admin
eb1ae37095
gates / gates (push) Successful in 23s
THE IMAGE IS NOT BUILT AND NOT PUBLISHED BY THIS COMMIT. Publishing to iso.felhom.eu is public and irreversible and its runbook requires a proof install on BOTH menu entries plus the 16-criterion gate run against the exact uploaded bytes. That is the operator's step. The download pages therefore still name 1.28.0 - the image that is actually published - and a new site gate refuses the two pages naming different files or hashes. Three texts a person meets before any dashboard become bilingual: Hungarian block first, byte for byte as before, then English, inside the same frame. The pairing banner, the bound banner, /etc/issue (and the postinst's byte-coupled copy), plus an English half on the GRUB entries. The Hungarian is a GOLDEN, not a grep: test/golden/*.hu.txt were captured from the script at183727db9cbefore one English line existed, and the harness asserts each banner's first N lines are exactly the golden. Red-proofed by one changed byte, by an "a" planted in the English block, and by an over-wide line. R-586, found on the way in: running the harness UNCHANGED at the base commit failed two R-496 checks. The script paints with `>`, which truncates a FILE but is a no-op on a console device; ISO 1.28.0's new bound banner (c033b3b) paints straight after the pairing one and wiped it before the check read it.c033b3bdid not touch the harness, and nobody saw it because the harness is in no gate and no CI run. Fixed with a FIFO; production code untouched. The harness being ungated is still open. The release gate's G16 required every Felhom string to be Hungarian and would have STOPPED this publication. Operator ruling 1b of 2026-09-17 supersedes that scope, so G16 is rewritten rather than waived: Hungarian FIRST, pinned by the golden, each secret named once per language. letoltes.html changes by four lines only. The English link is not in the nav - the nav is a shared block site_gates.py pins across every page, and the gate convicted the first attempt. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
521 lines
33 KiB
Bash
Executable File
521 lines
33 KiB
Bash
Executable File
#!/bin/bash
|
|
#===============================================================================
|
|
# build-felhom-iso.sh — R-21 slice A+B+C: turn the official PVE ISO into a Felhom auto-install ISO.
|
|
#
|
|
# SLICE C — --pairing builds the GENERIC, SECRET-FREE universal ISO: no customer-id / passphrase is
|
|
# baked in. The box registers itself at the hub as an UNCLAIMED APPLIANCE, the operator binds it to a
|
|
# customer, and the hub delivers the credentials ONCE — then the box completes day-0 exactly like a
|
|
# direct-mode box. Direct mode (--bootstrap-env, secret-bearing, operator-prepped) is unchanged.
|
|
#
|
|
# Renders answer.toml (from answer.toml.tmpl + a profile), mints a fresh THROWAWAY root hash,
|
|
# gates the answer through validate-answer by PARSING ITS OUTPUT (never $? — validate-answer returns
|
|
# exit 0 even on failure, spike S1 trap), renders the first-boot stub (injecting the bootstrap
|
|
# script/unit/env), and runs prepare-iso --fetch-from iso --on-first-boot. Emits the ISO + sha256 +
|
|
# a build manifest.
|
|
#
|
|
# R-38 GRUB SLICE (v1.22.0) — every ISO is now REPACKED after prepare-iso to carry the Felhom boot
|
|
# screen and, more importantly, a menu with exactly ONE entry ("Felhom telepítés", default, 5s). The
|
|
# stock PVE menu offers Graphical/Terminal-UI/serial installers plus an Advanced Options submenu with
|
|
# debug/nomodeset/rescue entries — every one of them a route into the MANUAL installer, whose first
|
|
# question is which disk to wipe. A customer, or their helpful nephew, must not be able to reach it
|
|
# from a boot menu; those entries are not hidden, they are not emitted. The kernel/append line is
|
|
# lifted verbatim from the ISO's own automated entry, so boot behavior is unchanged. See iso-repack.sh.
|
|
# (--no-brand exists for debugging the stock menu; it is not a shipping mode.)
|
|
#
|
|
# SLICE B — --loader shim|mkimage (default shim). shim = the stock output (MS-signed shim→GRUB chain,
|
|
# keeps Secure Boot working on compliant firmware, spike S2b). mkimage = replace the ISO's UEFI boot
|
|
# path with a monolithic grub-mkimage-built BOOTX64.EFI built from the ISO's OWN GRUB modules — the
|
|
# workaround PROVEN LIVE during the N100 run (VALIDATION-n100-baremetal F1: cheap AMI AN3PLUS-class
|
|
# firmware can't relocate the ISO's signed GRUB from USB, `relocation 0x0`). The mkimage loader is
|
|
# UNSIGNED → the target board MUST have Secure Boot OFF (documented in the n100 profile's prep). The
|
|
# loader surgery runs AFTER prepare-iso (the assistant's answer/first-boot payload is provably
|
|
# untouched except the loader path).
|
|
#
|
|
# SECRET-BEARING: if the bootstrap-env carries a retrieval passphrase (it must, for an unattended
|
|
# install — see README "secret-bearing"), the produced ISO embeds it. Supervised/single-use only;
|
|
# never distributed; delete after the run. The build log says so loudly.
|
|
#
|
|
# Runs on DooPlex; delegates validate-answer + prepare-iso + the mkimage surgery to the
|
|
# felhom-iso-assistant container (which carries proxmox-auto-install-assistant, xorriso, grub-mkimage,
|
|
# and mtools).
|
|
#===============================================================================
|
|
set -euo pipefail
|
|
|
|
# R-128 RULING (2026-07-31): the previous comment here claimed this "aligns with felhom-host-install
|
|
# SCRIPT_VERSION". That was a COMMENT, not an assertion — `SCRIPT_VERSION` appeared nowhere in
|
|
# scripts/iso/ except inside that sentence, so nothing ever evaluated it, and the two had drifted
|
|
# (1.25.0 vs 1.22.0). The fix is NOT to turn it into a real assertion, because the coupling it claimed
|
|
# does not exist: the ISO is a frozen artifact, while felhom-host-install.sh is fetched at RUN TIME
|
|
# from the website's git-sync of `main` (R-94/R-110), so whatever version an ISO carries, the script a
|
|
# box runs is always current. Coupling them would invent a constraint. The claim is corrected instead.
|
|
ISO_VERSION="1.29.0" # the ISO's own version. INDEPENDENT of felhom-host-install.sh's SCRIPT_VERSION,
|
|
# which is fetched at run time from main and is not frozen into the image.
|
|
IMAGE="${FELHOM_ISO_ASSISTANT_IMAGE:-felhom-iso-assistant:trixie}"
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
# --- logging (host-install idiom) -----------------------------------------------------------------
|
|
if [[ -t 1 ]]; then RED=$'\033[0;31m'; GREEN=$'\033[0;32m'; YELLOW=$'\033[1;33m'; BLUE=$'\033[0;34m'; CYAN=$'\033[0;36m'; NC=$'\033[0m'
|
|
else RED=""; GREEN=""; YELLOW=""; BLUE=""; CYAN=""; NC=""; fi
|
|
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
|
|
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
|
log_error() { echo -e "${RED}[ERROR]${NC} $1" >&2; }
|
|
log_step() { echo -e "${BLUE}[STEP]${NC} $1"; }
|
|
log_success() { echo -e "${GREEN}[OK]${NC} $1"; }
|
|
log_dry() { echo -e "${CYAN}[DRY-RUN]${NC} $1"; }
|
|
die() { log_error "$1"; exit 1; }
|
|
|
|
# ver_ge A B → true iff version A >= version B (dotted numeric, sort -V).
|
|
ver_ge() { [[ "$1" == "$2" ]] && return 0; [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -1)" == "$1" ]]; }
|
|
|
|
# R-71 STANDING GATE (v1.25.0): every ISO build asserts the golden it will install is >= the managed
|
|
# controller floor. If the floor exceeds golden, a freshly-installed box boots BELOW the floor and the
|
|
# day-0 managed update fires — racing the offsite apply-bridge exactly as it did on demo-hp
|
|
# (DIAG-f10-demo-hp-offsite-2026-07-23 / R-71). The build must fail loudly rather than ship that gap.
|
|
# Inputs: FELHOM_ASSERT_GOLDEN + FELHOM_ASSERT_FLOOR (the hub's current artifact_golden_version and
|
|
# min_controller_version — resolve them operator-side and pass in; the publish-train runbook covers
|
|
# how). Both printed. If either is unset the gate is UNENFORCED and says so LOUDLY (never a silent pass).
|
|
assert_golden_ge_floor() {
|
|
local golden="${FELHOM_ASSERT_GOLDEN:-}" floor="${FELHOM_ASSERT_FLOOR:-}"
|
|
if [[ -z "$golden" || -z "$floor" ]]; then
|
|
log_warn "R-71 golden>=floor gate UNENFORCED — pass FELHOM_ASSERT_GOLDEN + FELHOM_ASSERT_FLOOR to enforce (golden='${golden:-unset}' floor='${floor:-unset}')"
|
|
return 0
|
|
fi
|
|
if ver_ge "$golden" "$floor"; then
|
|
log_success "R-71 gate OK: golden $golden >= managed floor $floor"
|
|
else
|
|
die "R-71 BUILD GATE FAILED: golden $golden < managed floor $floor — a fresh box would boot below the floor and the day-0 update would race the offsite apply-bridge. Republish golden >= $floor (and vouch it) before building this ISO."
|
|
fi
|
|
}
|
|
|
|
PVE_ISO=""; ISO_SHA256=""; PROFILE=""; BOOTSTRAP_ENV=""; OUT_DIR="${FELHOM_ISO_OUT:-/mnt/5_hdd/felhom.eu/felhom-iso/out}"; PVE_VERSION=""; DRY_RUN=false
|
|
LOADER_CLI="" # --loader override; empty = fall back to the profile, then the shim default.
|
|
PAIRING=false # --pairing: build the GENERIC secret-free ISO (slice C); no --bootstrap-env.
|
|
RELEASE=false # --release: the PUBLIC image. No answer.toml at all, an INTERACTIVE two-entry menu,
|
|
# and day-0 delivered by a .deb rather than the answer file's [first-boot] hook.
|
|
BRAND=true # R-38: Felhom boot screen + single-entry menu. --no-brand is a debugging escape only.
|
|
BRAND_IMAGE="" # --brand-image override; empty = the website's og-image_2.png (the single source).
|
|
usage() {
|
|
cat <<EOF
|
|
Usage (direct): build-felhom-iso.sh --pve-iso PATH --iso-sha256 SHA --profile FILE --bootstrap-env FILE [options]
|
|
Usage (generic): build-felhom-iso.sh --pve-iso PATH --iso-sha256 SHA --profile FILE --pairing [options]
|
|
Usage (release): build-felhom-iso.sh --pve-iso PATH --iso-sha256 SHA --release [options]
|
|
|
|
Required:
|
|
--pve-iso PATH pre-downloaded official PVE ISO (not fetched here)
|
|
--iso-sha256 SHA expected sha256 of --pve-iso (verified before build; abort on mismatch)
|
|
--profile FILE build profile (fqdn + [disk-setup]); see profiles/ and README
|
|
|
|
Mode (exactly one):
|
|
--bootstrap-env FILE DIRECT mode: the in-ISO /etc/felhom/bootstrap.env (SECRET-BEARING: retrieval
|
|
passphrase). Must define FELHOM_CUSTOMER_ID, FELHOM_MODE, FELHOM_RETRIEVAL_PASSPHRASE.
|
|
--pairing PAIRING mode (slice C): the GENERIC, SECRET-FREE universal ISO. The box registers
|
|
itself as an unclaimed appliance at the hub; the operator binds it; the hub
|
|
delivers the customer-id + passphrase ONCE. No customer secret is baked in. The
|
|
hub URL comes from the profile (FELHOM_HUB_URL) or the default.
|
|
Options:
|
|
--loader shim|mkimage UEFI boot loader (default: shim, or the profile's FELHOM_LOADER; --loader wins).
|
|
shim = stock MS-signed chain (Secure Boot OK on compliant firmware).
|
|
mkimage = monolithic grub-mkimage loader for cheap AMI boards that can't boot
|
|
the ISO's GRUB from USB (F1). UNSIGNED -> the target board needs Secure Boot OFF.
|
|
--no-brand DEBUG ONLY: keep the stock PVE boot menu (all installer entries reachable).
|
|
Shipping ISOs are always branded: Felhom boot screen + exactly ONE entry.
