admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

SPIKE 3: [first-boot] does NOT fire on an interactive install

Browse Source 
Findings only — no script, profile or build file changed; no release ISO built, nothing published.
documentation/audits/SPIKE-universal-iso-3-2026-07-31.md

MEASURED with a control from the SAME image (one ISO, 15 GRUB entries):
- Automated entry  -> hook fires: ttyS0 marker, marker file,
  /var/lib/proxmox-first-boot/proxmox-first-boot (0700), activation symlink, unit active.
- Terminal-UI entry, normal manual install -> ALL absent, and the proxmox-first-boot PACKAGE is
  not installed at all. A whole-filesystem grep for the marker returns nothing.

Mechanism cited: Config.pm:118 defaults first_boot.enabled=0 and set_first_boot_opt is never
called in the Perl tree; Install.pm:746 returns early without it; Install.pm:1360 skips the
package. proxinstall (graphical) has ZERO occurrences of first-boot. [first-boot] is an
automated-installer feature, unavailable on every interactive path by construction. R-154.

A delivery mechanism DOES exist and is UNTESTED: Install.pm:1343-1372 unpacks every .deb in the
ISO's /proxmox/packages/ into the target on every path (fixed skip-list), then dpkg --configure -a
runs postinsts (:1378) — how PVE ships first-boot itself. Read from source, not measured.

Q5: the public image should carry NO answer.toml at all — that removes the baked root hash, the
disk profile and the whole Spike 1-2 problem space, and makes it a one-line release gate. But
iso-repack.sh:100-106 refuses an ISO without auto-installer-mode.toml. R-155.

Incidental R-153: hub hostInstallVersion=1.19.0 vs SCRIPT_VERSION=1.22.0; hostinstall_gates.py
detects it and exits 1 — the gate works, nothing runs it.

Q3 (real stub at before-network) was NOT reached and is recorded as not reached.
This commit is contained in:
authentik Default Admin
2026-07-31 14:47:18 +02:00
parent 19c932a693
commit bb29186d62
3 changed files with 387 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/CHANGELOG.md
+33
View File
@@ -1,3 +1,36 @@
## SPIKE 3 (no code change) — `[first-boot]` does NOT fire on an interactive install (2026-07-31)
**No script, profile or build file was modified.** Findings:
`documentation/audits/SPIKE-universal-iso-3-2026-07-31.md`. Opens R-153..R-155.
**MEASURED, with a control from the same image.** One probe ISO (15 GRUB entries: Automated,
Graphical, Terminal UI). Automated entry -> the first-boot hook fires: ttyS0 marker, marker file,
`/var/lib/proxmox-first-boot/proxmox-first-boot` (0700) and the activation symlink all present.
Terminal-UI entry, normal manual install -> **every one of those is absent, and the
`proxmox-first-boot` PACKAGE is not installed at all** (`dpkg-query: no packages found`). A
whole-filesystem grep for the marker returns nothing.
Mechanism, cited: `Config.pm:118` defaults `first_boot.enabled => 0` and `set_first_boot_opt` is never
called in the Perl tree; `Install.pm:746` returns early unless the flag is set; `Install.pm:1360` skips
the package itself. `proxinstall` (the graphical installer) contains **zero** occurrences of
`first-boot`. **`[first-boot]` is an automated-installer feature — unavailable on every interactive
path, by construction.** R-154.
**A delivery mechanism DOES exist, and it is untested.** `Install.pm:1343-1372` unpacks EVERY `.deb`
in the ISO's `/proxmox/packages/` into the target on every install path (fixed skip-list of known
names), then `dpkg --configure -a` runs postinsts (`:1378`). That is how PVE ships first-boot itself.
Read from source, NOT measured — proving it is the top follow-up.
Also: the interactive installer shows the target disk and a summary listing `Bootdisk(s) /dev/sda`
before erasing — the operator's ruling needs no Felhom work for that warning.
**Incidental: a working gate is red and nobody runs it.** `hub/internal/web/configs.go:28` has
`hostInstallVersion = "1.19.0"` vs `SCRIPT_VERSION = "1.22.0"`; `scripts/hostinstall_gates.py` detects
it and exits 1. The comment claiming drift "is now gated" is true of the gate and false of its
enforcement. R-153.
Q3 (the real stub at `before-network`) was NOT reached and is recorded as not reached.
## SPIKE 2 (no code change) — locked root closes the PVE web UI; before-network gives a measured zero window (2026-07-31)
**No script, profile or build file was modified.** Findings: