admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

iso: the release manifest described a different image than it shipped

Browse Source 
The 1.26.1 manifest — the file a tester reads to know what they have, and which is published
alongside the ISO — carried four statements that were false for a release build:

  boot-menu    'single entry Felhom telepítés, default, 5s'   -> it has TWO, timeout 15
  menu-entries '1 (... timeout 5s)'                           -> 2
  menu-removed 'Graphical, Terminal UI, ...'                  -> those are exactly what it SHIPS
  kernel-line  '... proxmox-start-auto-installer'             -> the release menu deliberately has none
  secret-bearing 'no   (embeds the customer retrieval passphrase...)'  -> self-contradictory

All four came from branding/pairing notes that predate --release and were emitted unconditionally.
A public artifact whose own manifest misdescribes it is the false-claim class this arc exists to
correct, so it is fixed before publication rather than after.
This commit is contained in:
authentik Default Admin
2026-07-31 20:34:03 +02:00
parent 52e5cdb86a
commit 70d034a3f3
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/iso/build-felhom-iso.sh
+11 -3
View File
@@ -463,6 +463,7 @@ echo "$OUT_SHA $(basename "$OUT_ISO")" > "$OUT_ISO.sha256"
LOADER_NOTE="shim (stock MS-signed chain; Secure Boot OK on compliant firmware)"
[[ "$LOADER" == "mkimage" ]] && LOADER_NOTE="mkimage (monolithic grub-mkimage UEFI loader, F1 fix — UNSIGNED; target board MUST have Secure Boot OFF)"
BRAND_NOTE="FELHOM (single entry 'Felhom telepítés', default, 5s; stock installer entries not emitted)"
$RELEASE && BRAND_NOTE="FELHOM release menu — TWO INTERACTIVE entries ('Felhom telepítés' graphical = default, 'Felhom telepítés (szöveges mód)' = Terminal UI), timeout 15s"
$BRAND || BRAND_NOTE="STOCK PVE menu (--no-brand; DEBUG BUILD — manual installer reachable, do not ship)"
MODE_NOTE="direct (env-baked customer-id + retrieval passphrase; secret-bearing)"
$PAIRING && MODE_NOTE="pairing (GENERIC secret-free universal ISO — box self-registers, operator binds, hub delivers once)"
@@ -475,15 +476,22 @@ pve-version : ${PVE_VERSION}
source-iso : ${ISO_BASE}
source-iso-sha256 : ${ISO_SHA256}
assistant-version : ${ASSISTANT_VER}
profile : ${PROFILE_NAME}
profile : $( $RELEASE && echo 'none (a release image bakes no disk selection)' || echo "${PROFILE_NAME}" )
fqdn : ${FELHOM_FQDN}
mode : ${MODE_NOTE}
loader : ${LOADER_NOTE}
grub-mkimage : ${GRUB_VERSION:-n/a (shim mode; loader unchanged)}
boot-menu : ${BRAND_NOTE}
$( $BRAND && cat "$WORK/brand-report.txt" 2>/dev/null || true )
$( if $RELEASE; then
echo "menu-entries : 2 (graphical default + Terminal UI; timeout 15s)"
echo "menu-removed : debug variants, Rescue Boot, memtest86+, UEFI Firmware Settings"
echo "automated-entry : NOT PRESENT — no auto-installer-mode.toml, so the stock grub.cfg does"
echo " not emit it. Disk selection is INTERACTIVE by construction."
else
$BRAND && cat "$WORK/brand-report.txt" 2>/dev/null || true
fi )
host-install-url : $(grep -oE 'FELHOM_INSTALL_URL=[^ ]*' "$BOOTSTRAP_ENV" 2>/dev/null || echo 'https://felhom.eu/scripts/felhom-host-install.sh (default)')
secret-bearing : ${SECRET_BEARING}$( $PAIRING && echo ' (GENERIC ISO — carries NO customer secret)' || echo ' (embeds the customer retrieval passphrase — supervised/single-use, delete after the run)')
secret-bearing : ${SECRET_BEARING}$( $RELEASE && echo ' (PUBLIC image — carries NO credential of any kind)' || { $PAIRING && echo ' (GENERIC ISO — carries NO customer secret)' || echo ' (embeds the customer retrieval passphrase — supervised/single-use, delete after the run)'; } )
root-password : $( $RELEASE && echo 'NONE — not baked. The installer prompts the person installing (release gate G2).' || echo "see $(basename "$OUT_ISO").rootpw.txt (operator-only; NEVER commit or paste into REPORTs)" )
answer-file : $( $RELEASE && echo 'NONE — no answer.toml, no auto-installer-mode.toml (release gate G1)' || echo 'baked (/answer.toml)' )
felhom-package : $( [[ -n "$RELEASE_DEB" ]] && echo "$(basename "$RELEASE_DEB") sha256=$(sha256sum "$RELEASE_DEB" | cut -d\ -f1)" || echo 'n/a (day-0 rides the answer file first-boot hook)' )