|
|
--brand-image FILE override the boot-screen card (default: website/assets/og-image_2.png)
|
|
--out DIR output directory (default: the DooPlex build root
|
|
/mnt/5_hdd/felhom.eu/felhom-iso/out; override via \$FELHOM_ISO_OUT for other hosts)
|
|
--pve-version VER override PVE version tag (default: parsed from the ISO filename)
|
|
--dry-run print the steps without producing an ISO
|
|
-h, --help this help
|
|
EOF
|
|
}
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--pve-iso) PVE_ISO="$2"; shift 2 ;;
|
|
--iso-sha256) ISO_SHA256="$2"; shift 2 ;;
|
|
--profile) PROFILE="$2"; shift 2 ;;
|
|
--bootstrap-env) BOOTSTRAP_ENV="$2"; shift 2 ;;
|
|
--pairing) PAIRING=true; shift ;;
|
|
--release) RELEASE=true; shift ;;
|
|
--loader) LOADER_CLI="$2"; shift 2 ;;
|
|
--no-brand) BRAND=false; shift ;;
|
|
--brand-image) BRAND_IMAGE="$2"; shift 2 ;;
|
|
--out) OUT_DIR="$2"; shift 2 ;;
|
|
--pve-version) PVE_VERSION="$2"; shift 2 ;;
|
|
--dry-run) DRY_RUN=true; shift ;;
|
|
-h|--help) usage; exit 0 ;;
|
|
*) die "unknown argument: $1 (see --help)" ;;
|
|
esac
|
|
done
|
|
[[ -z "$LOADER_CLI" || "$LOADER_CLI" == "shim" || "$LOADER_CLI" == "mkimage" ]] \
|
|
|| die "--loader must be 'shim' or 'mkimage' (got '$LOADER_CLI')"
|
|
|
|
[[ -n "$PVE_ISO" ]] || die "--pve-iso is required"
|
|
[[ -n "$ISO_SHA256" ]] || die "--iso-sha256 is required"
|
|
[[ -f "$PVE_ISO" ]] || die "--pve-iso not found: $PVE_ISO"
|
|
if $RELEASE; then
|
|
# A release image has no answer file, so it has no fqdn and no [disk-setup] to take from a profile.
|
|
# Accepting one would imply a disk selection the image deliberately does not make.
|
|
[[ -z "$PROFILE" ]] || die "--release takes no --profile (a release image bakes no disk selection)"
|
|
[[ -z "$BOOTSTRAP_ENV" ]] || die "--release and --bootstrap-env are mutually exclusive"
|
|
$PAIRING && die "--release and --pairing are mutually exclusive"
|
|
$BRAND || die "--release requires branding (the two-entry menu IS the release menu)"
|
|
else
|
|
[[ -n "$PROFILE" ]] || die "--profile is required"
|
|
[[ -f "$PROFILE" ]] || die "--profile not found: $PROFILE"
|
|
fi
|
|
# Mode: exactly one of --bootstrap-env (direct), --pairing (generic) or --release (public image).
|
|
if $RELEASE; then
|
|
: # validated above; a release image has no bootstrap-env by design
|
|
elif $PAIRING; then
|
|
[[ -z "$BOOTSTRAP_ENV" ]] || die "--pairing and --bootstrap-env are mutually exclusive"
|
|
else
|
|
[[ -n "$BOOTSTRAP_ENV" ]] || die "one of --bootstrap-env (direct), --pairing (generic) or --release is required"
|
|
[[ -f "$BOOTSTRAP_ENV" ]] || die "--bootstrap-env not found: $BOOTSTRAP_ENV"
|
|
fi
|
|
|
|
command -v docker >/dev/null || die "docker not found (needed for the assistant container)"
|
|
docker image inspect "$IMAGE" >/dev/null 2>&1 || die "assistant image '$IMAGE' not found — build it: docker build -f $HERE/Dockerfile.assistant -t $IMAGE $HERE"
|
|
|
|
# --- verify source ISO ----------------------------------------------------------------------------
|
|
log_step "verifying source ISO sha256"
|
|
actual_sha=$(sha256sum "$PVE_ISO" | awk '{print $1}')
|
|
[[ "$actual_sha" == "$ISO_SHA256" ]] || die "ISO sha256 MISMATCH: expected $ISO_SHA256, got $actual_sha"
|
|
log_success "source ISO sha256 OK ($actual_sha)"
|
|
|
|
if [[ -z "$PVE_VERSION" ]]; then
|
|
PVE_VERSION=$(basename "$PVE_ISO" | sed -E 's/^proxmox-ve_(.+)\.iso$/\1/')
|
|
[[ "$PVE_VERSION" != "$(basename "$PVE_ISO")" ]] || die "cannot parse PVE version from '$(basename "$PVE_ISO")' — pass --pve-version"
|
|
fi
|
|
PROFILE_NAME="$(basename "$PROFILE")"; PROFILE_NAME="${PROFILE_NAME%.profile}"
|
|
|
|
# --- load + validate profile ----------------------------------------------------------------------
|
|
if ! $RELEASE; then
|
|
log_step "loading profile: $PROFILE"
|
|
FELHOM_FQDN=""; FELHOM_DISK_SETUP=""; FELHOM_ROOT_SSH_KEY=""; FELHOM_LOADER=""; FELHOM_HUB_URL=""; FELHOM_INSTALL_URL=""
|
|
# shellcheck disable=SC1090
|
|
source "$PROFILE"
|
|
[[ -n "$FELHOM_FQDN" ]] || die "profile missing FELHOM_FQDN"
|
|
[[ -n "$FELHOM_DISK_SETUP" ]] || die "profile missing FELHOM_DISK_SETUP"
|
|
# Optional emergency/validation SSH key baked into the installed root account.
|
|
ROOT_SSH_LINE=""
|
|
[[ -n "$FELHOM_ROOT_SSH_KEY" ]] && ROOT_SSH_LINE="root-ssh-keys = [\"${FELHOM_ROOT_SSH_KEY}\"]"
|
|
else
|
|
log_info "release mode — no profile, no fqdn, no [disk-setup], no root key"
|
|
FELHOM_FQDN="(none — interactive install)"
|
|
fi
|
|
|
|
# --- resolve the loader mode: --loader wins over the profile's FELHOM_LOADER over the shim default ---
|
|
LOADER="${LOADER_CLI:-${FELHOM_LOADER:-shim}}"
|
|
[[ "$LOADER" == "shim" || "$LOADER" == "mkimage" ]] \
|
|
|| die "profile FELHOM_LOADER must be 'shim' or 'mkimage' (got '$FELHOM_LOADER')"
|
|
if [[ "$LOADER" == "mkimage" ]]; then
|
|
echo -e "${YELLOW}==================================================================================${NC}"
|
|
log_warn "LOADER MODE = mkimage — the UEFI boot path is a monolithic grub-mkimage loader (F1 fix)."
|
|
log_warn "This loader is UNSIGNED: the target board MUST have Secure Boot OFF. shim/SB is bypassed."
|
|
log_warn "The ISO filename gains '-mkimage'; never confuse it with a shim (SB-capable) build."
|
|
echo -e "${YELLOW}==================================================================================${NC}"
|
|
else
|
|
log_info "loader mode = shim (stock MS-signed chain; Secure Boot works on compliant firmware)"
|
|
fi
|
|
|
|
# --- resolve the boot-screen card (R-38) ------------------------------------------------------------
|
|
# Single source of truth: the website asset. NOT copied into scripts/iso/ — a second copy of a brand
|
|
# asset is a second thing to forget to update.
|
|
if $BRAND; then
|
|
[[ -n "$BRAND_IMAGE" ]] || BRAND_IMAGE="$HERE/../../website/assets/og-image_2.png"
|
|
[[ -f "$BRAND_IMAGE" ]] || die "brand image not found: $BRAND_IMAGE (pass --brand-image, or run from the repo checkout)"
|
|
log_info "boot-screen card = $BRAND_IMAGE (menu: exactly ONE entry, 'Felhom telepítés')"
|
|
else
|
|
echo -e "${YELLOW}==================================================================================${NC}"
|
|
log_warn "--no-brand — the STOCK PVE boot menu ships: Graphical/Terminal-UI/serial installers and"
|
|
log_warn "the Advanced Options submenu are all reachable, i.e. a manual 'which disk do I wipe'"
|
|
log_warn "installer is one keypress away. DEBUGGING ONLY — never hand this ISO to a customer."
|
|
echo -e "${YELLOW}==================================================================================${NC}"
|
|
fi
|
|
|
|
# --- mode: DIRECT validates the secret-bearing env; PAIRING is secret-free (env generated below) -----
|
|
if $RELEASE; then
|
|
SECRET_BEARING="no"
|
|
echo -e "${YELLOW}==================================================================================${NC}"
|
|
log_info "RELEASE MODE — the PUBLIC image. No answer.toml, no auto-installer-mode.toml, no root"
|
|
log_info "password, no SSH key, no disk profile. Two INTERACTIVE menu entries; the person"
|
|
log_info "installing chooses the disk. Day-0 rides felhom-bootstrap.deb in /proxmox/packages/."
|
|
echo -e "${YELLOW}==================================================================================${NC}"
|
|
elif $PAIRING; then
|
|
SECRET_BEARING="no"
|
|
PAIR_HUB_URL="${FELHOM_HUB_URL:-https://hub.felhom.eu}"
|
|
PAIR_INSTALL_URL="${FELHOM_INSTALL_URL:-https://felhom.eu/scripts/felhom-host-install.sh}"
|
|
echo -e "${YELLOW}==================================================================================${NC}"
|
|
log_info "PAIRING MODE — building the GENERIC, SECRET-FREE universal ISO (slice C)."
|
|
log_info "The box registers as an unclaimed appliance; the operator binds it; the hub delivers the"
|
|
log_info "customer-id + passphrase ONCE. Baked env carries only the hub URL ($PAIR_HUB_URL) — no secret."
|
|
echo -e "${YELLOW}==================================================================================${NC}"
|
|
else
|
|
log_step "checking bootstrap-env (secret-bearing detection)"
|
|
( set +e
|
|
FELHOM_CUSTOMER_ID=""; FELHOM_MODE=""; FELHOM_RETRIEVAL_PASSPHRASE=""
|
|
# shellcheck disable=SC1090
|
|
source "$BOOTSTRAP_ENV"
|
|
[[ -n "$FELHOM_CUSTOMER_ID" ]] || { echo "MISSING FELHOM_CUSTOMER_ID"; exit 3; }
|
|
[[ -n "$FELHOM_MODE" ]] || { echo "MISSING FELHOM_MODE"; exit 3; }
|
|
[[ -n "$FELHOM_RETRIEVAL_PASSPHRASE" ]] || { echo "MISSING FELHOM_RETRIEVAL_PASSPHRASE"; exit 3; }
|
|
) || die "bootstrap-env invalid ($BOOTSTRAP_ENV) — must define FELHOM_CUSTOMER_ID, FELHOM_MODE, FELHOM_RETRIEVAL_PASSPHRASE"
|
|
SECRET_BEARING="yes" # a valid bootstrap-env always carries the retrieval passphrase
|
|
log_warn "this ISO will be SECRET-BEARING (embeds the customer retrieval passphrase) — supervised/single-use only"
|
|
fi
|
|
|
|
# R-71 build gate — before any workspace/mint/build work commits (fails fast + loud).
|
|
assert_golden_ge_floor
|
|
|
|
# --- workspace ------------------------------------------------------------------------------------
|
|
WORK="$(mktemp -d "${TMPDIR:-/tmp}/felhom-iso.XXXXXX")"
|
|
# chmod first: the mkimage surgery's osirrox extract leaves read-only file modes that rm can't clear.
|
|
# FELHOM_ISO_KEEP_WORK=1 is a DEBUG/TEST escape: keep $WORK for post-mortem (the rootpw-emission
|
|
# harness cross-checks the emitted plaintext against the rendered answer's hash). Never a build mode.
|
|
cleanup() {
|
|
if [[ "${FELHOM_ISO_KEEP_WORK:-0}" == "1" ]]; then
|
|
log_warn "FELHOM_ISO_KEEP_WORK=1 — workspace KEPT at $WORK (debug/test only; delete it yourself)"
|
|
return 0
|
|
fi
|
|
chmod -R u+w "$WORK" 2>/dev/null || true; rm -rf "$WORK"
|
|
}
|
|
trap cleanup EXIT
|
|
mkdir -p "$OUT_DIR" "$WORK/tmp"
|
|
ISO_DIR="$(cd "$(dirname "$PVE_ISO")" && pwd)"; ISO_BASE="$(basename "$PVE_ISO")"
|
|
|
|
# PAIRING: generate the SECRET-FREE env the stub bakes — only the hub URL, no customer/passphrase.
|
|
# (The bootstrap detects the absent customer-id/passphrase and enters pairing mode.)
|
|
if $PAIRING; then
|
|
BOOTSTRAP_ENV="$WORK/pairing.env"
|
|
cat > "$BOOTSTRAP_ENV" <<EOF
|
|
# GENERIC secret-free pairing env (R-21 slice C). NO customer-id, NO passphrase — the box registers
|
|
# as an unclaimed appliance and the hub delivers the credentials once, after the operator binds it.
|
|
FELHOM_HUB_URL=$PAIR_HUB_URL
|
|
FELHOM_INSTALL_URL=$PAIR_INSTALL_URL
|
|
EOF
|
|
log_info "generated secret-free pairing env (hub=$PAIR_HUB_URL)"
|
|
fi
|
|
|
|
# --- resolve the output ISO name (needed by the mint below: the rootpw sibling file is named after
|
|
# the ISO). Rule 4: the loader mode is loud in the filename — a '-mkimage' ISO implies
|
|
# Secure-Boot-off prep. -----------------------------------------------------------------------
|
|
LOADER_SUFFIX=""; [[ "$LOADER" != "shim" ]] && LOADER_SUFFIX="-${LOADER}"
|
|
MODE_SUFFIX=""; $PAIRING && MODE_SUFFIX="-generic" # the secret-free universal ISO is unmistakable
|
|
if $RELEASE; then
|
|
# Named so it cannot be mistaken for one of the lab artifacts in out/ (canary, probe, nested-vm,
|
|
# demo, hp, n100). "felhom-installer" + the version is what a tester quotes in a bug report.
|
|
OUT_ISO="$OUT_DIR/felhom-installer-${ISO_VERSION}-pve${PVE_VERSION}${LOADER_SUFFIX}.iso"
|
|
else
|
|
OUT_ISO="$OUT_DIR/felhom-pve-${PVE_VERSION}-v${ISO_VERSION}-${PROFILE_NAME}${MODE_SUFFIX}${LOADER_SUFFIX}.iso"
|
|
fi
|
|
|
|
# --- mint fresh THROWAWAY root hash ---------------------------------------------------------------
|
|
if $RELEASE; then
|
|
log_info "release mode — NOT minting a root password (release gate G2: none is baked, and no"
|
|
log_info " .rootpw.txt is emitted). The installer prompts the person doing the install."
|
|
ROOT_HASH=""
|
|
else
|
|
log_step "minting fresh throwaway root password hash"
|
|
ROOT_PLAIN="felhom-throwaway-$(head -c12 /dev/urandom | base64 | tr -dc 'A-Za-z0-9')"
|
|
ROOT_HASH="$(openssl passwd -6 "$ROOT_PLAIN")"
|
|
# R-61 slice 1: the baked root password becomes KNOWABLE. The plaintext is written to a 0600 sibling
|
|
# file next to the ISO — the SINGLE record of truth — and nowhere else: never stdout/stderr/logs,
|
|
# never the manifest (manifests get pasted into committed REPORTs; a separate file cannot ride along
|
|
# by accident). A fixed well-known password stays REJECTED (operator ruling 2026-07-21): a
|
|
# pre-pairing box sits on a stranger's LAN. Note: an aborted build can leave a rootpw file for an
|
|
# ISO that was never produced; the next build of the same name overwrites it.
|
|
( umask 077; printf '%s %s built %s\n' "$ROOT_PLAIN" "$(basename "$OUT_ISO")" "$(date -Is)" > "$OUT_ISO.rootpw.txt" )
|
|
unset ROOT_PLAIN
|
|
[[ -n "$ROOT_HASH" ]] || die "failed to mint root hash"
|
|
log_info "throwaway root hash written to the answer file; plaintext in $(basename "$OUT_ISO").rootpw.txt (0600, operator-only — value not logged)"
|
|
fi
|
|
|
|
# --- render answer.toml (pure bash param-expansion; no metachar hazards) ---------------------------
|
|
if ! $RELEASE; then
|
|
log_step "rendering answer.toml"
|
|
ANSWER="$WORK/answer.toml"
|
|
: > "$ANSWER"
|
|
while IFS= read -r line || [[ -n "$line" ]]; do
|
|
if [[ "$line" == "__DISK_SETUP__" ]]; then
|
|
printf '%s\n' "$FELHOM_DISK_SETUP" >> "$ANSWER"
|
|
elif [[ "$line" == "__ROOT_SSH_KEYS__" ]]; then
|
|
[[ -n "$ROOT_SSH_LINE" ]] && printf '%s\n' "$ROOT_SSH_LINE" >> "$ANSWER" # blank -> omit line
|
|
else
|
|
line="${line//__FQDN__/$FELHOM_FQDN}"
|
|
line="${line//__ROOT_HASH__/$ROOT_HASH}"
|
|
printf '%s\n' "$line" >> "$ANSWER"
|
|
fi
|
|
done < "$HERE/answer.toml.tmpl"
|
|
|
|
# --- validate-answer OUTPUT-PARSE gate (never $? — spike S1) --------------------------------------
|
|
gate_validate_answer() {
|
|
local out
|
|
out=$(docker run --rm -v "$WORK":/work "$IMAGE" \
|
|
proxmox-auto-install-assistant validate-answer /work/answer.toml 2>&1) || true
|
|
echo "----- validate-answer output -----"; echo "$out"; echo "----------------------------------"
