# ISO release 1.29.0 — PUBLISHED 2026-09-18 (R-559, bilingual console)

| | |
|---|---|
| file | `felhom-installer-1.29.0-pve9.2-1.iso` |
| sha256 | `dceacae5da247d76cad065bf6c0d3bbefac8d8a5f8e571db2fd8449a97e94829` |
| size | 1 705 324 544 bytes |
| base | Proxmox VE 9.2-1 (`4e88fe41…c2c6c`) |
| source | felhom.eu `eb1ae37` + the menu-width fix (this commit) |
| published | `https://iso.felhom.eu/felhom-installer-1.29.0-pve9.2-1.iso` |
| rollback | `felhom-installer-1.28.0-pve9.2-1.iso` (sha `a4cd9b6d…`) stays online; rolling back is one edit on the two download pages |

**What changed:** the console is bilingual — the pairing banner, the bound banner and `/etc/issue`
carry the Hungarian block byte-for-byte as before, then an English block inside the same frame. Both
GRUB entries gained an English half.

## The criteria, each with its observed value

| | verdict | observed |
|---|---|---|
| G1 no `answer.toml` | **PASS** | `osirrox -find / -name answer.toml` → 0 hits |
| G2 no root password | **PASS** | no `.rootpw.txt` emitted for 1.29.0; the build says `root-pw: NONE` |
| G5 no credential literal | **PASS** | scanned the shipped script for `root_password`, `ssh-rsa`, `ssh-ed25519`, `PRIVATE KEY`, `password =`, `$6$`, `api_key` → all 0. One `Bearer` hit is `Bearer $token`, a variable |
| G6 boot menu | **PASS** | 2 menuentries, `timeout=15`, `timeout_style=menu` (underscore), `default=0`, banned entries 0 |
| G7 package present | **PASS** | `felhom-bootstrap 1.29.0` in `/proxmox/packages/`, and `dpkg -l` on both installs |
| G9 payload = repo HEAD | **PASS** | `cmp` of `felhom-bootstrap.sh` and `postinst` extracted from the shipped `.deb` → **IDENTICAL**; the installed copy's sha256 `00d4eb55…` equals the repo file's |
| G11 checksum + round trip | **PASS** | downloaded the published bytes: 1 705 324 544 B, sha256 `dceacae5…e94829` = built file = published `.sha256` |
| G14 a person chooses the disk | **PASS** | observed on BOTH entries: graphical `Target Harddisk: /dev/sda (32.00GiB, QEMU HARDDISK)` with a selector; text `Target harddisk: < /dev/sda (QEMU HARDDISK) (32.00 GiB) >` |
| G15 console after first boot AND one reboot | **PASS** | both installs: `grep -c 8006 /etc/issue` → **0**; `Felhom otthoni szerver` → 1; `Felhom home server` → 1; `pvebanner.service` → **masked**. Screendumps after the reboot are identical to first boot |
| G16 Hungarian first, secrets named once per language | **PASS** | harness green on every R-559 golden/English/width/height check; `jelszavad` 0, `Tulajdonosi jelmondat` 1, `Owner passphrase` 1 |

## The proof installs — BOTH menu entries, on the published bytes

Nested VMs on demo-hp, disks on `nvme-scratch` (`/mnt/hdd_1`), destroyed afterwards.

| | entry | VM | result |
|---|---|---|---|
| 1 | `Felhom telepítés / Install Felhom` (graphical) | 323 | installed, first boot + reboot, all checks pass |
| 2 | `Felhom telepítés (szöveges mód) / text` | 325 | installed, first boot + reboot, all checks pass |

Both first boots showed the bilingual `/etc/issue` above the login prompt and the bilingual pairing
banner, with the accented characters rendering correctly (R-63's console font). Screendumps in this
directory; the pairing codes in them are non-secret (a bind also needs the owner passphrase).

## A defect found and fixed BETWEEN builds

The first build's second menu entry read `Felhom telepítés (szöveges mód) / Install Felhom (text
mode)` — 58 characters. **The GRUB menu box cut it at `Instal`**, so its English half was
unreadable on the boot screen. Seen on the screendump, not reasoned about. Shortened to
`… / text` (38 chars) and the image rebuilt; the published image is the rebuilt one. The Hungarian
half is unchanged, which is why the English half was the part that had to give.

## Teardown

VMs 323, 324 and 325 created and **destroyed** (`qm destroy --purge`); `qm list` empty. The two
unclaimed appliance registrations the proof installs made (ids 32, 33) were **discarded** through
the operator endpoint — `status='discarded'`, and zero rows remain in `registered`. demo-hp guest
9201: the same 23 containers before and after, untouched. Two stale `*.rootpw.txt` files from July
were shredded from the publish source directory before the upload (R-587).