admin
0a6cf60bf8
gates / gates (push) Successful in 20s
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
46 lines
4.3 KiB
Markdown
46 lines
4.3 KiB
Markdown
# ISO release gate — felhom-installer-1.27.1 (2026-09-14)
|
||
|
||
**PUBLISHED 2026-09-15 08:45Z** on the operator's yes (decision 2026-09-15), by the P1-fixes task, from the exact file
|
||
gated here. Round trip over the real URL, 2026-09-15 08:45:55Z: `https://iso.felhom.eu/felhom-installer-1.27.1-pve9.2-1.iso`
|
||
→ **1 705 322 496 B, sha256 `25637007…c053`** (identical to the row below); `.sha256` → 200 (103 B); `.manifest.txt` →
|
||
200 (1 914 B). **Rollback is one link change:** `felhom-installer-1.26.1-pve9.2-1.iso` (+ `.sha256`, manifest) stays online
|
||
and was listed in the bucket before the upload. The download page `https://felhom.eu/letoltes` answered 200 naming 1.27.1
|
||
and the sha at 08:46:41Z. **G11 PASS** (above). **G12 NOT MEASURED:** the object-scoped token cannot read bucket settings
|
||
(`ListBuckets` 403s); `iso.felhom.eu/` and `/index.html` still 404, consistent with no public bucket listing — an
|
||
inference, not a measurement. **No git tag moved:** R-110 governs the host installer (`installer-v*`), which this ISO
|
||
does not change; nothing was re-tagged.
|
||
|
||
*Previously:* NOT PUBLISHED — awaiting the operator's yes (doorstep task Phase 5 STOP).
|
||
|
||
| | |
|
||
|---|---|
|
||
| file | `felhom-installer-1.27.1-pve9.2-1.iso` |
|
||
| sha256 | `25637007d5a7120ff9faa6b5b7ead3e33c0a361ac2d67e9fd4e0ee77c034c053` |
|
||
| size | 1 705 322 496 B |
|
||
| built from | felhom.eu `27e8ec8` (manifest `repo-commit`) = `HEAD` at gate time |
|
||
| package | `felhom-bootstrap_1.27.1_all.deb` |
|
||
|
||
Every observed value and what was scanned for: `gate-run.txt` (run in `felhom-iso-assistant:trixie`
|
||
against the exact output file, stock ISO `proxmox-ve_9.2-1.iso` for the enumeration).
|
||
|
||
| criterion | result | observed |
|
||
|---|---|---|
|
||
| G1 no answer file | **PASS** | `0`; control: `/auto-installer-capable` found by the same `find` (`1`) |
|
||
| G2 no root password | **PASS** | `0` hash patterns across every added file + the package tree; no `.rootpw.txt` |
|
||
| G3 no SSH key | **PASS** | `0` |
|
||
| G4 no customer identity | **PASS (reviewed)** | 1 hit, a non-value: the `FELHOM_RETRIEVAL_PASSPHRASE=` *parse check* string (`felhom-bootstrap.sh:515`) |
|
||
| G5 enumeration | **PASS** | 4 paths added (`felhomtheme/` ×3, the `.deb`), 3 removed (stock theme); content scan 0 hits, planted control `1` |
|
||
| G6 menu | **PASS** | 2 entries, `default=0`, `timeout=15`, `timeout_style=menu`; banned tokens `0`; **extra: `proxmox-start-auto-installer` in a live line `0`** (the build log's "lifted kernel line … auto-installer" is the repack's source read, not what ships) |
|
||
| G7 package | **PASS** | one `felhom-*.deb`, Version `1.27.1`, `Depends` lines `0` |
|
||
| G8 postinst | **PASS** | forbidden systemctl verbs `0`, network tools `0`, `set -e` `0`, last line `exit 0` |
|
||
| G9 payload = HEAD | **PASS** | `felhom-bootstrap.sh` `973f0c8f…9dd6` = repo; `.service` `cf2e4678…9af3` = repo |
|
||
| G10 committed | **PASS** | `scripts/iso/` porcelain empty; `HEAD == origin/main` |
|
||
| G11 round trip | **PASS (2026-09-15)** | downloaded bytes sha256 `25637007…c053`, 1 705 322 496 B = built file |
|
||
| G12 bucket private | **NOT MEASURED** | token is object-scoped (`ListBuckets` 403); root and `/index.html` 404 |
|
||
| G13 directories | **PASS** | `./etc/felhom/`, `./usr/local/sbin/`, `./lib/systemd/system/` each `1` |
|
||
| G14 a person chooses the disk | **static half PASS** | no answer file (G1), `filter.` keys `0`; the proof-install half is the walk |
|
||
| G15 console after first boot + reboot | **PASS (live, VM 332)** — first boot Felhom-only (screen `332-b12`); proven reboot (boot 16:14:11Z > `qm reboot` 16:13:56Z); `pvebanner` `masked` → `/dev/null`; `/etc/issue` 0 × `8006`; postinst log shows both acts | `systemctl mask pvebanner.service` present; issue text names `8006` `0`; see `audits/evidence-doorstep-walk-1270-2026-09-14/G15-live-332-iso1271.txt` |
|
||
| G16 Hungarian, one name | **static half PASS** | `jelszavad` `0`; `Tulajdonosi jelmondat` `1`; negative control `isszaáll` `0`; English `printf` review list empty; GRUB titles and echo lines Hungarian |
|
||
|
||
**G14 proof half:** one disk (VM 332) and three disks (VM 331, on 1.27.0 — the installer path is identical in 1.27.1) both show the installer's own disk screen; the three-disk list is screen `331-s07`. **Graphical entry:** proven to boot, wait at the EULA with nobody at the keyboard, show the one-disk target and reach the password screen — **not driven to a full install** (R-507).
|