+	minor) printf '1' ;;
+	*) printf '0' ;;
+	esac
+	return
+}
+
+# next_version CURRENT BUMP
+next_version() {
+	local current=$1 bump=$2
+	[[ ${current} =~ ${VERSION_RE} ]] || {
+		echo "VERSION '${current}' is a version like 2.0.1." >&2
+		exit 1
+	}
+	local major=${BASH_REMATCH[1]} minor=${BASH_REMATCH[2]} patch=${BASH_REMATCH[3]} pre=${BASH_REMATCH[4]}
+	if [[ -n ${pre} ]]; then
+		printf '%s.%s.%s' "${major}" "${minor}" "${patch}"
+	elif [[ ${bump} == major ]]; then
+		printf '%s.0.0' "$((major + 1))"
+	elif [[ ${bump} == minor ]]; then
+		printf '%s.%s.0' "${major}" "$((minor + 1))"
+	else
+		printf '%s.%s.%s' "${major}" "${minor}" "$((patch + 1))"
+	fi
+	return
+}
+
+# write_notes NOTES_FILE: the notes of the release are the Unreleased section of CHANGELOG.md; without written notes,
+# the commit subjects are listed.
+write_notes() {
+	local notes=$1
+	awk '/^## Unreleased$/ { found = 1; next } found && /^## \[/ { exit } found' CHANGELOG.md |
+		sed -e '/./,$!d' | sed -e ':a' -e '/^\n*$/{$d;N;ba' -e '}' >"${notes}.written"
+	if grep -q '[^[:space:]]' "${notes}.written"; then
+		mv -f "${notes}.written" "${notes}"
+	else
+		rm -f "${notes}.written"
+		printf '### Changed\n\n- %s\n' "${SUBJECTS//$'\n'/$'\n'- }" >"${notes}"
+	fi
+	return
+}
+
+# update_changelog VERSION LAST_TAG NOTES_FILE: the Unreleased section becomes the section of the release.
+update_changelog() {
+	local version=$1 last_tag=$2 notes=$3 date link
+	date=$(date -u +%Y-%m-%d)
+	if [[ -n ${last_tag} ]]; then
+		link="[${version}]: https://github.com/${REPOSITORY}/compare/${last_tag}...v${version}"
+	else
+		link="[${version}]: https://github.com/${REPOSITORY}/releases/tag/v${version}"
+	fi
+	awk -v version="${version}" -v date="${date}" -v link="${link}" -v notes="${notes}" '
+		/^## Unreleased$/ && !done {
+			print; print ""; print "## [" version "] - " date; print ""
+			while ((getline line < notes) > 0) print line
+			print ""; skipping = 1; done = 1; next
+		}
+		skipping && /^## \[/ { skipping = 0 }
+		skipping { next }
+		/^\[[^]]+\]: / && !linked { print link; linked = 1 }
+		{ print }
+		END { if (!linked) print link }
+	' CHANGELOG.md >CHANGELOG.md.next
+	mv -f CHANGELOG.md.next CHANGELOG.md
+	return
+}
+
+main() {
+	local requested=${RELEASE_BUMP:-auto} notes=${RELEASE_NOTES:-release-notes.md} pre=${RELEASE_PRERELEASE:-}
+	local last_tag range current version
+	local bump=patch sha subject body entry commit_bump count=0
+	SUBJECTS=''
+	[[ ${requested} =~ ^(auto|patch|minor|major)$ ]] || {
+		echo "RELEASE_BUMP must be auto, patch, minor or major, not '${requested}'." >&2
+		exit 2
+	}
+	[[ -z ${pre} || ${pre} =~ ^[0-9A-Za-z]+(\.[0-9A-Za-z]+)*$ ]] || {
+		echo "RELEASE_PRERELEASE '${pre}' is a pre-release name like rc.1." >&2
+		exit 2
+	}
+	current=$(<VERSION)
+	# A pre-release VERSION names the release already; the labels cannot change it.
+	[[ ${current} != *-* || ${requested} != auto ]] || requested='patch'
+	last_tag=$(git describe --tags --abbrev=0 --match 'v[0-9]*' --match '[0-9]*' 2>/dev/null || true)
+	range=HEAD
+	[[ -z ${last_tag} ]] || range="${last_tag}..HEAD"
+	while IFS=$'\x1f' read -r -d $'\x1e' sha subject body; do
+		sha=${sha//[[:space:]]/}
+		[[ -n ${sha} ]] || continue
+		entry="${subject}"$'\n'"${body}"
+		[[ ${entry} != *'[skip release]'* ]] || continue
+		count=$((count + 1))
+		SUBJECTS+="${subject}"$'\n'
+		if [[ ${requested} == auto ]]; then
+			commit_bump=$(bump_of "${subject}" "${body}" "$(labels "${sha}")")
+			if (($(rank "${commit_bump}") > $(rank "${bump}"))); then
+				bump=${commit_bump}
+			fi
+		fi
+	done < <(git log --no-merges --format='%H%x1f%s%x1f%b%x1e' "${range}")
+	SUBJECTS=${SUBJECTS%$'\n'}
+	if [[ ${count} -eq 0 ]]; then
+		echo "Since ${last_tag} there is nothing to release."
+		output release=false
+		return 0
+	fi
+	[[ ${requested} == auto ]] || bump=${requested}
+	version=$(next_version "${current}" "${bump}")
+	[[ -z ${pre} ]] || version+="-${pre}"
+	printf '%s\n' "${version}" >VERSION
+	sed -i -E "s/^version: .*/version: \"${version}\"/" ansible/galaxy.yml
+	sed -i -E "s/^lss_version: .*/lss_version: \"${version}\"/" ansible/roles/lss/defaults/main.yml
+	write_notes "${notes}"
+	# A pre-release (a test of the release, or a candidate) leaves the changelog to the release it precedes.
+	[[ -n ${pre} ]] || update_changelog "${version}" "${last_tag}" "${notes}"
+	echo "${current} -> ${version} (${bump}, ${count} commits since ${last_tag:-the start})"
+	output release=true "version=${version}" "tag=v${version}"
+	return
+}
+
+main "$@"
diff --git a/scripts/release/tag-ruleset.json b/scripts/release/tag-ruleset.json
new file mode 100644
index 0000000..1915924
--- /dev/null
+++ b/scripts/release/tag-ruleset.json
@@ -0,0 +1,20 @@
+{
+  "name": "Protect tags",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~ALL"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "creation" },
+    { "type": "update" },
+    { "type": "deletion" },
+    { "type": "non_fast_forward" }
+  ],
+  "bypass_actors": [
+    { "actor_id": null, "actor_type": "DeployKey", "bypass_mode": "always" }
+  ]
+}
diff --git a/tests/ansible/requirements.in b/tests/ansible/requirements.in
new file mode 100644
index 0000000..e4511b8
--- /dev/null
+++ b/tests/ansible/requirements.in
@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# Python tools of the Ansible collection checks: building (ansible-galaxy), running and linting it. requirements.txt
+# pins them with hashes: uv pip compile --universal --python-version 3.12 --generate-hashes requirements.in -o requirements.txt
+ansible-core
+ansible-lint
diff --git a/tests/ansible/requirements.txt b/tests/ansible/requirements.txt
new file mode 100644
index 0000000..830bf4f
--- /dev/null
+++ b/tests/ansible/requirements.txt
@@ -0,0 +1,717 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile --universal --python-version 3.12 --generate-hashes --exclude-newer 2026-10-07 requirements.in -o requirements.txt
+ansible-compat==26.9.0 \
+    --hash=sha256:6756ba0adee1a07d609ede35483fc563b9838df25ec70e57378ae8b564f185cf \
+    --hash=sha256:e101649196e4fffc810c3f9f4f185107cc1e5be0ef26d38ad9c4abfa22b0b183
+    # via ansible-lint
+ansible-core==2.21.5 \
+    --hash=sha256:08886f9f3e23d129aa98a01271c4a47833516e1cb7c737a246788cb474f41222 \
+    --hash=sha256:65bb3148c58ebb843cd5074004c805f404f152114d98476dd823324616c9c6cb
+    # via
+    #   -r requirements.in
+    #   ansible-compat
+    #   ansible-lint
+ansible-lint==26.9.0 \
+    --hash=sha256:4d01903fca9c42f7ce2b366ea5503d0701a27b3c6fdf684276a72888eea57f50 \
+    --hash=sha256:cb3265888f30815de0dcf0964d34768b45c98bb4361eea7eb42c0342e81b51b4
+    # via -r requirements.in
+attrs==26.1.0 \
+    --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 \
+    --hash=sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32
+    # via
+    #   jsonschema
+    #   referencing
+black==26.10.0 \
+    --hash=sha256:0218c848ba69aa94052372cb5b50c6ac07dec2f2010a02e36b9cfb0921b2fad0 \
+    --hash=sha256:02ebe88a2262cd06c40f66931fc482dffaad0840c1f01ef4e936eacf06fe9685 \
+    --hash=sha256:0a74b4fd8f67ce75628686506c0faefdbbb4b8c9931721490bdef9298009c625 \
+    --hash=sha256:0ddc6d68d97c3289836f1e93c82ee3e1892f87ad685a54105820add0aad33751 \
+    --hash=sha256:25609587ce07ead25ee19a2eb3f3a32c9f82d8605ff234cb6e2a6152fdf753f3 \
+    --hash=sha256:3584c121fc57d08e0f73510df1d206f2c0c8858d3c82fc0664af7647ee8d1b3f \
+    --hash=sha256:39d4c2cd2c1205a81ec83aa672bd3b3b0b67f2bbc13b03033b8f95f7a3728aa6 \
+    --hash=sha256:3ae1b87103e33f1cd7a47a55ad693bf3101d043c75ce8c32209127ea87291de4 \
+    --hash=sha256:45889344b08ceb9c23733ec48873872d19e2ed3d1d64b3aee6c07745bf44d4a9 \
+    --hash=sha256:48b0d461ffcbbbbbb79d6a8ccb6ac16cb065621097d24cec43057ee2d25e5c58 \
+    --hash=sha256:5bb0b882e59f69afb102f161ca12d46c3b46804029d1894056010a2cdf8a5cb2 \
+    --hash=sha256:5d75e2a73baed5fbb7914c09bdfee330f599163591494c7f93d85b8deeaf72de \
+    --hash=sha256:5e71cf23717ca67ba4ff2d0250f3603aa38dcdb3e9c66ed39983b71a2c2ea4ac \
+    --hash=sha256:69e5bf5e22660dba002e102e43a2dce1924b098781c9665bffa1ffd2d490ebc5 \
+    --hash=sha256:6b1e1eb80bf189408e96bdeaa3befdb2bdf04932adba164d1381f6a8efe12fa9 \
+    --hash=sha256:7ced1df50785931b06d5ee7264cdcd246fab0cacd83c8dc7f1b2774d85d23e05 \
+    --hash=sha256:87fd0c6c769c650439e7107742f0d6493bfb117fab95d97ef1eb2381d1713258 \
+    --hash=sha256:9873e36e27e6786935900f153b1b7c04868c8abf616d1316e6fa9a5f9f64ffc4 \
+    --hash=sha256:9aaf3104612ad99241ff26dd9e136979cd93450a41b471a411ebb6e926db03e3 \
+    --hash=sha256:b3476ce71b494fc6e39d77e75488e8339a87583029bbf608416e955c83582bd6 \
+    --hash=sha256:b532e40012f21a8a0e8c5996ea8f5f8413dc89793361aa9e2f451826d0ebd711 \
+    --hash=sha256:b6a3d22ee0edb81ef80267224a3befd285f812111903e8963146ed32f334c923 \
+    --hash=sha256:c3e770b27a848b23ca90783dcce243a72035566322fdee7b7080aed2f1066692 \
+    --hash=sha256:c5e1e899bcc049203b1c3514dfbae8410f9ed7b650f2d4c9907064e94401cdc2 \
+    --hash=sha256:db0894554f5a95b33874ad7bc6040360f2b126b8d6c9b47d8ddfbd5c6a030618 \
+    --hash=sha256:fdc0d5b766c20c88d9583f9231d6f41ab05ad9b94266b33a1401ec046d77aeae \
+    --hash=sha256:fe0aa3c70ed74ae3cbd994b49c2f8a68df00ee8c2a2dc67b9bb796b4caf23387
+    # via ansible-lint
+bracex==3.0.1 \
+    --hash=sha256:4e38e32392e4a4780fe15d644bfc7c8514057cfc3861e060b11814ce829c25e4 \
+    --hash=sha256:6523ad83aeb5098a4ee597cff0f964442ff74e460bd3fafaffab6a013ff2288c
+    # via wcmatch
+cffi==2.1.1 \
+    --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \
+    --hash=sha256:06c72bb76605a4b0cd0aad6930b69d4baf7dd5d806cfc409b824191099700e66 \
+    --hash=sha256:0beceaabe56af686895136a2de78db54ecd8e4046b236b8fd6d6cb61389e9bf2 \
+    --hash=sha256:154852545011f779917b11c78db2358d095da62a9a172b78ad0a583ee5adc0d0 \
+    --hash=sha256:194cffa889098ced9976c3fc6340305e43f6303657d298da55366907c05c22d6 \
+    --hash=sha256:19ee6127ee34de7d83ce3d371ebc5ed91addbdcc39f9ab15ce4eb35a4e534971 \
+    --hash=sha256:1a18a57b58cfb21fc28d72e876acf10eaed67a1ed96226f92af4df681d571c4c \
+    --hash=sha256:1aa5645c30469b09530c4ebca77ebf8f17618293c58f8549cb1a543a50236e7d \
+    --hash=sha256:1dea0e4d7d4f11f619fe8c1d76caf49e24405b4b5743c0e3be16a500ecd930c9 \
+    --hash=sha256:208f941bb9d18e768138677f0a6d2ce01f590df56043dda1df1535ac57c88517 \
+    --hash=sha256:210019b6c7cf07f081b4c54635c8cf744377001350e29cc0f81c4377b4797735 \
+    --hash=sha256:246fa40ce8645a614ff682e0b70f37134e460eaf93a775e0cbe3cca585a67a80 \
+    --hash=sha256:25792eac27877609e7bb06d42ff88278a6624fff2ba9bbb523c09616b117e80f \
+    --hash=sha256:27350daa11d4f10c540e6e89dada4c54feb7256ad03e9a4dc075ebad7ba360d1 \
+    --hash=sha256:28907ab9bfb6aa13184cfc17c6b8e1023c5ab6fd7076d8c20a35e59fe04f8f29 \
+    --hash=sha256:2ae64be792b8966f2c69538199728b290e34726562896df1e5dc8ffd8d8188e8 \
+    --hash=sha256:31348097ff5bbe827ccc41795d4dd099d9f0625e7def00ee653c137a490c2a6c \
+    --hash=sha256:3143d81e29e1e20a9ce10901ec369012947876596f75a222235965f2b7ae832e \
+    --hash=sha256:3222ba5d678f80a030e6afbcc33dc1ae5cb45facabb61cee2c7016b8432fde48 \
+    --hash=sha256:3311ed60d36f83378794e1009ac6258bafbf81f7888b4caa7b35a521e3f95813 \
+    --hash=sha256:334644fbac4eff73d985a17a91226df55d0f394160c4cfb880e084c8f7161cac \
+    --hash=sha256:34e261f78cb6ceaaa36f42f2613f4380d94d9c759a9c73c769ee6e0247364632 \
+    --hash=sha256:363e05fa78e15116c3c32c210ee36884fd6b9afa6d440e47112c3bd511d64cb6 \
+    --hash=sha256:398aff33cee2767e3e781d2554c54bd0dff386bb437581e0d8011fde1a942ec1 \
+    --hash=sha256:3d22a20b1fb1632cc72c22f95f7b0d2961c3e1c235f245ba4c606c4771035659 \
+    --hash=sha256:42a494cee34437f05546455144f2b5d9ac09b1face62bcfce597d2e521066688 \
+    --hash=sha256:42e2f76b9455f5a9a844f770bf3e200ed3da0e15f5df3db9c31fe80b04b3d004 \
+    --hash=sha256:42f6930c31dc7f50732c9ae793c2786c7b6b044195967bbdde40bb9be81c4cc0 \
+    --hash=sha256:456a61fa52d579ebf9df2e9552ead5129855dbaff6c1e5a9b1bc408809bdc062 \
+    --hash=sha256:471cee653ae88de62096552e6d24ccb4a5adb8c8c9f10b5054d0122c15bf2779 \
+    --hash=sha256:49cbc70e6542d4ccccb936558d1064a8012541e78f821f955cff24e357776c94 \
+    --hash=sha256:4a7c934f7360e8cd64fe9efadcbd10c7c6364f531e432b9a4bf5ccbc9e0e8b50 \
+    --hash=sha256:4be96343e422f2dfcd12ab5c9f5aebe03f82f737c6bffeca6830b3875cb44aab \
+    --hash=sha256:4f42141fc14250de6dde5ee7ea4432be017252d91f19c5ad043c084cea629cac \
+    --hash=sha256:507a24c282e0f42f8ed737cf048572cbf580468da5555764a8331735e9c736b6 \
+    --hash=sha256:51b31d1c98274844cfd7838ce00bfc27c7423a4dc00fc0772fc3331c2cc90676 \
+    --hash=sha256:58acb8ab8e295e6c5ea12f888cbb13cf21511ef2a3303a23f4325c29d17fe5c1 \
+    --hash=sha256:5a59cc1c4442bc3d5c703bf720b51138d0bfc173618807c9ee2490a7541dd3d9 \
+    --hash=sha256:5bb4e7ea95dcd6a014a6fef62e62467d67d8e582326443f3d68e71d6320a9fcf \
+    --hash=sha256:5c58fe613dc5e5336357eff555824a314d8e43282600435c8d1cb6a7a2fedd13 \
+    --hash=sha256:5e7cecbaadb83884793e05828cee59b210b24583b9c7425d0ba6a754fe22eb4e \
+    --hash=sha256:616f097f2fe415bc92a247f02e11f634e1f9e9a83d327e3c915c15089c87869e \
+    --hash=sha256:63bbfd5ded17c4840ac07cd8f1c21ba9d9708141f840b324f422f41b207e3973 \
+    --hash=sha256:64faea20f4e2613363a1a9b9c7dd73058f3ecd00133a511e72ad7c511658f527 \
+    --hash=sha256:661c298b4821edebead0c91edd2b00374d67ad7c5a1f7a91d4442633b79d6a72 \
+    --hash=sha256:68e62fe11f30d5ca8289242866f0a5291402d8529ca2178ab8afc5c9694ae890 \
+    --hash=sha256:6a8dddef476fab96d066d578fc88526767b836ab5ab21754e1d5bf3879c31c7c \
+    --hash=sha256:6e192623c49c94421616a5778fba35cf0d5a8d000650c1967ef4448ee5cdd990 \
+    --hash=sha256:7225e4514edb64eb6740324353e0da0711954fd8d7da4576755b1c6e09b697cd \
+    --hash=sha256:75f80557d1389eddbd0de2681f6a390a0c5338c31ddaa821381c203fc3fd50d9 \
+    --hash=sha256:770de9db11e84213beec501cfcaa013b019820ca881e03344dea5844f7876d94 \
+    --hash=sha256:7750c6449dff7864bb9bb27ddfb0267756189201a3afc911d82b3caacd70dfc3 \
+    --hash=sha256:7bde5e4cc5c10140859842b9d383af292b22639a4dffb725314baf45968cef80 \
+    --hash=sha256:7ce713ace7c0e4520535b42b77eaa742c16dab813978064913e5a3cf82973b41 \
+    --hash=sha256:7da0c5eff80f0197f3b3d1232ec5a682a9325f4ae9016a78f5f5ca35f9ced1f5 \
+    --hash=sha256:7dbb61fe3a7699468030f71bbe5f8a0e326a151daa91beb11a6fc1f980c55e1c \
+    --hash=sha256:811bd1e21d32de12efca32393a0ab3f5133b54fce9bd44b8bd77ab07da14bf6a \
+    --hash=sha256:8ef53b2de9bcb9197d31854256575d59dbac0cba72ac627bb291ef5eceb74be4 \
+    --hash=sha256:937c0052c05a31ca1daf18de3158eed4dbfcb9cc107adbea227728d647be701e \
+    --hash=sha256:9d2055050ea716bd38b7f7f1579c275386646b4894c155a3e2f3cd62ed41b7c6 \
+    --hash=sha256:9f8d177621de5cb38ee3e731eda45d421db093ec0739f46a5594babda7987a98 \
+    --hash=sha256:a2d7755bef5a12ed488f4ef1f1b69ee9191d7396083b755a5d2295f6edb4768b \
+    --hash=sha256:a48d62ab9d6f4f98c983223a547af44be6ca3691074c31cecced6facd3ba2dc1 \
+    --hash=sha256:a4f00aa42f75d6e4595e8866e748cc1705adc0cddfeb2ca86d0d03993d63ba03 \
+    --hash=sha256:a6e721d4b0e45d5b65e87534470e67b18dcd092c83f68fba09f152b9cbc061af \
+    --hash=sha256:a730a083190634c65cca36ba5f489531576ebd79bcd5c8e172130f6453127231 \
+    --hash=sha256:a931079504ecc49efed7744c476a5c343a92fabf66dec2db95edb1b2fdc770e2 \
+    --hash=sha256:aa9511c62d14da7aacc9b4bf51f3f697a621e83b2d6919008243c3aad168eea3 \
+    --hash=sha256:ab36d55f9ed2d067327667c2fea18dda018eb628dd6347aa01dda6cf1f5d3836 \
+    --hash=sha256:ad2c86c495b899d862ea0f4b42891b8713a3bd45dd4105c7fd51c2a72f39f3a5 \
+    --hash=sha256:aeae0e330c9f6acd681f647d46cefd30c29f93e3392882e792e82080c9691399 \
+    --hash=sha256:b0431303acaea1089ad4b3e9ce4e6518193def1118d4073ca848635ee4ea2e96 \
+    --hash=sha256:b5bdfd1c873d4e093aabc0ca84c4ca6dbc4f752afb5c86f146d9742580c9da2e \
+    --hash=sha256:baed1e86cc735622097354b9d1281406caf42ff42a886d29faa8e8d1630333be \
+    --hash=sha256:c1453022f490d2459a11819d83ad1d586e9ff65a12ac3e705ffebd46d3685dcf \
+    --hash=sha256:c26608d2222fb1e94487e4a387d85f13eb55d5ed725cb25a0c589ac4ee60e7bc \
+    --hash=sha256:c7659f22557c5a0bc4855cd635f55edec690cc008a40768527762cb9fb263455 \
+    --hash=sha256:c8c69575568085ba0b1b10c0249d779a214aea6f6522e949a0fc9fb0fcb449d0 \
+    --hash=sha256:c8d2c9fd1f2d16f780d15127abb050d13d1a76c03a4bd87d7e4980e45e511e12 \
+    --hash=sha256:ca82be1a1d406ecfe1d25dc16cb33488e5a16bf4438c9fb590484ea29d92478b \
+    --hash=sha256:cc572dace3f60ef98d7b12ff411d20f5362feb31a0439eab0085bbfd349982d7 \
+    --hash=sha256:d18e5ac0f2f03f4f518d3e23db0f0cad7faa1da8620e9c09461d443bbf6e6692 \
+    --hash=sha256:d28630f5854ab07ab1fd4aba756de52326c82e6be15d414b12793f1975048b54 \
+    --hash=sha256:d9c275eaacd24aa73f94ffd6de08fc3f932424d8b6c376f4bed7cde376fe7bc3 \
+    --hash=sha256:da0e573f9f97159390c89d9f1a9e41908b66d408cc5b58d08cf3847d844c531b \
+    --hash=sha256:dd31f52ea1086513bb9df30f8fcee9b8918323ae067a3d5b78bc826a000712be \
+    --hash=sha256:dddad92b554513a31f272570678ba307fb9f618f05e3d4a5eacafff9eae03e1d \
+    --hash=sha256:df423d40ee8654634421812bc3b196da3f9bd7d32929da813f8394c4348a5358 \
+    --hash=sha256:df913725b79db7bcf03448f36b7bf8815363417d5b58deecf9305e3e30f0f21a \
+    --hash=sha256:e0bcb7e0f677f543555d2adff3bf19c05f66cdb4796e5ff602442ab2fe3c4ef7 \
+    --hash=sha256:e2d65b31f36619cda3999b78b2aa9632e76b78448e7a56fc4240824200e7c4fc \
+    --hash=sha256:e6e8cff14d6fb0be70a09c0bdc58096f501952d04624ebf867e0e56da2df8960 \
+    --hash=sha256:f16c709686a78c727bbbf059f92b0bf41c6fc60deec706d2dc19f529175a6125 \
+    --hash=sha256:f24fb43132a4c6b4cb4eb029492919b2db645be6808d738f244fd146c03c32cb \
+    --hash=sha256:f53e442b08449d42821fa4a4fba000095af9f62742a500f978a9f557ec44339a \
+    --hash=sha256:f5cfbc5fe74540d335175b656c725d74d90e3730c626d92575eea35029d9afaa \
+    --hash=sha256:f81b3b8f3d4e343550fa4baa0e479bba9f2d29ce9c2e9b51d1ce1718d7442fcf \
+    --hash=sha256:f8ec5e643a9a937f64e1999eb9f75d072263751912dc5cd06d3c85f8f44be7c3 \
+    --hash=sha256:fb92203a88b3d3053034db775110081c49d28be6551923805e039924093761e4 \
+    --hash=sha256:fcd22650c908d7b7da162bbfaab594a1227a15d1643a98c68b122ac642fa2264
+    # via
+    #   ansible-lint
+    #   cryptography
+click==8.5.0 \
+    --hash=sha256:255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360 \
+    --hash=sha256:ba0d2089de75ea0310e2dde03160e6ca10009947fb95a182f9b54021bb272e34
+    # via black
+cryptography==50.0.2 \
+    --hash=sha256:0ddc924c04591c2811ca024d62ecad4f7f6f08af8939c211438f48a16bd23602 \
+    --hash=sha256:0ec5f09541743261e66e291b4a0cbf0fb2997aeaab6d9e9c740b9dba1b58d1c2 \
+    --hash=sha256:0ecbc5652bdb6fc9eaf89a7d196e20941adfe812f43bc4ca05d9150496821047 \
+    --hash=sha256:1981f1db4630889b9ef7803fadef12b056f428cb6b85c27ba57b774793b6093c \
+    --hash=sha256:1ba34f04897fcdaa73f74145c25f3ec146fbd56593853e88adc2e811303c5f42 \
+    --hash=sha256:241449bf940a5d27309bd317e6f9a2af6932113818bb2b8f5c59ddc7ef16da18 \
+    --hash=sha256:25784ce8b9621c90c643efb9e1e2162ab3b0224cae446ad5e70e7fcb1ce18b51 \
+    --hash=sha256:3dc4fd8058cea1644971207d530e1a03a184a805ffc8ebdddf0599d78a331b81 \
+    --hash=sha256:4061c0079120205fb760c58acab6443e217307dcf05e3702cf970e0689972856 \
+    --hash=sha256:4a20ce1e5cb4284a86692fdcba7cb8754185c6b2e5c56fcef3751cf451d3cdc2 \
+    --hash=sha256:4e81d95e5bafc2d6e34e4bed780e53e4d5b9a2f928573428aa4d35fbec1eb0de \
+    --hash=sha256:58a0c478eeca76fe5e07993c5a0703def34a6dc6a0cda4f5564639b33112ffe7 \
+    --hash=sha256:58ddb5a8e3179d12f19e4ea34d2d32e9d63a4baa142c875c1eb59f41b7243acd \
+    --hash=sha256:630ebfea3bf689d075f82316324ff7433dc447fe6bc1bfc76524b74b4a9567d2 \
+    --hash=sha256:6f8700550aa1474a91e5dc07049c46f98b423b5b1ddd0483e0b51362eeeaf5be \
+    --hash=sha256:78198641e5be9521beea5aa782bb551a58068d10e6eb04c9c680c1b69f2e7d45 \
+    --hash=sha256:79def8d059362e7831389ed3be0ecdf58a89386e1271e35dd9f5af84e81bffd0 \
+    --hash=sha256:7a8701d6b584d76e909e3d305b7d126b41439876a5aaf76cddc67fc230eafa2e \
+    --hash=sha256:7afa5a6602a9f29af1f3a2965f831bae7c9d5d597b7cbb716d41ab3b7d89879c \
+    --hash=sha256:7b46165bb56eb4704e2eaaf86f3c940d19154535d9b0ca7d6d590b04060e00d5 \
+    --hash=sha256:7b75de3c8b3be1cdb1052747c929440c3eea46c1bc2cb8a6e3a48388e9b7b452 \
+    --hash=sha256:7c6d0330c472d96f6a6afe24d80dfdf15176c33096f0a4397ae4c60f3dd3be48 \
+    --hash=sha256:828d49b0ff5a0e3975865571c5d91dbbdd0d38d8289b249a163e9425413a5e05 \
+    --hash=sha256:84f964e537f916e2cc85199e5a88742e964939b575ac8598b3f9d6cc416cdaf1 \
+    --hash=sha256:85d0d9a31b9098e98534226d5686b47264b95e62ce459dc2e62fdfc809f9fe93 \
+    --hash=sha256:87e9ce85beb6b328ba370cc6e6aea483c92617b4c95b1d33a49297eb662bfb04 \
+    --hash=sha256:8c71ba2cd31fc93748c38e1b613200ff1c2665cbfd5341fe3a61cfde35a1430e \
+    --hash=sha256:92e665960f25fcdc73725b9cec7a3824f279ba97a98653afe9ffac2e43668f67 \
+    --hash=sha256:94e5e9f108ee10471288214d3d233fbfbb492840a8457eb85178d643ddeb32c7 \
+    --hash=sha256:9c8402a82ea0dc4ceeab793db05f0fafa8ca139ca34fcde5df0f596103c74107 \
+    --hash=sha256:9dab55f57c74c3cad24c323bacbbd04be4705ba6eb0d92e920b1fc4837ed5079 \
+    --hash=sha256:a582ab2ae1d34f67112cadc86702774c9ea4374df6bca6afe672817203c99134 \
+    --hash=sha256:a6557e5f38e065ca9fbdaf7cfc7435ecb1d113aa81a022d1b51921ee7432e227 \
+    --hash=sha256:a9f7355e6fab51f6c369b86fb7571cffa05edee2c2121e0380a37fb9ac1cd5c1 \
+    --hash=sha256:ab50ee449bf968271e820086f10a33d101dd060370abc10bcd22279be2656539 \
+    --hash=sha256:ac9ed99d81760c62fe89d5f0815cdfa1ba9a35141cf30f1c2d044f04b4803d2e \
+    --hash=sha256:b13478603dcd0a2479ff8e87e2c19a7d525734686fe3c49542472293a204212d \
+    --hash=sha256:c423ab384a46c4dff7217b2ea5ba2e11cffdeab6441acd04cf65a369caf0366c \
+    --hash=sha256:c5e67125c7dca78d199ec4e116aa93dbb83494808ecbb8211a2cb09b1bf41dbd \
+    --hash=sha256:c71be1cbfa5cd9a41ee452acf1eccd82b2c05950358b106ec8ceb83411d1a020 \
+    --hash=sha256:cbc8738fd8526d80f35cb3a40d41f41a2e7030bb3b18b09a6778ef63d291c2fd \
+    --hash=sha256:ce47f66801c20ec6c6632453bb5960fe38939e9306970b48b3a5a26de7745d94 \
+    --hash=sha256:d370b8d1dfcdf7130178137f6fbee6140774a1acc6cacefc4b42643ec11d0a3a \
+    --hash=sha256:d38cdff612d06fa6a32840d5e1b1f7a27cee4a349aa9085d94a67789d6bfd408 \
+    --hash=sha256:d8947001be83df1394050758ce0e745dd74fb134eef0a4b5124208dfc3a68c37 \
+    --hash=sha256:deb9fde5c60e437ee4821bc9bc39ff31b42135c27e1dc61ef0a629389c1de62e \
+    --hash=sha256:dfe9763530994147d9af1def057a5b9658b00e8f8fe8743d144d1e0911c2e454 \
+    --hash=sha256:e105ab60406787da31fccc883fc0f733af1efd78f0136a4599692c4083a73d0c \
+    --hash=sha256:e275096ea1e60cc595cda2836fd4a6c725d1125108b868be17f53684d164e2cc \
+    --hash=sha256:edc3342adf8f697fc5f59c887a304356f147b397809440ed64e2fa6af2f50f37 \
+    --hash=sha256:ee247f5c245c9a2fe7c8e2214e295918838e44e00a45a6718451e4004219e767 \
+    --hash=sha256:eef4c2f3423810b3070ab391f85436d2f8bbfcb286ac15cbc73190b3563b1f1a \
+    --hash=sha256:f21e8a22c8605750c7af886bab299a363721264061b4ac0a30efb73cfd58efc5 \
+    --hash=sha256:f265528741e048bce55c3463ed721fb0aa45a5888d8add8cfeccb3035451bbdc \
+    --hash=sha256:f2f9bd7f90c64fe89253f0a2c05e3c4856072660429ce8831b4235bf29403a67 \
+    --hash=sha256:f785f6161f202ab04d8ca194158968798e480ca058943907972da5f12e2881e8 \
+    --hash=sha256:f9f6143a8c75945eb960d9eb98905a441394abfa24afaae239d514ffb2586480 \
+    --hash=sha256:fa8f5efb344d6908a1ce62f4a24e2e5780f825d6f53f5f50ec5ffacac72936cb \
+    --hash=sha256:fdd28f912fccfec1846a94e2e1e8f9b0012f557f0c46fe4f3eb0d7a87afcf90b
+    # via
+    #   ansible-core
+    #   ansible-lint
+distro==1.9.0 \
+    --hash=sha256:2fa77c6fd8940f116ee1d6b94a2f90b13b5ea8d019b98bc8bafdcabcdd9bdbed \
+    --hash=sha256:7bffd925d65168f85027d8da9af6bddab658135b840670a223589bc0c8ef02b2
+    # via ansible-lint
+filelock==4.0.12 \
+    --hash=sha256:5f17ee83ecee8a6f3e389c75822fb70a1c2f0506b99438a6dffa1d56793588c8 \
+    --hash=sha256:cf42711a7ac791818b299fab0332a088c65aeeefa36290de98db92c434303b0c
+    # via ansible-lint
+jinja2==3.1.6 \
+    --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
+    --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
+    # via ansible-core
+jsonschema==4.26.0 \
+    --hash=sha256:0c26707e2efad8aa1bfc5b7ce170f3fccc2e4918ff85989ba9ffa9facb2be326 \
+    --hash=sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce
+    # via
+    #   ansible-compat
+    #   ansible-lint
+jsonschema-specifications==2025.9.1 \
+    --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe \
+    --hash=sha256:b540987f239e745613c7a9176f3edb72b832a4ac465cf02712288397832b5e8d
+    # via jsonschema
+markupsafe==3.0.4 \
+    --hash=sha256:007e1ffd9bf65bb6ee96df7b258fc632a4868dd5566037986c64781f35a36e98 \
+    --hash=sha256:02fa4acbc6a3fc5c693c34d4dd8c1130b7fe99cc915181b0ddd6f72aeb296002 \
+    --hash=sha256:03470d1a8268e692ecf79ecd565593e59d44219377a7ead61f1f1b94c1f7ff6b \
+    --hash=sha256:04e7902ba80ee4bac1d50a549606527a1dcf0476cd81403db41099d3b60ec653 \
+    --hash=sha256:051417f74bcaaefa316276e0ff723f541616ca51043d070da00249d9bddd3e3c \
+    --hash=sha256:05295589e619b9bed252a86b532b8e27350abc372d18ba89b59375325e91ec1e \
+    --hash=sha256:06de8ef6331f6e822c28d577dc8bf43fe398800477c49498f38fc38b67ff33fc \
+    --hash=sha256:0764a13d34cae40db7bbf3a09b7e9b491bf4603e20b263a7a9d6b8e324975d0a \
+    --hash=sha256:077293e425f28ec737dbcad442a71752e28f8ae27cde3d68acd1fb212091cd92 \
+    --hash=sha256:0930db9bdc62d22944e10b066448bb65dc9abe9112880c7cab8da54db4284d5f \
+    --hash=sha256:0cee7cb0f9a1b6892ea482237d9403b3d1b4603aee057d0ff01f0fac2d019a97 \
+    --hash=sha256:0d9c47709875fdb321452056622e930c52afbc07a7d780762fbb8b4d91ce6fa4 \
+    --hash=sha256:11935df9bf455ed0c04eb87bcd720f02b1fe5e02128a9430f23aed6f93336fc7 \
+    --hash=sha256:12a606a492de952afcb43b59a14aaaaad120e708d3663dd0fdf2d738d427a691 \
+    --hash=sha256:14bd2d845d62ab678eaf81da89d7b621b51756c72346745c1a594c09d49207a2 \
+    --hash=sha256:15ba9e28640feef770374b116a6f019c21f52404aeabe516aa7f800587b98cfc \
+    --hash=sha256:18a801868a884f216e784d7d14db2a4077143ce7610440aee2ce8f734e7cfcde \
+    --hash=sha256:1c0df495a977d10460a94941799c72d5b5ab03d3858d949b55b5a66c8f371c99 \
+    --hash=sha256:1caa2fa5a6184fb233153b35f654e6687bd555476f6170f29d8ee9be1a8b0af9 \
+    --hash=sha256:1e1451fab512d1bcc3dc26988ec1edb0b82c2db909132872cd9356070a6b63df \
+    --hash=sha256:1f1f9477e174582b0a1b583d60b66e1f2cf5d3fe12cee985e4aedf44766600e5 \
+    --hash=sha256:2628d3a8cb648ecebb3c5d6b0a1052d400e4d8b7ac0fb786be8d285b50040d17 \
+    --hash=sha256:26e9867520db70d37f7fb421a7f0d8adb40171011fb84ce869afa1a83370dfa8 \
+    --hash=sha256:2a6ef68ae94aed8721934072b27a3b654ea2100b97e4ab864cf1489c90926fbc \
+    --hash=sha256:2b2b1e18af909b448bb3cf9e3433366f7a8726271fc214e8b10e0f62a78c724b \
+    --hash=sha256:2cb3dd71fc6be918ad4264346a8ed69485f9b7ed7bf35495d8e22807cd6b8bea \
+    --hash=sha256:2d1b7d9308288661f56672b1b157d75fc536714d3638487bbea17b6318a78248 \
+    --hash=sha256:2dad610540cb2e6272855c178f08ae9a1c7ac258a7fb71660553a5f104b42741 \
+    --hash=sha256:2e5a7cd7fdd14fcb1ae5d7d8bf23d24fbd1daefd1fbca2580132e1ea75f098b5 \
+    --hash=sha256:2e9ad7dd851bf45fab9f75cbff4cb493fee9979e8d8c7c9c3ee119022518edd6 \
+    --hash=sha256:340cbb1957ba99929cbf19a75626d36ba1ae21d1730b287d1cf7f824a20c4fc7 \
+    --hash=sha256:34bdde374c5932765d7dc685c4a1d191a3207852d67e8e0a9eb6ea85156181f1 \
+    --hash=sha256:353bd63081912ab8cfa6a0c7d185934cdf8426f04c618bba6bc4b394f2069b67 \
+    --hash=sha256:387d8cd30e69b3f0a72877b9ae717033396404e19095b17fe89753a981fda44f \
+    --hash=sha256:3882fb412298575bae3b9c46868251f15cc69307359f87bb1b382e53d6e5a2c9 \
+    --hash=sha256:38fc55594dab834470b6733dead2ee9e3f657fb0608c769dcafa0ba5ab52f45c \
+    --hash=sha256:396ec4e65cc889f69786b3b89478b471cee5a3bcf468b9d9bb03e1a30fb291fc \
+    --hash=sha256:39dbacefc411633db5b4378b066a9aca70a3d7e2922c9e578d825f844026eeba \
+    --hash=sha256:3a93d9616ddecfb393727a0041a562cf0b15a244e20f2bd25efc7949be4c4f17 \
+    --hash=sha256:3d23795802fc8bd72534836d64489bbf0f67c088959091bdb22e10735a5107bf \
+    --hash=sha256:434139499bb20b502ed3baa1f169e618f924a97e7a777fea1a49446d80106cf6 \
+    --hash=sha256:436e3ffc6310d3c41878c601db29098102fe5d8a467c49da4a4125254e0980f2 \
+    --hash=sha256:489505b03f692c3f376394e49194fa7a7f9e8558d6e293a7056a0032b0c38163 \
+    --hash=sha256:4a540e2d3192792fc84eced57bef37851ccb2b41f73291bb17408eea77bcd278 \
+    --hash=sha256:4a7cdc2a420ca01058182da4253329764d4bfa055564d1eced90e6ba1e8b1d3d \
+    --hash=sha256:4bced6e2a6dba6a28f7dd3c6ce14df1b2dd495923f16ea484cad03decd463b2b \
+    --hash=sha256:4cf3468d5ec187ffffcaca8e61929a37448f215dafc1386a12c750a72fe53634 \
+    --hash=sha256:4e2c4809c14559aa7ef426f27fb35afbb38104c349a903bf8f3600456764bb38 \
+    --hash=sha256:4ed644d75aa94a2baf7ec3a96eaa160ea58c742eb9d27c6506053c5c40fc84ed \
+    --hash=sha256:4f6e0852a0283b1b1fd776eeb7b766a5f440b3e2bd31ab51af3b400585f3965c \
+    --hash=sha256:5066b244f576f91afc8ee3ba029a89f99d39c79b1853fe9d39bea9f0afbec148 \
+    --hash=sha256:5086f9975abb1ab531ee6afca1761e4b59a19b446f3f6522ed776963228cfe5a \
+    --hash=sha256:50b5bedc9ed8a94fc8857a42ef4f84a81ea88f8d4f05dc8705fb23ee6d8dcca7 \
+    --hash=sha256:52704c5d36eb6dda8866493decd61111fff86244c9b1ad225ca01b9e91e5970f \
+    --hash=sha256:55ffd6ce583d97dc71dc92e930324c8c0d25aea7e3ade6ae54ef77cedb096811 \
+    --hash=sha256:569d65055d367e3dcdf30c3f41119467b73d9ee9faf332bdf40402644f5ac08e \
+    --hash=sha256:57f9947a7e57a081c1e3e0a2dd0d2dcf290a4531450e6f611e30084c222a7295 \
+    --hash=sha256:5989cb26b2e1efc6a42216a9f6b5ee495ce5ace2e5b352a9af489976b32d1ee2 \
+    --hash=sha256:5c22873ad1f0532ba40fa1727f3c0fc1bbbaab6d373d4cbe3f0dc74b2e2521c7 \
+    --hash=sha256:5e8b3d0b18fd623afa12ecb2ce8d8becef69f9b5440c6330c7972200e0bb84b0 \
+    --hash=sha256:61631e08084be9e21a8967ec3139c7616ed7c5e9368e05c86d1b39562c8a57b6 \
+    --hash=sha256:64511c54db4e4987aef4c41923235927428729e8174c5dba488429be70a998ed \
+    --hash=sha256:6669c1bf34080161ce49c589cc512ef24d4c704ac9d2b2d3667f519c60418378 \
+    --hash=sha256:672d207103e6b16ca098611b0f9efad6bc00afd47c03d6ef62186495ca677dc0 \
+    --hash=sha256:6768d67d1bce64270e0fdc2e69309d68b9b18ae56ddf6c711d168e9d051c2cac \
+    --hash=sha256:6a45c3d514f2436064db00d7fc8778d888f0236ebfed649b53d13a59e69ad51b \
+    --hash=sha256:6bd9e1788e15bfcf6a9082de42e30387e7b85d211ab21e57a939bb8cfaaf8d96 \
+    --hash=sha256:6d2a9efe686f9de00d0d1ea32a4a5a86d558a2277501bd78d964214eab625e59 \
+    --hash=sha256:6da83a088f8ef93b2d483a8232a4dbf4d69d3d8496b568a03c56becac43e1808 \
+    --hash=sha256:7018d4af1cd272e847aa5917983ab5e83e4f6579f9dbfecd4a79c0ca80b144c2 \
+    --hash=sha256:71f88e749ea29f67f21f3b36433c1dc54c7729ed2a6d9e2da2e0d9e0d7b224eb \
+    --hash=sha256:737c9c3981998eba27f11786f84fddcbabc74068b72a4a1f454ea02094b57b65 \
+    --hash=sha256:73e77980c7207854f00fc4e71fb1626868d5740ab4012623d55c7a99ad122a72 \
+    --hash=sha256:799c39bdf5e2f1292fedd3009f7b3c9e760f10b2420cb9638d56920840ff6db8 \
+    --hash=sha256:7a83aa6e4805df46fed18e989d3d16f86ef60cb50bbc8d9ce3a6be89165fbf6e \
+    --hash=sha256:7d3391b2188d18737cb2fa147028b1096236eaa7e156446c650a489fa2cadc91 \
+    --hash=sha256:7e1636da3d8dfc220b6dd10264db5f2b165e4888c4518594898fbe381049af8a \
+    --hash=sha256:805c8b84534fa10891890f0e4be39f3a99e94615d93e8836bf9fa1fdca2feeb2 \
+    --hash=sha256:811d02d5122171c1941357efd8f9bf4ffe907b7f0a1a4e729a880e4be3f46e3e \
+    --hash=sha256:8138eb83940ec7299024d92d4dee45f601b9e6c5ffde9d25f4e35e326203c707 \
+    --hash=sha256:83b3944fea42a8400edf92fd1770fb8d0d4f7de651353bd2d8525a92dba69a21 \
+    --hash=sha256:849dd2bb0e5e4ab2b71c7191726a4a8d5aa8a610daa584728cbee0b710ddc4ef \
+    --hash=sha256:8698d70a8081ee8c090dbb394768b5789a1da8b131b5499f89d071dd3cfaf6be \
+    --hash=sha256:8781a792a070cf2bd1b86d3aa943894115faaba6e88122a7bf32d62072742453 \
+    --hash=sha256:88d59b473bfb03259722600839af9bbd7fa13a2eb514beefeedb95997882f69a \
+    --hash=sha256:8909c2f1c6dd65e054ac4b573a91c8384d1492281e55d82d159d653f7a13adf6 \
+    --hash=sha256:8965520ac587c94a4ac48b729be3d8b8de00af39699b17585dfb599babe77977 \
+    --hash=sha256:8b5d563170ff8ba3181caa967c99a3c804d1dedb702c7cb93a6a7c32247da978 \
+    --hash=sha256:8e124f974786f831d6043728e38296969d3579db8896fe004682f5758e613581 \
+    --hash=sha256:8f0fac8b13d14bb06c68195f849371924ae53dd7b1c00fed24650f704383b692 \
+    --hash=sha256:9240187afb63d2f9ddc3e032c670356fe941f6e20662ea168a5dc3f1f317e1b3 \
+    --hash=sha256:925f929d6b59a8b3f8b8c6ac363cd0af7eecc81efb3071770b3c6717c450a369 \
+    --hash=sha256:9348cbb300d224fe3b89793262cb093504d4ae927004468463f745188a193e4a \
+    --hash=sha256:9388003072b95f2f1e3fd908604194d653ba21330d811961a78b7da1a77e9e36 \
+    --hash=sha256:9438a2648b2195980cb2dd8e53ed7b8df91319e2d0b70ae61a9e1d1bc8d3bec9 \
+    --hash=sha256:94e4c421742086aeee4c32a506eec8859d7634aad943f7e6aacf70f813478768 \
+    --hash=sha256:94f5407f7bc64fa6463906b896f9904beeeb7dd8dc116ee8e9056c8714ff9916 \
+    --hash=sha256:971a3bbb75d97ae4e2e8f7d4834236f86f85f0c85e04ab2e191db1123b04f80b \
+    --hash=sha256:9e227f3dbe6bde7491cf0a9965d00b88c6b1a4a95d11480ddf88bb96d397c19f \
+    --hash=sha256:9e25feb9e330b63edb0278a0acdf85e50d0cb0fbf49c3084abbe4e24ae195346 \
+    --hash=sha256:9f098115c247e11d138ab83a28fa0323c77015007ea2df73ba5fd714dfefd67c \
+    --hash=sha256:a18f38cafc329bac5e3c2b96c765b4c96d3d103421ed22ab7988c1e3fce27464 \
+    --hash=sha256:a4bbd2d87dd233b9fc5812160c3d0ffbe42edc22a26ce0469f58479ede633fe9 \
+    --hash=sha256:a5fcffb37e602b0b3c1638a97746b9b96125caa9bcf6fa41d337a9261de231ee \
+    --hash=sha256:a8e9f292fcda89b324f2f5c91d13f1424a153e40fc2756f38ee23b15835ff300 \
+    --hash=sha256:a9f54054101545a9a9cccefddf54316aa6e4491611fcbef9e91b3b6bebec04f6 \
+    --hash=sha256:aa2c838cc024642cc04c6854232f32b43e5e22833dd11119c1766c7873b8370d \
+    --hash=sha256:ac0c7c9f1609b0c4c114feb1d7a3409564c7fb77e360bed9e97e5d25dfeaf868 \
+    --hash=sha256:add96447a86d205ab616665d53b2950ee81083757f56e6ea833c8b2917646b46 \
+    --hash=sha256:ae9dcb8fbe244cb82f8a6458b455b927a03685e383d9bacf1ea5ce180b96dc97 \
+    --hash=sha256:b4a635a0487774f841cb1fb62e907e7195cc95bc761e053184b8acc3ceb20733 \
+    --hash=sha256:b4d12837e0203bbace818ff4a7461afdcd78bcd782351cea148139180d7bcffe \
+    --hash=sha256:b61687d0828e72bf5cda24a2690188f37170bd31c9359ac97e4e66569f120a16 \
+    --hash=sha256:b807e598953730f82e4eae3bd30f6a122cf6b31c398c6b504c0e04c13c170429 \
+    --hash=sha256:b8cd1f918b26fd7b1832ece557cc18f2d8747309ff8b3f0ef9d4250c5ad67a39 \
+    --hash=sha256:b91cc9d336957239ff200f30097e6fea2dc6d6fb3c81e853eaa09eac904fd894 \
+    --hash=sha256:bd3ce56ae2cbae3ba82b683bc425cd7e48d2ed8b10f3e818186b6f5646d9271c \
+    --hash=sha256:be6cb0c799abb0e2ba3e618e6d28ddddf7e485f6c2ce938dfa237daf3905072c \
+    --hash=sha256:befb4158af32106b9a93db8d6d1d1cbbd418c0d5aca0cabb7b1780abf0c89169 \
+    --hash=sha256:bf053da3c97a4bc5ecfbb218cdd2983febd91c617be8367d139882aa11e490aa \
+    --hash=sha256:c02e8f18bdedba082cef725942ac823b9b60656db07f7e265cb31618dfd00d77 \
+    --hash=sha256:c1bc67752d5f21013cfe430df4062441714eab79f65a6a05e01505957e9c35fe \
+    --hash=sha256:c61750fadcd119d0825bcb7d7d675dd264dcc89cc05292aab5be68ebdbb374ad \
+    --hash=sha256:c90d5b3d4e944e065a301d741b3c1d784f6bd1f503aa68b4967e32b2ba313d85 \
+    --hash=sha256:c9a7f43c0b202b334cc9184af09bb8f21d3a209e038efaf106936fb69e6b026e \
+    --hash=sha256:cb96e6e088d6cf71c1ea977510948320234824cf226e32f6f6e044f7a9c82b34 \
+    --hash=sha256:cf63c214fe879a65e69a386f915e36104fc84254ab141240f8854602d8e0be2a \
+    --hash=sha256:d1aca03ede943eb80ab3d63bb082c84b7aab85ea83bd0fd0c200260945fb49d9 \
+    --hash=sha256:d2e56fd3b00222722abfb3f5f0759ddbae4b90811b5ad4343c64030ad1bde70c \
+    --hash=sha256:d5f93ebbeb8032d47e349328ec8662d973d9b05a70b3c35df1f91fe419b84749 \
+    --hash=sha256:d882a373d8093c2941e01291b7ced96e9cbe4781da9a7751ca7e6c70385e5214 \
+    --hash=sha256:d920abdfa61279ba1a2ef9484aab07bf03331f8c08a10120fa332353d06e6932 \
+    --hash=sha256:da2af0d7aebfc2074080d72efa6ab8317c62481ef1f896f65d9999c1c01f4494 \
+    --hash=sha256:dd8ea6ebee7aedbf7c749fa80521d9ccf1ba473e0d1e14805caafbaad281c889 \
+    --hash=sha256:de8b364c423ef0a4bad9069657d617f9a5d2b2062457a89b1fa16ee199c399c1 \
+    --hash=sha256:df1ae86ff54725a01fa1a0510b914ca53a161b7050be74f6204e24aded5971d0 \
+    --hash=sha256:dff05cb7016dff1e9fd68f4122c127b65dfc59de5306cfb7ad92f956f230bee2 \
+    --hash=sha256:e1a622f13970d81f95d0c72f9dc090dce9085fccfa4c9f2174377ee32bd15786 \
+    --hash=sha256:e49fb0d1ce92cfa0cb198cc5b1b11cdf9d0638658e2a2db2687e39db7c87fc78 \
+    --hash=sha256:e5c802729725bd07e2bc3ab7b76dc7e0bbfc53129d8f1eb1c002c24cf774717e \
+    --hash=sha256:e841068dc0be4cb6dfb5c890eb88cbdcff2f4a332393c7ec94e8e618bd32c1a8 \
+    --hash=sha256:e916035e3e9930cbdfdd10abf48861340221857f45509565898e012263f7b289 \
+    --hash=sha256:eba154571c16e032112afac0dc2dfe9e63c2ceb7aedd07bb7eecf2ce26d4dd4c \
+    --hash=sha256:f03460ff076f70ab595bb45a0205ccea1971443575b6920c52e755dec2b3fbfe \
+    --hash=sha256:f0ec3b750b59375eab5b0fb2b9254810c00a3375be6d789899f1055a1d556237 \
+    --hash=sha256:f291bcf42ae98eb5107edb162c3c998b4a89648fd8e99ed4cbd12705292788cd \
+    --hash=sha256:f61efe1d2fe0de16158a5fe1d1cf3c14bdb6aecd54d8938fd26512c525c1f624 \
+    --hash=sha256:f68edfc67aabac33708941f26f22a7b8e9f81429bc0cf249fcf7d66b23af8d19 \
+    --hash=sha256:fa95848c929b6a75f6848d3c9793e59db365ee436776e57db835cdbfa79ba977 \
+    --hash=sha256:fd9f8797427910198f95bced71ddfed61130d7e349213bfb8466c9c99e2c46a8 \
+    --hash=sha256:fdb4ca07ab75ffadab4a8b135ad59cdbb3156b99310f3d565370da74a15d6bd3
+    # via jinja2
+mypy-extensions==1.1.0 \
+    --hash=sha256:1be4cccdb0f2482337c4743e60421de3a356cd97508abadd57d47403e94f5505 \
+    --hash=sha256:52e68efc3284861e772bbcd66823fde5ae21fd2fdb51c62a211403730b916558
+    # via black
+packaging==26.3 \
+    --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
+    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
+    # via
+    #   ansible-compat
+    #   ansible-core
+    #   ansible-lint
+    #   black
+pathspec==1.1.1 \
+    --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \
+    --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189
+    # via
+    #   ansible-lint
+    #   black
+    #   yamllint
+platformdirs==4.12.3 \
+    --hash=sha256:080f3b39423b5abfca9a23d84c4e9795f54d395cd8459867a8ded44084fcd5f8 \
+    --hash=sha256:427fc0bb321ae0c5b037fa03238ca74820437be162e78b4848c4d4055b9b766c
+    # via black
+pycparser==3.0 ; implementation_name != 'PyPy' \
+    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
+    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
+    # via cffi
+pytokens==0.4.1 \
+    --hash=sha256:0fc71786e629cef478cbf29d7ea1923299181d0699dbe7c3c0f4a583811d9fc1 \
+    --hash=sha256:11edda0942da80ff58c4408407616a310adecae1ddd22eef8c692fe266fa5009 \
+    --hash=sha256:140709331e846b728475786df8aeb27d24f48cbcf7bcd449f8de75cae7a45083 \
+    --hash=sha256:24afde1f53d95348b5a0eb19488661147285ca4dd7ed752bbc3e1c6242a304d1 \
+    --hash=sha256:26cef14744a8385f35d0e095dc8b3a7583f6c953c2e3d269c7f82484bf5ad2de \
+    --hash=sha256:27b83ad28825978742beef057bfe406ad6ed524b2d28c252c5de7b4a6dd48fa2 \
+    --hash=sha256:292052fe80923aae2260c073f822ceba21f3872ced9a68bb7953b348e561179a \
+    --hash=sha256:29d1d8fb1030af4d231789959f21821ab6325e463f0503a61d204343c9b355d1 \
+    --hash=sha256:2a44ed93ea23415c54f3face3b65ef2b844d96aeb3455b8a69b3df6beab6acc5 \
+    --hash=sha256:30f51edd9bb7f85c748979384165601d028b84f7bd13fe14d3e065304093916a \
+    --hash=sha256:34bcc734bd2f2d5fe3b34e7b3c0116bfb2397f2d9666139988e7a3eb5f7400e3 \
+    --hash=sha256:3ad72b851e781478366288743198101e5eb34a414f1d5627cdd585ca3b25f1db \
+    --hash=sha256:3f901fe783e06e48e8cbdc82d631fca8f118333798193e026a50ce1b3757ea68 \
+    --hash=sha256:42f144f3aafa5d92bad964d471a581651e28b24434d184871bd02e3a0d956037 \
+    --hash=sha256:4a14d5f5fc78ce85e426aa159489e2d5961acf0e47575e08f35584009178e321 \
+    --hash=sha256:4a58d057208cb9075c144950d789511220b07636dd2e4708d5645d24de666bdc \
+    --hash=sha256:4e691d7f5186bd2842c14813f79f8884bb03f5995f0575272009982c5ac6c0f7 \
+    --hash=sha256:5502408cab1cb18e128570f8d598981c68a50d0cbd7c61312a90507cd3a1276f \
+    --hash=sha256:584c80c24b078eec1e227079d56dc22ff755e0ba8654d8383b2c549107528918 \
+    --hash=sha256:5ad948d085ed6c16413eb5fec6b3e02fa00dc29a2534f088d3302c47eb59adf9 \
+    --hash=sha256:670d286910b531c7b7e3c0b453fd8156f250adb140146d234a82219459b9640c \
+    --hash=sha256:682fa37ff4d8e95f7df6fe6fe6a431e8ed8e788023c6bcc0f0880a12eab80ad1 \
+    --hash=sha256:6d6c4268598f762bc8e91f5dbf2ab2f61f7b95bdc07953b602db879b3c8c18e1 \
+    --hash=sha256:79fc6b8699564e1f9b521582c35435f1bd32dd06822322ec44afdeba666d8cb3 \
+    --hash=sha256:8bdb9d0ce90cbf99c525e75a2fa415144fd570a1ba987380190e8b786bc6ef9b \
+    --hash=sha256:8fcb9ba3709ff77e77f1c7022ff11d13553f3c30299a9fe246a166903e9091eb \
+    --hash=sha256:941d4343bf27b605e9213b26bfa1c4bf197c9c599a9627eb7305b0defcfe40c1 \
+    --hash=sha256:967cf6e3fd4adf7de8fc73cd3043754ae79c36475c1c11d514fc72cf5490094a \
+    --hash=sha256:970b08dd6b86058b6dc07efe9e98414f5102974716232d10f32ff39701e841c4 \
+    --hash=sha256:97f50fd18543be72da51dd505e2ed20d2228c74e0464e4262e4899797803d7fa \
+    --hash=sha256:9bd7d7f544d362576be74f9d5901a22f317efc20046efe2034dced238cbbfe78 \
+    --hash=sha256:add8bf86b71a5d9fb5b89f023a80b791e04fba57960aa790cc6125f7f1d39dfe \
+    --hash=sha256:b35d7e5ad269804f6697727702da3c517bb8a5228afa450ab0fa787732055fc9 \
+    --hash=sha256:b49750419d300e2b5a3813cf229d4e5a4c728dae470bcc89867a9ad6f25a722d \
+    --hash=sha256:d31b97b3de0f61571a124a00ffe9a81fb9939146c122c11060725bd5aea79975 \
+    --hash=sha256:d70e77c55ae8380c91c0c18dea05951482e263982911fc7410b1ffd1dadd3440 \
+    --hash=sha256:d9907d61f15bf7261d7e775bd5d7ee4d2930e04424bab1972591918497623a16 \
+    --hash=sha256:da5baeaf7116dced9c6bb76dc31ba04a2dc3695f3d9f74741d7910122b456edc \
+    --hash=sha256:dc74c035f9bfca0255c1af77ddd2d6ae8419012805453e4b0e7513e17904545d \
+    --hash=sha256:dcafc12c30dbaf1e2af0490978352e0c4041a7cde31f4f81435c2a5e8b9cabb6 \
+    --hash=sha256:ee44d0f85b803321710f9239f335aafe16553b39106384cef8e6de40cb4ef2f6 \
+    --hash=sha256:f66a6bbe741bd431f6d741e617e0f39ec7257ca1f89089593479347cc4d13324
+    # via black
+pyyaml==6.0.3 \
+    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
+    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
+    --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \
+    --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \
+    --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \
+    --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \
+    --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \
+    --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \
+    --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \
+    --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \
+    --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \
+    --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \
+    --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \
+    --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \
+    --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \
+    --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \
+    --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \
+    --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \
+    --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \
+    --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \
+    --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \
+    --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \
+    --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \
+    --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \
+    --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \
+    --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \
+    --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \
+    --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \
+    --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \
+    --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \
+    --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \
+    --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \
+    --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \
+    --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \
+    --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \
+    --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \
+    --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \
+    --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \
+    --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \
+    --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \
+    --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \
+    --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \
+    --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \
+    --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \
+    --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
+    --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \
+    --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \
+    --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \
+    --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
+    --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \
+    --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \
+    --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \
+    --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \
+    --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \
+    --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \
+    --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \
+    --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \
+    --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \
+    --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \
+    --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \
+    --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
+    --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \
+    --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
+    --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
+    --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \
+    --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
+    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
+    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
+    # via
+    #   ansible-compat
+    #   ansible-core
+    #   ansible-lint
+    #   yamllint
+referencing==0.37.0 \
+    --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231 \
+    --hash=sha256:44aefc3142c5b842538163acb373e24cce6632bd54bdb01b21ad5863489f50d8
+    # via
+    #   ansible-lint
+    #   jsonschema
+    #   jsonschema-specifications
+resolvelib==1.2.1 \
+    --hash=sha256:7d08a2022f6e16ce405d60b68c390f054efcfd0477d4b9bd019cc941c28fad1c \
+    --hash=sha256:fb06b66c8da04172d9e72a21d7d06186d8919e32ae5ab5cdf5b9d920be805ac2
+    # via ansible-core
+rpds-py==2026.9.1 \
+    --hash=sha256:00ba2d8c7dd4ee537978ddf4b3fbd712bef2d8751603f7f3146b3f4287768e25 \
+    --hash=sha256:01445c8d194aa032a08e944f16567672da1c62dbdbefd8b6d0693032e290cf68 \
+    --hash=sha256:028ad274ea951dac64491b5d1e65712a4aeabfdbdb9fccf797b57bd899b0c495 \
+    --hash=sha256:0483515261947e4e8b8e1375bf7463e7eb6ccfb3d86e7b554d90cd5285f20f32 \
+    --hash=sha256:068c37bba854ec2fe42f7365c640af11dd9895890ccbf2df5070d0c059bd7f96 \
+    --hash=sha256:074a4d198bc34d9a8ea425114fc3ded6d11ec01f6a314a8db67454a5152d8834 \
+    --hash=sha256:07deecbfce94c78473018bc7d10b337cc651d12df87a1eb2cb3e4024bc9c33d0 \
+    --hash=sha256:08dae4a4095150a7c4545a1fb40b98e1ab1744fbc2770d92c977b9dadaa49ab6 \
+    --hash=sha256:0da298fb372dc192610a4b9ecbc68a0cd8b675bbbd1fc519d01b41cfd658333e \
+    --hash=sha256:0f045bb053c9057720d72c56dffe30dffdc05997b2897a827b9325f0ab6623fa \
+    --hash=sha256:10e208f2425d973938afcd56e28a7c4be32e27b6a60b5d381f49fb9d8acf9759 \
+    --hash=sha256:136a1c3fe4402b7008bc81cb62ee538481795b61a7e83df88dff3b3f02b726ff \
+    --hash=sha256:159a7aab5c5e8b112c8830f54717ce56da1252ebdbb526f5be2df2309280b9e7 \
+    --hash=sha256:172e47169583f46ce118cbec68e6795d0da0f4606b488b6434f8276bca0a058c \
+    --hash=sha256:1c2d1f6da5128eabf34e963d7163a818846075a52568250d006c4c953b40f903 \
+    --hash=sha256:1d55198263bb51f557550c6ed2e6d1cb6a6fed6eb5c9120b741c5926bef8a45d \
+    --hash=sha256:1d77b649e6f7cdf12ca5c2a98dad0ad37f9ea9b6f960408a92f0cb12bb3d04d9 \
+    --hash=sha256:1e8d4d79d828299bf44a55db22a9388ab967b49d17132c88eab0f4360b48da8e \
+    --hash=sha256:22ffd29a63d71fb1b81552c21f2c2b734949b7ac751a9be70675a939a900839b \
+    --hash=sha256:2693b2728bbcc48d09a981a356954b0c47c53ff25b545856f28a889ea619f69a \
+    --hash=sha256:270bdcdaac5d5b6f73c5e22e7e135c7f2a50e789f71d9e241d5be8d90026e19a \
+    --hash=sha256:2711d29b653b3bce48a63d18b9c6b53274669e6d6c4094dddeb4d9a0e45128b2 \
+    --hash=sha256:2c16ab111bc27c646ba8aa005d0527754edc538ebb636f0b1bf8e244b48d1945 \
+    --hash=sha256:306ee1850d8105b5baf977e78d45fcadd12c1a54678d614c9baf217708446e91 \
+    --hash=sha256:3231c4c0e521dafa5be0c9f114ee2c2ad46650836f2d72caa86801950c3e7044 \
+    --hash=sha256:3890a6aa36e6baa53d5258a2a25d3ef8b37ad165a6ab27a892d7c3e3a432cd69 \
+    --hash=sha256:3a72c11530d71abfb66c8d7696a2f86c43e63fca8b948f1a784ac490f4ec688e \
+    --hash=sha256:3b5a6f40f0a1486b4b36c888123afc67acdbd9f33235927acf5ff295429a0ba3 \
+    --hash=sha256:3c91c210ae7645626c608400e3519b4a642f837cce09ca830db3beb2e9f274d4 \
+    --hash=sha256:3cd182d7291d29b92c521a0069d9c01ba6193628a9a105531d11b40a6d731a33 \
+    --hash=sha256:3e524c7874ac72884d28e16dd5b8d839fd09e0fe76b020d3fbca23212a7b8c52 \
+    --hash=sha256:3e93b2cd69a9830be33e03945cd7cda940a0a8bfcfbff41d6144f0cb0d3d8bd9 \
+    --hash=sha256:3edae8c5ddfdb6985d49ae9d150516e5076888879022f91a26c2de9276ce0bdb \
+    --hash=sha256:3f0e9ac28fc067d4d34b88ae43c48e9489455c97fee9633d851f7eeed5a05d35 \
+    --hash=sha256:42e75466f83cd43f6026c81eab74246efb2bdadafb307b85700632d06c68f299 \
+    --hash=sha256:44b32a7c4f0da3d28af31c259e38ddcff096f855e205ed0671d02fcf44f1ea1c \
+    --hash=sha256:457866b85daf5034296666168b84a69e0b2e89dc4f1af102b46f6448a60b9063 \
+    --hash=sha256:45bc6bccf78b20fd834237d18db64965d7ee68ba7f60440a26c7ab71e7b8d51a \
+    --hash=sha256:46d80bc76b51a6c24f9944368c28d38b8bcbcea1da4f2f8d3ebc31a67e8c6ec6 \
+    --hash=sha256:4793ef7f78268b124b73fa933440f01d258bbae01de9fa53e9080c9ab0425a12 \
+    --hash=sha256:492e5e428cbe126221611f47e068f01660352feec4ad18bc0f5ea9b2ae88fb14 \
+    --hash=sha256:4b26b03d9d2658ee2fa234f8f4f19f38a09773fe5261028025032e26d4d35af0 \
+    --hash=sha256:4c0d2cb595a420b34d5086db0add011e26e2c09d6a024afbac4228bf8f863a30 \
+    --hash=sha256:4cfaf02209061880210819934de2f4f6aa83dc04dafe6770276acc240a56da31 \
+    --hash=sha256:501909f2e4a1e2dee528ef766fe3c469060ebc17e54a8383d404ba07a81a6f02 \
+    --hash=sha256:50906f5aea24b5a865cbd0a589698288631d9f3a54c3a937c83aefa95a0d14af \
+    --hash=sha256:54ac2158a6f96cfbabff0b2eedaf94b90c5ec7ca8317fcadc61e1c2b2e0ff6ef \
+    --hash=sha256:56c6952a9b15047466d0c2347c446a761d4527f89976156341e68f0ce5cc08b0 \
+    --hash=sha256:56cd8b3f77d7b6812f533b662186a1f28316931166ddc00fb893b1b0db7e9888 \
+    --hash=sha256:57492a550a1d88d29d003247e5f78dd8cf04a701fac0e4c8db8745a6d2504e0a \
+    --hash=sha256:5943980471829f6de242a20b109de3111ba6b77e3af0ffc587028ac854b05e6c \
+    --hash=sha256:5c6ee90dee3e85e055ddfd502d611643d9b0fd94c818220bda84ec3dacd9b27b \
+    --hash=sha256:5c90e7fa02e8f5de0d10c17595c568ada48c5302e749462c0ea1a4c362111a86 \
+    --hash=sha256:5ce8943f79c2210f7abcc28e86367b03b28d95027fd01c46d2472373ae70c86f \
+    --hash=sha256:617f59cde379b4f648a09797b7f683d04b90a46344cddab85639da5aff0f5531 \
+    --hash=sha256:6307a0da524939decb8ca4a3933b8ab62525794411d6984fca6726e732804af6 \
+    --hash=sha256:684fd492fff4fead00587544e059be2bbcb6f93454f21fa2a91b66fc7508be82 \
+    --hash=sha256:6b5b393eda5ea42cca1c1a6665f2a4882b4fd5d1777e41ce0545a107fb008c9d \
+    --hash=sha256:6b723eb406dec5bc9ec516c73ab9c3239a3284e017f7eb89ee2b3258bd504fb7 \
+    --hash=sha256:6b9bf3135b4ad5981df9a73d71a35272d650a2985ae9c2746357b24d59de2448 \
+    --hash=sha256:6beb738155fe8ab8091afdfa5a3226b21c2b1593f1e50ebb90eb25b44dbc0391 \
+    --hash=sha256:6c0dbbcc19735fe5f8b0a54c07659d154a9e69f47e15d0a6ab7299215daf62cb \
+    --hash=sha256:6cdc537c8633d7fd92a82e2e0d2ab74320a3f63d5e59fb9cf08711e08fe151c4 \
+    --hash=sha256:6eae33003518fd4cb4f83a218d5371469dd3001aa3b87128c005b07762f7fe5e \
+    --hash=sha256:740d0a99cf9de0b17a3943388e9294a59becf75e7c43421f387bd3c7a9901f7c \
+    --hash=sha256:75c38c50ab9aca840225d9a9a3810bf11d04bd5c1f186cabbb8aee56db3e9b15 \
+    --hash=sha256:761fdae6728ceb99ab182fad2f0cc1e262f610834dc891aea1d1a2a2e634776f \
+    --hash=sha256:7664419f27db41d4f1c43a78dccda7dd6e8ef2428df3ee01d0c2a07a6b071297 \
+    --hash=sha256:76d3af9732d2dab69f28179b40ba2d87e2f1d5824b4a694780aa787d685e8f36 \
+    --hash=sha256:78326f4cb4427a56ba4996c0762b63be45f06b85f086526420d2b3a66e40f84d \
+    --hash=sha256:7868b85224291c6cb6759f9b5adb9745f486d226f62b16a614dd5a2a5ab2b35b \
+    --hash=sha256:815d26356930846a40c7bc1366e7b1b0320ab8a063e66c11298a208bed0fd237 \
+    --hash=sha256:8171b44a054e5c67fd748ada04187f1250bf35b95f85e52ab64bcf3331a923bb \
+    --hash=sha256:821b2755db9194409254012f429c56643416fb96ef9be090be82ec8826b7f477 \
+    --hash=sha256:837c6b305e26fe0f75b15c92cf3b2ba29e0ae19dc40b1c557b026cb426347d0c \
+    --hash=sha256:839dde845559254f34885267c6878f60d61d5205180226d976fe488d45fa128e \
+    --hash=sha256:84a6ecc0c940169190d2c23bd969debd48c94dbc855acd60188a68d71d421608 \
+    --hash=sha256:8601470267d938bcb7f3ab1a336100af51a4fd5b6ed030ef52461bb3ef5e7e07 \
+    --hash=sha256:88b5268892fde430d5531f95bc560b6efbbd67c929662c586afd729a96e7461c \
+    --hash=sha256:8aa5dda18d39b6143eb24809d158f9252c88f402749b6f1b62a506cc7d96cc35 \
+    --hash=sha256:926bdd3e3b5998ddf70cc64bc8cf57209571f9044542913afb673799fec77dd0 \
+    --hash=sha256:96beca19ec79de272e8668585380ff9092c47077c1d7a1e098e00bbd921f4785 \
+    --hash=sha256:9a0460d43603d1fd9ef59c30278531e15d78581721ddb538fa560aa7817ea4ad \
+    --hash=sha256:a03d57b86d2a51d0a66c92177e2be154ad015f357791d306e714569999cdb4cc \
+    --hash=sha256:a36b70596407634ca82d4b989a3729074a008537a0522e4c8046a67c729103e9 \
+    --hash=sha256:a3a52a3ba86436ab3aef510fbe21512abc2ddd1993005dfe50514bd2284ef025 \
+    --hash=sha256:a3dbc5ed9514908d5046107d7b1346bde71eea61de6e0e4919c19354f97e769f \
+    --hash=sha256:a431156bb41865fc14cd5d79bb9d7bbed83110b0159e34e62ae30951f96c0009 \
+    --hash=sha256:a575404ebc9cf2e91edd32eaf570ec1430eb900d4f56724ba7dd4bc1fc9c176d \
+    --hash=sha256:a5cf77eb04f20b720be95265a3e00eb2a14814074255cc27069c551b2db53118 \
+    --hash=sha256:a8763f20692da7df39b0afdd1ba3042b004c50a45994f76c2d9a25641f7673db \
+    --hash=sha256:ab4b2fda7c2b542f7f9d886cc6a838c5079d2b76f72e6081411faba11adde2c9 \
+    --hash=sha256:addeda51556dac7c1a2f14cda62db8b621cd12afba3091d03a96c72932387eab \
+    --hash=sha256:b242c27c8f836305a4a72df9cdd564386ac57b807bd252a063223331c9316b37 \
+    --hash=sha256:b4f062343e7ad3fa94f2c66e5ae667dee47ee74dd41a9057c4fbe163236a123d \
+    --hash=sha256:b5b8b0753718d258fd454283fbd57e14545d3b40583fa672e27cb4f987626bcc \
+    --hash=sha256:be3e47e2d91aa3942ff9bf4077a505226005abfc39b6f7554a91c1b9393986b9 \
+    --hash=sha256:befc2d6a953e563f8a7bfd87a42c22ebf8a3e980dcb7b6a4d17b70b0e914e8a3 \
+    --hash=sha256:bf35d0568abda97233239ce32896d3ad53fccc537832c104e30c94aa5fb93569 \
+    --hash=sha256:c933c6678c6f116ff8af47a4c6db0868b8ace74af0343016c0ef00f00272ea69 \
+    --hash=sha256:c9d1aca01f49170fdcf5c92761b1fafe97f554b721ca4570c5949fff778f0d4b \
+    --hash=sha256:cdeaa99ce822dca76cfb1b993e9120c5ea212f2eb66d48950ad63c349668a018 \
+    --hash=sha256:ce4d4f52e2a4324396caddbd45a97d8d7be5f42edd25d2355282a9c34f9b2f7f \
+    --hash=sha256:d1028417bb44037eb3069c1009bd7b7277212876cda22fbe565b0bca9fab6d2c \
+    --hash=sha256:d151e148117294133bf8af7eeace085e7e87432db15ab6adf640330298a47f6f \
+    --hash=sha256:d7841166b7fa64c9c56404617ae4341448847482d45933b13135d26c130519e5 \
+    --hash=sha256:d7fca4eb6df565e2a928f1c7dad92d27db8f9df0f449e76423ed5d7e713ed445 \
+    --hash=sha256:d95a354e02393eada6d7351184671aced9d4cce109dabf927cb7aa99624352a1 \
+    --hash=sha256:d9edf30457d74eebfd76b045535e36f1cd89062566a128a0db2145ca042d787e \
+    --hash=sha256:dbc2673f9223d420c91145599b3ba45a8a50c207d1976908e5fb5ddb0c9b9429 \
+    --hash=sha256:e01b3c878c8641913e688edd1b3f08658c6783d29cf6b826bd3c0d1ae7a1ffaa \
+    --hash=sha256:e21c1429e205828ea886a2293a4a2c8e01f4c25d9893ca330e97a6cf73f52e7b \
+    --hash=sha256:e43d4a1f673e8a1cbd8533e809e02b4bf9d4f2280269bb640436556312121250 \
+    --hash=sha256:e6d198bad4e49dd6732fbd636e2fc5c082f45c8cad0b4acb756b00c82c76072e \
+    --hash=sha256:e6ea1cda8d8c688278430e4268a42f5e5da3bdd74578dfadc0820c3f1766ce83 \
+    --hash=sha256:ea394a937f17a54c51239348bdbe2e3518124c8d4a8951ba04a311d3095bd18f \
+    --hash=sha256:eac2f5dbafd585dfe31f86a23ebf0d3ba480a9d49ebc87947267b5608d4ea0cd \
+    --hash=sha256:eb61be926bb81567c1f48bdc8aa22b9855048dc2efd53871f9f7e6e9a5632346 \
+    --hash=sha256:eba5d173f7d5708b22a93815017a4611873ed54db9f268077c0dd1ed99cfc858 \
+    --hash=sha256:ec450527cbf485e13c8d3602a54f428ab0432fdade0ede75efd74b735421c871 \
+    --hash=sha256:eef6a03b0b6d08d0835ccfa8ec8d1bc70525e3801387567137b50c557695e6da \
+    --hash=sha256:ef0d8c843e2827d6c120ab4687e9423fb1d893db1df27b7c1506615bcb9734a0 \
+    --hash=sha256:ef6b65b03247c54692ad4fd9ee97cb772781927db72e3cb05e70b3db6d1ff14f \
+    --hash=sha256:f3d6ed6a98cfd19155996605474982cc470d7601746a6439078f1a5a3fa8b050 \
+    --hash=sha256:fce4b85234a0cbad67bf8e6e1201ee815d172c9aebad75f25645bc4d834f8e31 \
+    --hash=sha256:fda1d96e542c37b6c804547dbf489c129fe7c97183a76a5ec275909ba1a063df \
+    --hash=sha256:fdcd198979b4ecffcc1beba366a7fbcf4eb41243691a82fe52ceb0b902f09c12 \
+    --hash=sha256:fe5ad0664ec772b02c45859041aa17655709cced7a31005817fbbbd988c25567
+    # via
+    #   jsonschema
+    #   referencing
+ruamel-yaml==0.19.1 \
+    --hash=sha256:27592957fedf6e0b62f281e96effd28043345e0e66001f97683aa9a40c667c93 \
+    --hash=sha256:53eb66cd27849eff968ebf8f0bf61f46cdac2da1d1f3576dd4ccee9b25c31993
+    # via ansible-lint
+subprocess-tee==0.4.2 \
+    --hash=sha256:21942e976715af4a19a526918adb03a8a27a8edab959f2d075b777e3d78f532d \
+    --hash=sha256:91b2b4da3aae9a7088d84acaf2ea0abee3f4fd9c0d2eae69a9b9122a71476590
+    # via
+    #   ansible-compat
+    #   ansible-lint
+typing-extensions==4.16.0 ; python_full_version < '3.13' \
+    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
+    --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
+    # via referencing
+wcmatch==11.0.1 \
+    --hash=sha256:1ea2b4fa678b8ca268253798d5963935df39132d47c3e241c0a0732224005e7d \
+    --hash=sha256:fd149ecddb9f0a88ea780017d6dde17c994e494e7f7303d4e3c9d6251f978f4b
+    # via ansible-lint
+yamllint==1.38.0 \
+    --hash=sha256:09e5f29531daab93366bb061e76019d5e91691ef0a40328f04c927387d1d364d \
+    --hash=sha256:fc394a5b3be980a4062607b8fdddc0843f4fa394152b6da21722f5d59013c220
+    # via ansible-lint
diff --git a/tests/ansible/site.yml b/tests/ansible/site.yml
new file mode 100644
index 0000000..142e991
--- /dev/null
+++ b/tests/ansible/site.yml
@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+---
+# Test playbook of tests/integration/ansible.sh: the role vectode.lss.lss on a systemd container, with the test
+# release directory and its signer passed to bootstrap.sh through the environment.
+- name: Set up the test server with lss
+  hosts: all
+  gather_facts: false
+  environment:
+    LSS_RELEASE_URL: file:///srv/release
+    LSS_RELEASE_WORKFLOW: "{{ lookup('ansible.builtin.env', 'LSS_RELEASE_WORKFLOW') }}"
+    LSS_RELEASE_REF: "{{ lookup('ansible.builtin.env', 'LSS_RELEASE_REF') }}"
+  roles:
+    - role: vectode.lss.lss
+      vars:
+        lss_modules: "{{ test_modules | default(['tools']) }}"
+        lss_modules_absent: "{{ test_modules_absent | default([]) }}"
+        lss_settings:
+          LSS_SYSTEM_HOSTNAME: lss-test
+          LSS_SYSTEM_UPGRADE: false
+          LSS_TIME_TIMEZONE: Europe/Berlin
+          LSS_TOOLS_EXTRA: tree
diff --git a/tests/integration/ansible.sh b/tests/integration/ansible.sh
new file mode 100755
index 0000000..c24b17e
--- /dev/null
+++ b/tests/integration/ansible.sh
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# Integration test of the Ansible collection: tests/integration/ansible.sh SYSTEM RELEASE_DIR VERSION_A VERSION_B
+#
+# RELEASE_DIR holds two attested test releases (see update.sh); the collection of VERSION_A must be installed for
+# ansible-playbook (ANSIBLE_COLLECTIONS_PATH). Over SSH into a systemd container, tests/ansible/site.yml installs lss A
+# with the role vectode.lss.lss and the module tools, runs again without a change, updates lss to B through the
+# role, removes tools in check mode (nothing changes) and for real.
+set -Eeuo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/../.."
+
+SYSTEM=${1:?usage: ansible.sh SYSTEM RELEASE_DIR VERSION_A VERSION_B}
+RELEASE_DIR=$(cd "${2:?usage: ansible.sh SYSTEM RELEASE_DIR VERSION_A VERSION_B}" && pwd)
+A=${3:?usage: ansible.sh SYSTEM RELEASE_DIR VERSION_A VERSION_B}
+B=${4:?usage: ansible.sh SYSTEM RELEASE_DIR VERSION_A VERSION_B}
+: "${LSS_RELEASE_WORKFLOW:?the workflow file that signed the test releases}" "${LSS_RELEASE_REF:?its git ref}"
+export LSS_RELEASE_WORKFLOW LSS_RELEASE_REF
+# shellcheck source=tests/integration/target.sh
+source tests/integration/target.sh
+work=$(mktemp -d)
+
+# play NAME EXPECTED_CHANGED [ansible-playbook options...]: runs the test playbook and checks the number of changed
+# tasks in the recap ("any" for at least one).
+play() {
+	local name=$1 expected=$2 changed
+	shift 2
+	group_start "${SYSTEM}: ${name}"
+	ansible-playbook -i "${work}/inventory" tests/ansible/site.yml "$@" | tee "${work}/play.log"
+	changed=$(sed -nE 's/.*changed=([0-9]+) +unreachable=0 +failed=0 .*/\1/p' "${work}/play.log")
+	group_end
+	if [[ -z ${changed} ]] || { [[ ${expected} == any ]] && ((changed == 0)); } ||
+		{ [[ ${expected} != any ]] && ((changed != expected)); }; then
+		echo "${name}: expected ${expected} changed tasks, the recap says '${changed:-failed}'." >&2
+		exit 1
+	fi
+	return
+}
+
+trap 'status=$?; rm -rf -- "${work}"; target_stop "${status}"' EXIT
+target_start
+
+# Python for Ansible and an SSH login for root with a key of this run, as on a fresh cloud server.
+ssh-keygen -q -t ed25519 -N '' -f "${work}/id_ed25519"
+in_target "set -e
+	if command -v apt-get >/dev/null; then
+		apt-get -qq update && DEBIAN_FRONTEND=noninteractive apt-get -qq install -y --no-install-recommends python3 >/dev/null
+	else
+		dnf -y -q install python3 >/dev/null
+	fi
+	install -d -m 0700 /root/.ssh
+	cat >/root/.ssh/authorized_keys
+	chmod 0600 /root/.ssh/authorized_keys
+	systemctl enable --now ssh 2>/dev/null || systemctl enable --now sshd" <"${work}/id_ed25519.pub"
+address=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "${TARGET_CONTAINER}")
+cat >"${work}/inventory" <<EOF
+[target]
+${address} ansible_user=root ansible_ssh_private_key_file=${work}/id_ed25519 ansible_python_interpreter=/usr/bin/python3 ansible_ssh_common_args='-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null'
+EOF
+export ANSIBLE_HOST_KEY_CHECKING=False ANSIBLE_NOCOLOR=1 ANSIBLE_FORCE_COLOR=0
+
+ssh_works() {
+	ssh -q -i "${work}/id_ed25519" -o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+		-o ConnectTimeout=10 "root@${address}" true
+	return
+}
+
+# The PAM account stack of the minimal rocky-9 image denies root ("Access denied for user root by PAM account
+# configuration"), which is a property of the container image, not of lss. Where that happens, show the stack and let
+# sshd skip PAM for the test, with the password of root set to "*" (no password, but the account is not locked).
+if ! ssh_works; then
+	in_target "ls -l /etc/pam.d/sshd /etc/pam.d/password-auth; grep -v '^#' /etc/pam.d/sshd
+		grep '^account' /etc/pam.d/password-auth; getent shadow root | cut -d: -f1,3-"
+	in_target "set -e
+		printf 'UsePAM no\n' >/etc/ssh/sshd_config.d/00-lss-test.conf
+		usermod -p '*' root
+		systemctl restart sshd"
+	ssh_works
+fi
+
+play "install lss ${A} and tools" any -e "lss_version=${A}"
+in_target "[[ \$(lss version) == 'lss ${A}' ]] && lss status | grep -E '^tools +installed'"
+play "the same again changes nothing" 0 -e "lss_version=${A}"
+play "update lss to ${B}" any -e "lss_version=${B}"
+in_target "[[ \$(lss version) == 'lss ${B}' && \$(readlink /opt/lss/previous) == '${A}' ]]"
+play "remove tools in check mode" any -e "lss_version=${B}" -e '{"test_modules": [], "test_modules_absent": ["tools"]}' --check
+in_target "lss status | grep -E '^tools +installed'"
+play "remove tools" any -e "lss_version=${B}" -e '{"test_modules": [], "test_modules_absent": ["tools"]}'
+in_target "! lss status | grep -E '^tools '"
+echo "${SYSTEM}: Ansible collection passed"
diff --git a/tests/integration/target.sh b/tests/integration/target.sh
new file mode 100644
index 0000000..06eb503
--- /dev/null
+++ b/tests/integration/target.sh
@@ -0,0 +1,55 @@
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# A systemd test container with a release directory, for tests/integration/update.sh and ansible.sh. Sourced; the
+# caller sets SYSTEM (a directory in tests/integration/images) and RELEASE_DIR (mounted read-only at /srv/release).
+
+TARGET_CONTAINER="lss-release-${SYSTEM}"
+
+group_start() {
+	echo "::group::$1"
+	return
+}
+
+group_end() {
+	echo "::endgroup::"
+	return
+}
+
+# in_target SCRIPT: runs a script as root in the container, with the release settings of the test.
+in_target() {
+	local script=$1
+	docker exec -i -e LSS_RELEASE_URL=file:///srv/release -e LSS_RELEASE_WORKFLOW -e LSS_RELEASE_REF \
+		"${TARGET_CONTAINER}" bash -c "${script}"
+	return
+}
+
+target_start() {
+	[[ -d tests/integration/images/${SYSTEM} ]] || {
+		echo "Unknown system ${SYSTEM}" >&2
+		exit 2
+	}
+	docker build -q -f "tests/integration/images/${SYSTEM}/Containerfile" -t "lss-test:${SYSTEM}" \
+		"tests/integration/images/${SYSTEM}" >/dev/null
+	docker rm -f "${TARGET_CONTAINER}" >/dev/null 2>&1 || true
+	docker run -d --name "${TARGET_CONTAINER}" --hostname lss-test --privileged --cgroupns=host \
+		-v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock --tmpfs /tmp:exec \
+		-v "${RELEASE_DIR}:/srv/release:ro" "lss-test:${SYSTEM}" >/dev/null
+	in_target 'for i in $(seq 60); do s=$(systemctl is-system-running 2>/dev/null || true); [[ $s == running || $s == degraded ]] && exit 0; sleep 1; done; exit 1'
+	return
+}
+
+# target_stop [STATUS]: removes the container, with diagnostics first when STATUS (default: $?) is not 0; exits with
+# STATUS. Pass the status from an EXIT trap: under set -e, "(exit N)" there would end the trap before this runs.
+target_stop() {
+	local status=${1:-$?}
+	set +e
+	if [[ ${status} -ne 0 ]]; then
+		echo "Diagnostics (exit status ${status}):"
+		in_target 'ls -la /opt/lss /usr/local/sbin 2>&1; tail -n 80 /var/log/lss/*.log 2>/dev/null
+			journalctl -t lss -n 60 --no-pager; journalctl -u ssh -u sshd -n 40 --no-pager' </dev/null
+	fi
+	docker rm -f "${TARGET_CONTAINER}" >/dev/null 2>&1
+	exit "${status}"
+}
diff --git a/tests/integration/update.sh b/tests/integration/update.sh
new file mode 100755
index 0000000..4cf1815
--- /dev/null
+++ b/tests/integration/update.sh
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# Integration test of bootstrap.sh and `lss update`: tests/integration/update.sh SYSTEM RELEASE_DIR VERSION_A VERSION_B
+#
+# RELEASE_DIR holds two test releases built by scripts/release/build.sh and attested by the CI workflow, in the
+# layout of GitHub releases (download/vVERSION/..., latest/download/SHA256SUMS). LSS_RELEASE_WORKFLOW and
+# LSS_RELEASE_REF name the workflow run that signed them. In a systemd container: install A with bootstrap.sh, update
+# to the latest (B), roll back, update and downgrade by version, and refuse a release whose attestation does not
+# match, one whose checksum does not match, one signed by another workflow and a rollback to a changed version.
+set -Eeuo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/../.."
+
+SYSTEM=${1:?usage: update.sh SYSTEM RELEASE_DIR VERSION_A VERSION_B}
+source_dir=${2:?usage: update.sh SYSTEM RELEASE_DIR VERSION_A VERSION_B}
+A=${3:?usage: update.sh SYSTEM RELEASE_DIR VERSION_A VERSION_B}
+B=${4:?usage: update.sh SYSTEM RELEASE_DIR VERSION_A VERSION_B}
+: "${LSS_RELEASE_WORKFLOW:?the workflow file that signed the test releases}" "${LSS_RELEASE_REF:?its git ref}"
+export LSS_RELEASE_WORKFLOW LSS_RELEASE_REF
+RELEASE_DIR=$(mktemp -d)
+# shellcheck source=tests/integration/target.sh
+source tests/integration/target.sh
+
+# Two broken copies of B: C has a changed archive with a matching SHA256SUMS (its attestation cannot match), D a
+# SHA256SUMS that lists another checksum for an archive that is otherwise genuine.
+C=${B}.tampered
+D=${B}.badsum
+cp -R "${source_dir}/." "${RELEASE_DIR}/"
+chmod -R a+rX "${RELEASE_DIR}"
+for version in "${C}" "${D}"; do
+	dir="${RELEASE_DIR}/download/v${version}"
+	mkdir -p "${dir}"
+	cp "${RELEASE_DIR}/download/v${B}/lss-${B}.tar.gz" "${dir}/lss-${version}.tar.gz"
+	cp "${RELEASE_DIR}/download/v${B}/lss-${B}.intoto.jsonl" "${dir}/lss-${version}.intoto.jsonl"
+done
+printf '\0' >>"${RELEASE_DIR}/download/v${C}/lss-${C}.tar.gz"
+(cd "${RELEASE_DIR}/download/v${C}" && sha256sum "lss-${C}.tar.gz" >SHA256SUMS)
+printf '%064d  lss-%s.tar.gz\n' 0 "${D}" >"${RELEASE_DIR}/download/v${D}/SHA256SUMS"
+
+# expect_active VERSION [PREVIOUS]: the links and the command point where they should, and lss answers.
+expect_active() {
+	local version=$1 previous=${2:-}
+	in_target "set -e
+		[[ \$(readlink /opt/lss/current) == '${version}' ]] || { echo \"current is \$(readlink /opt/lss/current), expected ${version}\"; exit 1; }
+		[[ -z '${previous}' || \$(readlink /opt/lss/previous) == '${previous}' ]] || { echo \"previous is \$(readlink /opt/lss/previous)\"; exit 1; }
+		[[ \$(readlink /usr/local/sbin/lss) == /opt/lss/current/lss ]]
+		[[ \$(lss version) == 'lss ${version}' ]]
+		[[ -z \$(find /opt/lss/${version} -perm /022 ! -type l) && \$(stat -c %U /opt/lss/${version}/lss) == root ]] || { echo 'writable or foreign files'; exit 1; }
+		ls /opt/lss"
+	return
+}
+
+# expect_refused COMMAND MESSAGE: the command fails with the message, and nothing changed.
+expect_refused() {
+	local command=$1 message=$2 output
+	if output=$(in_target "${command}" 2>&1); then
+		printf '%s\n' "${output}"
+		echo "'${command}' should have been refused." >&2
+		exit 1
+	fi
+	printf '%s\n' "${output}"
+	grep -qF -- "${message}" <<<"${output}" || {
+		echo "'${command}' failed without '${message}'." >&2
+		exit 1
+	}
+	return
+}
+
+# target_stop reads the exit status of the test, so the cleanup before it passes the status on.
+trap 'status=$?; rm -rf -- "${RELEASE_DIR}"; target_stop "${status}"' EXIT
+target_start
+
+group_start "${SYSTEM}: bootstrap.sh installs ${A}"
+in_target "bash /srv/release/download/v${A}/bootstrap.sh ${A}"
+expect_active "${A}"
+in_target "bash /srv/release/download/v${A}/bootstrap.sh ${A} 2>&1 | tee /dev/stderr | grep -q 'is installed and active'"
+group_end
+
+group_start "${SYSTEM}: lss update to the latest release"
+in_target 'lss --yes --dry-run update'
+expect_active "${A}"
+in_target 'lss --yes update'
+expect_active "${B}" "${A}"
+in_target 'lss --no-color list >/dev/null && lss --yes --no-color verify && lss --yes --dry-run install tools'
+group_end
+
+group_start "${SYSTEM}: rollback, update and downgrade by version"
+in_target 'lss --yes update --rollback'
+expect_active "${A}" "${B}"
+in_target "lss --yes update ${B}"
+expect_active "${B}" "${A}"
+in_target "lss --yes update ${A}"
+expect_active "${A}" "${B}"
+group_end
+
+group_start "${SYSTEM}: refused releases"
+expect_refused "lss --yes update ${C}" 'does not verify'
+expect_refused "lss --yes update ${D}" 'Checksum mismatch'
+expect_refused "LSS_RELEASE_WORKFLOW=release.yml lss --yes update ${B}" 'does not verify'
+expect_active "${A}" "${B}"
+in_target "[[ ! -e /opt/lss/${C} && ! -e /opt/lss/${D} ]]"
+in_target "echo '# changed' >>/opt/lss/${B}/lss"
+expect_refused 'lss --yes update --rollback' 'changed after it was installed'
+expect_active "${A}" "${B}"
+group_end
+
+group_start "${SYSTEM}: a fresh copy replaces a changed version"
+in_target 'lss --yes update'
+expect_active "${B}" "${A}"
+group_end
+echo "${SYSTEM}: bootstrap and update passed"
diff --git a/tests/unit/bootstrap.bats b/tests/unit/bootstrap.bats
new file mode 100644
index 0000000..6b6e64b
--- /dev/null
+++ b/tests/unit/bootstrap.bats
@@ -0,0 +1,345 @@
+#!/usr/bin/env bats
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# bootstrap.sh: versions, checksums, attestation arguments, the installed layout, update, rollback and pruning. The
+# releases here are small fake archives in a file:// release directory; downloading the GitHub CLI is replaced by a
+# stub that accepts or refuses every attestation and records its arguments.
+
+setup() {
+	bats_require_minimum_version 1.5.0
+	REPO_ROOT=$(cd "${BATS_TEST_DIRNAME}/../.." && pwd)
+	export LSS_JOURNAL=0
+	export LSS_PREFIX=${BATS_TEST_TMPDIR}/opt/lss
+	export LSS_BIN_LINK=${BATS_TEST_TMPDIR}/sbin/lss
+	export LSS_LOCK=${BATS_TEST_TMPDIR}/lss.lock
+	RELEASES=${BATS_TEST_TMPDIR}/releases
+	export LSS_RELEASE_URL=file://${RELEASES}
+	export GH_LOG=${BATS_TEST_TMPDIR}/gh.log
+	export GH_EXIT=0
+	WORK=${BATS_TEST_TMPDIR}/work
+	mkdir -p "${WORK}" "${RELEASES}"
+	# shellcheck source=bootstrap.sh
+	source "${REPO_ROOT}/bootstrap.sh"
+	# bootstrap.sh turns on nounset for itself; bats needs it off.
+	set +u
+	# The pinned GitHub CLI is replaced by a stub; bs_fetch reads file:// URLs without curl.
+	# shellcheck disable=SC2329 # called by bs_download
+	bs_fetch_gh() {
+		mkdir -p "$1/gh"
+		printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$*" >>"${GH_LOG}"\nexit "${GH_EXIT}"\n' >"$1/gh/gh"
+		chmod +x "$1/gh/gh"
+		printf '%s' "$1/gh/gh"
+		return
+	}
+	# shellcheck disable=SC2329 # called by bs_download and bs_latest_version
+	bs_fetch() {
+		[[ $1 == file://* ]] || bs_die "Refusing $1: releases are downloaded over HTTPS."
+		cp -- "${1#file://}" "$2" 2>/dev/null || bs_die "Download failed: $1"
+		return
+	}
+	return
+}
+
+# make_release VERSION [ANSWER]: a release directory with an archive whose lss answers "lss VERSION" (or ANSWER).
+make_release() {
+	local version=$1 answer=${2:-lss $1} tree dir
+	tree=${BATS_TEST_TMPDIR}/build/lss-${version}
+	dir=${RELEASES}/download/v${version}
+	mkdir -p "${tree}" "${dir}"
+	printf '#!/usr/bin/env bash\necho "%s"\n' "${answer}" >"${tree}/lss"
+	printf '#!/usr/bin/env bash\n' >"${tree}/bootstrap.sh"
+	printf '%s\n' "${version}" >"${tree}/VERSION"
+	tar -czf "${dir}/lss-${version}.tar.gz" -C "${BATS_TEST_TMPDIR}/build" "lss-${version}"
+	(cd "${dir}" && sha256sum "lss-${version}.tar.gz" >SHA256SUMS)
+	printf '{}\n' >"${dir}/lss-${version}.intoto.jsonl"
+	mkdir -p "${RELEASES}/latest/download"
+	cp "${dir}/SHA256SUMS" "${RELEASES}/latest/download/SHA256SUMS"
+	return
+}
+
+active() {
+	readlink "${LSS_PREFIX}/current"
+	return
+}
+
+# --- versions -----------------------------------------------------------------------------------------------------
+
+@test "versions are compared by SemVer precedence" {
+	local pair
+	for pair in "2.0.1 2.0.0 1" "2.0.0 2.0.1 -1" "2.10.0 2.9.9 1" "2.0.0 2.0.0 0" "2.0.0 2.0.0-rc.1 1" \
+		"2.0.0-rc.1 2.0.0 -1" "2.0.0-rc.2 2.0.0-rc.10 -1" "2.0.0-rc.1 2.0.0-beta 1" "2.0.0-alpha 2.0.0-alpha.1 -1" \
+		"2.0.0-1 2.0.0-alpha -1" "2.0.0-ci.2 2.0.0-ci.1 1" "3.0.0 10.0.0 -1"; do
+		read -r a b expected <<<"${pair}"
+		[ "$(bs_version_cmp "${a}" "${b}")" = "${expected}" ] || {
+			echo "${a} vs ${b}: $(bs_version_cmp "${a}" "${b}"), expected ${expected}"
+			return 1
+		}
+	done
+}
+
+@test "only release versions are accepted" {
+	bs_valid_version 2.0.1
+	bs_valid_version 2.0.0-rc.1
+	run ! bs_valid_version v2.0.1
+	run ! bs_valid_version 2.0
+	run ! bs_valid_version '2.0.1; rm -rf /'
+	run ! bs_valid_version ../2.0.1
+}
+
+# --- checks -------------------------------------------------------------------------------------------------------
+
+@test "the checksum of the archive must match SHA256SUMS" {
+	printf 'release\n' >"${WORK}/lss-1.0.0.tar.gz"
+	(cd "${WORK}" && sha256sum lss-1.0.0.tar.gz >SHA256SUMS)
+	bs_check_sum "${WORK}/lss-1.0.0.tar.gz" "${WORK}/SHA256SUMS"
+	printf 'changed\n' >"${WORK}/lss-1.0.0.tar.gz"
+	run bs_check_sum "${WORK}/lss-1.0.0.tar.gz" "${WORK}/SHA256SUMS"
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"Checksum mismatch for lss-1.0.0.tar.gz"* ]]
+	printf '%064d *other.tar.gz\n' 0 >"${WORK}/SHA256SUMS"
+	run bs_check_sum "${WORK}/lss-1.0.0.tar.gz" "${WORK}/SHA256SUMS"
+	[[ ${output} == *"lists lss-1.0.0.tar.gz without a SHA-256"* ]]
+}
+
+@test "downloads use HTTPS or a local release directory" {
+	source "${REPO_ROOT}/bootstrap.sh"
+	run bs_fetch http://example.com/lss.tar.gz "${WORK}/x"
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"Refusing http://example.com/lss.tar.gz"* ]]
+	run bs_fetch ftp://example.com/lss.tar.gz "${WORK}/x"
+	[ "${status}" -eq 1 ]
+}
+
+@test "the GitHub CLI is used only with its pinned checksum" {
+	source "${REPO_ROOT}/bootstrap.sh"
+	bs_fetch() {
+		printf 'not the GitHub CLI' >"$2"
+		return
+	}
+	run bs_fetch_gh "${WORK}"
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"Checksum mismatch for the GitHub CLI ${BS_GH_VERSION}"* ]]
+	[[ ${BS_GH_SHA256_AMD64} =~ ^[0-9a-f]{64}$ && ${BS_GH_SHA256_ARM64} =~ ^[0-9a-f]{64}$ ]]
+}
+
+@test "releases must be signed by the release workflow on main" {
+	[ "$(bs_signer)" = "https://github.com/VectoDE/Linux-Server-Setup-Script/.github/workflows/release.yml@refs/heads/main" ]
+	LSS_RELEASE_WORKFLOW=distribution.yml LSS_RELEASE_REF=refs/pull/12/merge
+	[ "$(bs_signer)" = "https://github.com/VectoDE/Linux-Server-Setup-Script/.github/workflows/distribution.yml@refs/pull/12/merge" ]
+	LSS_RELEASE_WORKFLOW='../other/repo/x.yml' run bs_signer
+	[ "${status}" -eq 1 ]
+	LSS_RELEASE_REF='refs/heads/../x' run bs_signer
+	[ "${status}" -eq 1 ]
+}
+
+@test "the attestation is checked for the repository, workflow, ref and hosted runners" {
+	make_release 1.0.0
+	bs_download 1.0.0 "${WORK}" >/dev/null
+	[ "$(grep -c . "${GH_LOG}")" -eq 2 ]
+	grep -q "attestation verify ${WORK}/SHA256SUMS --bundle ${WORK}/lss-1.0.0.intoto.jsonl" "${GH_LOG}"
+	grep -q "attestation verify ${WORK}/lss-1.0.0.tar.gz --bundle" "${GH_LOG}"
+	grep -q -- "--repo VectoDE/Linux-Server-Setup-Script --cert-identity https://github.com/VectoDE/Linux-Server-Setup-Script/.github/workflows/release.yml@refs/heads/main --source-ref refs/heads/main --deny-self-hosted-runners" "${GH_LOG}"
+}
+
+# --- install, update, rollback -----------------------------------------------------------------------------------
+
+@test "the latest release is installed with links, a file list and no writable files" {
+	make_release 1.0.0
+	run bs_install '' "${WORK}"
+	[ "${status}" -eq 0 ]
+	[[ ${output} == *"lss 1.0.0: checksum and build attestation verified"* ]]
+	[[ ${output} == *"lss 1.0.0 is installed"* ]]
+	[ "$(active)" = 1.0.0 ]
+	[ ! -e "${LSS_PREFIX}/previous" ]
+	[ "$(readlink "${LSS_BIN_LINK}")" = "${LSS_PREFIX}/current/lss" ]
+	[ "$("${LSS_BIN_LINK}" version)" = "lss 1.0.0" ]
+	grep -q ' ./lss$' "${LSS_PREFIX}/1.0.0/.lss-manifest"
+	[ -z "$(find "${LSS_PREFIX}/1.0.0" -perm /022 ! -type l)" ]
+	[ -z "$(find "${LSS_PREFIX}" -maxdepth 1 -name '.stage-*')" ]
+}
+
+@test "the active version is not downloaded again" {
+	make_release 1.0.0
+	bs_install 1.0.0 "${WORK}"
+	: >"${GH_LOG}"
+	run bs_install v1.0.0 "${WORK}"
+	[[ ${output} == *"lss 1.0.0 is installed and active."* ]]
+	[ ! -s "${GH_LOG}" ]
+}
+
+@test "an update keeps the version before it, a third version removes the oldest" {
+	make_release 1.0.0
+	bs_install '' "${WORK}"
+	make_release 1.1.0
+	run bs_install '' "${WORK}"
+	[[ ${output} == *"lss 1.1.0 is active (was 1.0.0"* ]]
+	[ "$(active)" = 1.1.0 ]
+	[ "$(readlink "${LSS_PREFIX}/previous")" = 1.0.0 ]
+	make_release 1.2.0
+	bs_install 1.2.0 "${WORK}"
+	[ "$(active)" = 1.2.0 ]
+	[ "$(readlink "${LSS_PREFIX}/previous")" = 1.1.0 ]
+	[ ! -e "${LSS_PREFIX}/1.0.0" ]
+}
+
+@test "other directories in the prefix survive the pruning" {
+	mkdir -p "${LSS_PREFIX}/pgadmin" "${LSS_PREFIX}/.stage-0.9.0.abc"
+	make_release 1.0.0
+	bs_install '' "${WORK}"
+	[ -d "${LSS_PREFIX}/pgadmin" ]
+	[ ! -e "${LSS_PREFIX}/.stage-0.9.0.abc" ]
+}
+
+@test "lss update without a version never goes back" {
+	make_release 1.0.0
+	make_release 1.1.0
+	bs_install 1.1.0 "${WORK}"
+	cp "${RELEASES}/download/v1.0.0/SHA256SUMS" "${RELEASES}/latest/download/SHA256SUMS"
+	run bs_install '' "${WORK}"
+	[[ ${output} == *"lss 1.1.0 is newer than the latest release 1.0.0 and stays active."* ]]
+	[ "$(active)" = 1.1.0 ]
+}
+
+@test "a named older version is a downgrade with a warning" {
+	make_release 1.0.0
+	make_release 1.1.0
+	bs_install 1.1.0 "${WORK}"
+	run bs_install 1.0.0 "${WORK}"
+	[ "${status}" -eq 0 ]
+	[[ ${output} == *"Going back from 1.1.0 to the older 1.0.0"* ]]
+	[ "$(active)" = 1.0.0 ]
+	[ "$(readlink "${LSS_PREFIX}/previous")" = 1.1.0 ]
+}
+
+@test "rollback switches to the previous version and back" {
+	make_release 1.0.0
+	make_release 1.1.0
+	bs_install 1.0.0 "${WORK}"
+	bs_install 1.1.0 "${WORK}"
+	run bs_rollback
+	[ "${status}" -eq 0 ]
+	[[ ${output} == *"lss 1.0.0 is active again (was 1.1.0"* ]]
+	[ "$(active)" = 1.0.0 ]
+	[ "$(readlink "${LSS_PREFIX}/previous")" = 1.1.0 ]
+	bs_rollback
+	[ "$(active)" = 1.1.0 ]
+}
+
+@test "rollback refuses a version whose files changed, and needs a version to go back to" {
+	make_release 1.0.0
+	bs_install 1.0.0 "${WORK}"
+	run bs_rollback
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"rollback needs the one before it"* ]]
+	make_release 1.1.0
+	bs_install 1.1.0 "${WORK}"
+	printf 'echo changed\n' >>"${LSS_PREFIX}/1.0.0/lss"
+	run bs_rollback
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"changed after it was installed"* ]]
+	[ "$(active)" = 1.1.0 ]
+}
+
+@test "a release whose attestation does not verify installs nothing" {
+	make_release 1.0.0
+	GH_EXIT=1 run bs_install '' "${WORK}"
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"The attestation of SHA256SUMS does not verify"* ]]
+	[[ ${output} == *"Nothing was installed."* ]]
+	[ ! -e "${LSS_PREFIX}/1.0.0" ]
+	[ ! -e "${LSS_PREFIX}/current" ]
+}
+
+@test "a changed archive is refused before its attestation is checked" {
+	make_release 1.0.0
+	printf '\0' >>"${RELEASES}/download/v1.0.0/lss-1.0.0.tar.gz"
+	run bs_install 1.0.0 "${WORK}"
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"Checksum mismatch for lss-1.0.0.tar.gz"* ]]
+	[ ! -s "${GH_LOG}" ]
+	[ ! -e "${LSS_PREFIX}/1.0.0" ]
+}
+
+@test "an archive with another version inside is refused" {
+	make_release 1.0.0
+	mv "${RELEASES}/download/v1.0.0" "${RELEASES}/download/v1.0.1"
+	mv "${RELEASES}/download/v1.0.1/lss-1.0.0.tar.gz" "${RELEASES}/download/v1.0.1/lss-1.0.1.tar.gz"
+	(cd "${RELEASES}/download/v1.0.1" && sha256sum lss-1.0.1.tar.gz >SHA256SUMS)
+	cp "${RELEASES}/download/v1.0.1/lss-1.0.0.intoto.jsonl" "${RELEASES}/download/v1.0.1/lss-1.0.1.intoto.jsonl"
+	run bs_install 1.0.1 "${WORK}"
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"holds no lss-1.0.1/ directory"* ]]
+	[ ! -e "${LSS_PREFIX}/1.0.1" ]
+}
+
+@test "a version that does not start leaves the active one in place" {
+	make_release 1.0.0
+	bs_install 1.0.0 "${WORK}"
+	make_release 1.1.0 'broken'
+	run bs_install 1.1.0 "${WORK}"
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"lss 1.1.0 does not start ('broken'); 1.0.0 stays active."* ]]
+	[ "$(active)" = 1.0.0 ]
+	[ ! -e "${LSS_PREFIX}/previous" ]
+}
+
+@test "a dry run verifies and changes nothing" {
+	make_release 1.0.0
+	LSS_DRY_RUN=1 run bs_install '' "${WORK}"
+	[ "${status}" -eq 0 ]
+	[[ ${output} == *"Dry run: lss 1.0.0 verified; nothing was changed."* ]]
+	[ ! -e "${LSS_PREFIX}/1.0.0" ]
+}
+
+@test "the latest version comes from the file list of the latest release" {
+	printf '%064d  lss-2.3.4.tar.gz\n%064d  vectode-lss-2.3.4.tar.gz\n%064d  bootstrap.sh\n' 1 2 3 \
+		>"${BATS_TEST_TMPDIR}/sums"
+	mkdir -p "${RELEASES}/latest/download"
+	cp "${BATS_TEST_TMPDIR}/sums" "${RELEASES}/latest/download/SHA256SUMS"
+	[ "$(bs_latest_version "${WORK}")" = 2.3.4 ]
+	printf '%064d  other.tar.gz\n' 1 >"${RELEASES}/latest/download/SHA256SUMS"
+	run bs_latest_version "${WORK}"
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"names its version unclearly"* ]]
+}
+
+@test "an lss checkout in the prefix must move first" {
+	mkdir -p "${LSS_PREFIX}"
+	: >"${LSS_PREFIX}/lss"
+	run bs_check_layout
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"holds an lss checkout"* ]]
+	rm "${LSS_PREFIX}/lss"
+	bs_check_layout
+}
+
+@test "arguments: one version, or --rollback alone" {
+	run bs_main 1.0.0 1.1.0
+	[[ ${output} == *"Name one version, not '1.0.0' and '1.1.0'."* ]]
+	run bs_main --rollback 1.0.0
+	[[ ${output} == *"--rollback goes back to the previous version"* ]]
+	run bs_main --bogus
+	[[ ${output} == *"Unknown option '--bogus'"* ]]
+	run bs_main --help
+	[ "${status}" -eq 0 ]
+	[[ ${output} == *"Usage: sudo bash bootstrap.sh"* ]]
+	run bs_install 'latest' "${WORK}"
+	[[ ${output} == *"'latest' is a version like 2.0.1."* ]]
+}
+
+@test "a second run gives up after a short wait: the lock is taken once" {
+	bs_lock
+	(
+		exec 9>&-
+		LSS_LOCK_HELD=0 run bs_lock
+		[ "${status}" -eq 1 ]
+		[[ ${output} == *"Another lss run is in progress."* ]]
+	)
+	LSS_LOCK_HELD=1 bs_lock
+}
+
+@test "bootstrap.sh output and errors never start with Not or No" {
+	run ! grep -nE 'bs_(info|ok|warn|die|log [A-Z]+) "(Not|No)[ t]' "${REPO_ROOT}/bootstrap.sh"
+}
diff --git a/tests/unit/release.bats b/tests/unit/release.bats
new file mode 100644
index 0000000..4d4371e
--- /dev/null
+++ b/tests/unit/release.bats
@@ -0,0 +1,176 @@
+#!/usr/bin/env bats
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# The release scripts: scripts/release/prepare.sh in a scratch repository, scripts/release/build.sh with a stub
+# ansible-galaxy, and the version that VERSION, the collection and the role must share.
+
+setup() {
+	bats_require_minimum_version 1.5.0
+	REPO_ROOT=$(cd "${BATS_TEST_DIRNAME}/../.." && pwd)
+	BIN=${BATS_TEST_TMPDIR}/bin
+	mkdir -p "${BIN}"
+	# Pull request labels come from the GitHub API; the stub answers with $LABELS for every commit.
+	printf '#!/usr/bin/env bash\n[[ -n ${LABELS:-} ]] || exit 1\nprintf "%%s\\n" ${LABELS}\n' >"${BIN}/gh"
+	chmod +x "${BIN}/gh"
+	export PATH="${BIN}:${PATH}" LABELS=''
+	return
+}
+
+# scratch_repo VERSION: a repository with the files prepare.sh changes, one tagged release and one commit after it.
+scratch_repo() {
+	command -v git >/dev/null || skip 'git is missing'
+	REPO=${BATS_TEST_TMPDIR}/repo
+	cd "${BATS_TEST_TMPDIR}" || return 1
+	rm -rf -- "${REPO}"
+	mkdir -p "${REPO}/scripts/release" "${REPO}/ansible/roles/lss/defaults"
+	cp "${REPO_ROOT}/scripts/release/prepare.sh" "${REPO}/scripts/release/"
+	cd "${REPO}" || return 1
+	git init -q
+	git config user.email test@example.com
+	git config user.name test
+	git config commit.gpgsign false
+	git config tag.gpgsign false
+	printf '%s\n' "$1" >VERSION
+	printf 'version: "%s"\n' "$1" >ansible/galaxy.yml
+	printf 'lss_version: "%s"\n' "$1" >ansible/roles/lss/defaults/main.yml
+	printf '# Changelog\n\n## Unreleased\n\n## [1.0.0] - 2025-01-01\n\n- First.\n\n[1.0.0]: https://example.com/1.0.0\n' >CHANGELOG.md
+	git add -A
+	git commit -qm 'Release 1.0.0'
+	git tag v1.0.0
+	return
+}
+
+commit() {
+	git commit -q --allow-empty -m "$1" ${2:+-m "$2"}
+	return
+}
+
+prepare() {
+	RELEASE_NOTES=${BATS_TEST_TMPDIR}/notes.md GITHUB_OUTPUT=${BATS_TEST_TMPDIR}/output bash scripts/release/prepare.sh
+	return
+}
+
+@test "a fix makes a patch release, with the commit subjects as notes" {
+	scratch_repo 1.0.0
+	commit 'fix(ssh): keep the port'
+	prepare
+	[ "$(cat VERSION)" = 1.0.1 ]
+	grep -qx 'version: "1.0.1"' ansible/galaxy.yml
+	grep -qx 'lss_version: "1.0.1"' ansible/roles/lss/defaults/main.yml
+	grep -qx 'release=true' "${BATS_TEST_TMPDIR}/output"
+	grep -qx 'tag=v1.0.1' "${BATS_TEST_TMPDIR}/output"
+	grep -qx -- '- fix(ssh): keep the port' "${BATS_TEST_TMPDIR}/notes.md"
+	grep -q '^## \[1.0.1\] - ' CHANGELOG.md
+	grep -qx '\[1.0.1\]: https://github.com/VectoDE/Linux-Server-Setup-Script/compare/v1.0.0...v1.0.1' CHANGELOG.md
+	[ "$(grep -c '^## Unreleased$' CHANGELOG.md)" -eq 1 ]
+}
+
+@test "features and labels raise the version step" {
+	scratch_repo 1.0.0
+	commit 'feat: new module'
+	prepare
+	[ "$(cat VERSION)" = 1.1.0 ]
+	scratch_repo 1.0.0
+	commit 'something'
+	LABELS='enhancement' prepare
+	[ "$(cat VERSION)" = 1.1.0 ]
+	scratch_repo 1.0.0
+	commit 'fix!: rename a setting'
+	prepare
+	[ "$(cat VERSION)" = 2.0.0 ]
+	scratch_repo 1.0.0
+	commit 'refactor' 'BREAKING CHANGE: the old name is gone'
+	prepare
+	[ "$(cat VERSION)" = 2.0.0 ]
+	scratch_repo 1.0.0
+	commit 'something'
+	LABELS='documentation breaking-change' prepare
+	[ "$(cat VERSION)" = 2.0.0 ]
+}
+
+@test "a pre-release VERSION is released as its version, with the written notes" {
+	scratch_repo 2.0.0-dev
+	sed -i 's/^## Unreleased$/## Unreleased\n\nVersion 2.0.0 is new.\n\n### Added\n\n- lss/' CHANGELOG.md
+	commit 'feat!: everything new'
+	prepare
+	[ "$(cat VERSION)" = 2.0.0 ]
+	[ "$(head -n 1 "${BATS_TEST_TMPDIR}/notes.md")" = 'Version 2.0.0 is new.' ]
+	grep -qx -- '- lss' "${BATS_TEST_TMPDIR}/notes.md"
+	# The written notes moved under the release; Unreleased is empty again.
+	[ "$(sed -n '/^## Unreleased$/,/^## \[2.0.0\]/p' CHANGELOG.md | grep -c .)" -eq 2 ]
+}
+
+@test "the requested step wins, [skip release] commits are left out" {
+	scratch_repo 1.0.0
+	commit 'fix: small'
+	RELEASE_BUMP=major prepare
+	[ "$(cat VERSION)" = 2.0.0 ]
+	scratch_repo 1.0.0
+	commit 'Release 1.0.1' '[skip release]'
+	run prepare
+	[[ ${output} == *"Since v1.0.0 there is nothing to release."* ]]
+	grep -qx 'release=false' "${BATS_TEST_TMPDIR}/output"
+	[ "$(cat VERSION)" = 1.0.0 ]
+	RELEASE_BUMP=huge run prepare
+	[ "${status}" -eq 2 ]
+}
+
+@test "a pre-release for a test of the release leaves the changelog alone" {
+	scratch_repo 2.0.0-dev
+	commit 'feat: new'
+	cp CHANGELOG.md "${BATS_TEST_TMPDIR}/before"
+	RELEASE_PRERELEASE=rc.1 prepare
+	[ "$(cat VERSION)" = 2.0.0-rc.1 ]
+	grep -qx 'tag=v2.0.0-rc.1' "${BATS_TEST_TMPDIR}/output"
+	cmp CHANGELOG.md "${BATS_TEST_TMPDIR}/before"
+	git commit -qam 'Release v2.0.0-rc.1' -m '[skip release]'
+	git tag v2.0.0-rc.1
+	commit 'fix: after the candidate'
+	prepare
+	[ "$(cat VERSION)" = 2.0.0 ]
+	grep -qx '\[2.0.0\]: https://github.com/VectoDE/Linux-Server-Setup-Script/compare/v2.0.0-rc.1...v2.0.0' CHANGELOG.md
+	RELEASE_PRERELEASE='rc 1' run prepare
+	[ "${status}" -eq 2 ]
+}
+
+@test "VERSION, the collection and the role default name the same version" {
+	local version
+	version=$(<"${REPO_ROOT}/VERSION")
+	grep -qx "version: \"${version}\"" "${REPO_ROOT}/ansible/galaxy.yml"
+	grep -qx "lss_version: \"${version}\"" "${REPO_ROOT}/ansible/roles/lss/defaults/main.yml"
+}
+
+@test "build.sh builds the archive, bootstrap.sh, the collection, the SBOM and SHA256SUMS" {
+	command -v jq >/dev/null || skip "jq is missing"
+	# ansible-galaxy stub: checks what the collection gets and packs it under the expected name.
+	cat >"${BIN}/ansible-galaxy" <<'EOF'
+#!/usr/bin/env bash
+dir=$3 out=$5
+grep -qx 'version: "9.9.9-test"' "${dir}/galaxy.yml" || exit 3
+grep -qx 'lss_version: "9.9.9-test"' "${dir}/roles/lss/defaults/main.yml" || exit 4
+cmp -s "${dir}/roles/lss/files/bootstrap.sh" "${REPO_ROOT}/bootstrap.sh" || exit 5
+tar -czf "${out}/vectode-lss-9.9.9-test.tar.gz" -C "${dir}" .
+EOF
+	chmod +x "${BIN}/ansible-galaxy"
+	export REPO_ROOT
+	local out=${BATS_TEST_TMPDIR}/dist
+	run bash "${REPO_ROOT}/scripts/release/build.sh" --version 9.9.9-test "${out}"
+	[ "${status}" -eq 0 ]
+	(cd "${out}" && sha256sum --strict -c SHA256SUMS)
+	[ "$(awk '{ print $2 }' "${out}/SHA256SUMS" | tr '\n' ' ')" = 'lss-9.9.9-test.tar.gz bootstrap.sh vectode-lss-9.9.9-test.tar.gz lss-9.9.9-test.cdx.json ' ]
+	[ "$(tar -xzOf "${out}/lss-9.9.9-test.tar.gz" lss-9.9.9-test/VERSION)" = 9.9.9-test ]
+	tar -tzf "${out}/lss-9.9.9-test.tar.gz" | grep -qx 'lss-9.9.9-test/lss'
+	tar -tzf "${out}/lss-9.9.9-test.tar.gz" | grep -qx 'lss-9.9.9-test/bootstrap.sh'
+	tar -tzf "${out}/lss-9.9.9-test.tar.gz" >"${BATS_TEST_TMPDIR}/files"
+	run ! grep -qE '^lss-9.9.9-test/(tests|\.github|ansible)/' "${BATS_TEST_TMPDIR}/files"
+	jq -e '.bomFormat == "CycloneDX" and .metadata.component.version == "9.9.9-test"' "${out}/lss-9.9.9-test.cdx.json"
+	jq -e '[.components[] | select(.name == "gh")] | length == 2' "${out}/lss-9.9.9-test.cdx.json"
+	jq -e '[.components[] | select(.type == "file")] | length > 10' "${out}/lss-9.9.9-test.cdx.json"
+	jq -e '[.components[].hashes[].content | test("^[0-9a-f]{64}$")] | all' "${out}/lss-9.9.9-test.cdx.json"
+	# The same commit gives the same archive.
+	sum=$(sha256sum "${out}/lss-9.9.9-test.tar.gz" | cut -d ' ' -f 1)
+	bash "${REPO_ROOT}/scripts/release/build.sh" --version 9.9.9-test "${out}" >/dev/null
+	[ "$(sha256sum "${out}/lss-9.9.9-test.tar.gz" | cut -d ' ' -f 1)" = "${sum}" ]
+}
diff --git a/tests/unit/update.bats b/tests/unit/update.bats
new file mode 100644
index 0000000..bfa3be6
--- /dev/null
+++ b/tests/unit/update.bats
@@ -0,0 +1,64 @@
+#!/usr/bin/env bats
+# SPDX-FileCopyrightText: 2025-2026 VectoDE
+#
+# SPDX-License-Identifier: MIT
+
+# lss update: the command hands its version, --rollback and --dry-run to bootstrap.sh of the running version and
+# tells it that the lock is held. bootstrap.sh itself is tested in bootstrap.bats.
+
+setup() {
+	bats_require_minimum_version 1.5.0
+	REPO_ROOT=$(cd "${BATS_TEST_DIRNAME}/../.." && pwd)
+	export FAKE_ROOT=${BATS_TEST_TMPDIR}/root
+	export CALLS=${BATS_TEST_TMPDIR}/calls
+	mkdir -p "${FAKE_ROOT}"
+	printf '#!/usr/bin/env bash\nprintf "%%s|%%s\\n" "$*" "${LSS_LOCK_HELD:-}" >>"${CALLS}"\nexit "${BOOTSTRAP_EXIT:-0}"\n' \
+		>"${FAKE_ROOT}/bootstrap.sh"
+	# Drivers as files, not bash -c: under kcov (coverage.sh) BASH_SOURCE is unset in bash -c, and lss runs with set -u.
+	printf '%s\n' 'source "$1"' 'shift' 'parse_args "$@"' 'LSS_ROOT=${FAKE_ROOT}' 'cmd_update' >"${BATS_TEST_TMPDIR}/update.sh"
+	printf '%s\n' 'source "$1"' 'echo sourced' >"${BATS_TEST_TMPDIR}/source.sh"
+	export LSS_JOURNAL=0 LSS_COLOR=never
+	return
+}
+
+# update ARGS...: parses the arguments as lss does and runs `lss update` against the stub bootstrap.sh.
+update() {
+	bash "${BATS_TEST_TMPDIR}/update.sh" "${REPO_ROOT}/lss" "$@"
+	return
+}
+
+@test "lss update runs bootstrap.sh with the lock held" {
+	update update
+	[ "$(cat "${CALLS}")" = "|1" ]
+}
+
+@test "lss update VERSION passes the version" {
+	update update 2.0.1
+	[ "$(cat "${CALLS}")" = "2.0.1|1" ]
+}
+
+@test "--rollback and --dry-run reach bootstrap.sh" {
+	update --dry-run update --rollback
+	[ "$(cat "${CALLS}")" = "--rollback --dry-run|1" ]
+}
+
+@test "two versions are refused" {
+	run update update 2.0.1 2.0.2
+	[ "${status}" -eq 1 ]
+	[[ ${output} == *"Usage: lss update [VERSION] | lss update --rollback"* ]]
+	[ ! -e "${CALLS}" ]
+}
+
+@test "a failed update fails the command" {
+	BOOTSTRAP_EXIT=1 run update update
+	[ "${status}" -eq 1 ]
+}
+
+@test "the help lists update, and lss runs only when executed" {
+	run bash "${REPO_ROOT}/lss" --help
+	[[ ${output} == *"update [VERSION]"* && ${output} == *"update --rollback"* ]]
+	run bash "${REPO_ROOT}/lss" version
+	[ "${output}" = "lss $(<"${REPO_ROOT}/VERSION")" ]
+	run bash "${BATS_TEST_TMPDIR}/source.sh" "${REPO_ROOT}/lss"
+	[ "${output}" = sourced ]
+}