|
|
# LOAD-BEARING: validate-answer exits 0 even on failure; decide on the MESSAGE TEXT, not $?.
|
|
if echo "$out" | grep -q "parsed successfully" && ! echo "$out" | grep -qi "Found issues"; then
|
|
return 0
|
|
fi
|
|
return 1
|
|
}
|
|
log_step "validating rendered answer (output-parse gate)"
|
|
if $DRY_RUN; then
|
|
log_dry "docker run … validate-answer /work/answer.toml (output-parse gate)"
|
|
else
|
|
gate_validate_answer || die "answer validation FAILED — NO ISO produced (fix the answer/profile)"
|
|
log_success "answer validated"
|
|
fi
|
|
|
|
# --- render the first-boot stub (inject bootstrap script/unit/env as base64) ----------------------
|
|
log_step "rendering first-boot stub"
|
|
STUB="$WORK/stub-first-boot.sh"
|
|
sh_b64="$(base64 -w0 < "$HERE/felhom-bootstrap.sh")"
|
|
unit_b64="$(base64 -w0 < "$HERE/felhom-bootstrap.service")"
|
|
env_b64="$(base64 -w0 < "$BOOTSTRAP_ENV")"
|
|
awk -v sh="$sh_b64" -v unit="$unit_b64" -v env="$env_b64" '
|
|
{ gsub(/@@BOOTSTRAP_SH_B64@@/, sh); gsub(/@@BOOTSTRAP_UNIT_B64@@/, unit); gsub(/@@BOOTSTRAP_ENV_B64@@/, env); print }
|
|
' "$HERE/stub-first-boot.sh" > "$STUB"
|
|
chmod 0755 "$STUB"
|
|
grep -q '@@BOOTSTRAP_.*_B64@@' "$STUB" && die "stub still has unfilled markers — injection failed"
|
|
fi # end: non-release answer/stub rendering
|
|
|
|
# --- RELEASE: build the felhom-bootstrap .deb from COMMITTED source (release gate G7/G9/G10) --------
|
|
RELEASE_DEB=""
|
|
if $RELEASE; then
|
|
log_step "building the felhom-bootstrap package"
|
|
[[ -x "$HERE/pkg/build-deb.sh" ]] || die "pkg/build-deb.sh not found next to build-felhom-iso.sh"
|
|
RELEASE_DEB="$("$HERE/pkg/build-deb.sh" "$ISO_VERSION" "$WORK/pkg")" \
|
|
|| die "package build FAILED (its own G8/G9 self-assertions gate it)"
|
|
log_success "package: $(basename "$RELEASE_DEB") ($(stat -c%s "$RELEASE_DEB") bytes)"
|
|
fi
|
|
|
|
# --- prepare-iso ----------------------------------------------------------------------------------
|
|
# (OUT_ISO is resolved above the mint — the rootpw sibling file is named after it.)
|
|
GRUB_VERSION="" # populated by the mkimage surgery (the grub-mkimage build used)
|
|
log_step "building ISO: $(basename "$OUT_ISO")"
|
|
if $DRY_RUN; then
|
|
log_dry "docker run … prepare-iso /iso/$ISO_BASE --fetch-from iso --answer-file /work/answer.toml --on-first-boot /work/stub-first-boot.sh --output /work/out.iso"
|
|
$BRAND && log_dry "docker run … (repack/brand) generate 1024x768 boot card from $(basename "$BRAND_IMAGE") → install felhomtheme → rewrite grub.cfg to ONE entry ('Felhom telepítés', 5s), kernel line lifted from the stock automated entry"
|
|
[[ "$LOADER" == "mkimage" ]] && log_dry "docker run … (repack/mkimage) grub-mkimage from the ISO's own modules → swap BOOTX64.EFI in the EFI tree + efi.img"
|
|
( $BRAND || [[ "$LOADER" == "mkimage" ]] ) && log_dry "docker run … (repack) xorriso re-master → /work/final.iso"
|
|
log_info "DRY-RUN: no ISO produced"
|
|
exit 0
|
|
fi
|
|
if $RELEASE; then
|
|
# NO prepare-iso. That step is what creates /answer.toml and /auto-installer-mode.toml, and their
|
|
# absence is release-gate G1 — it also removes the Automated menu entry by construction, since the
|
|
# stock grub.cfg emits it only inside `if [ -f auto-installer-mode.toml ]`.
|
|
log_info "release mode — skipping prepare-iso entirely (no answer file is created)"
|
|
cp "$PVE_ISO" "$WORK/out.iso"
|
|
else
|
|
docker run --rm -v "$ISO_DIR":/iso:ro -v "$WORK":/work "$IMAGE" \
|
|
proxmox-auto-install-assistant prepare-iso "/iso/$ISO_BASE" \
|
|
--fetch-from iso --answer-file /work/answer.toml \
|
|
--on-first-boot /work/stub-first-boot.sh \
|
|
--tmp /work/tmp --output /work/out.iso
|
|
fi
|
|
[[ -f "$WORK/out.iso" ]] || die "prepare-iso produced no output"
|
|
|
|
# --- REPACK: R-38 GRUB branding + single-entry menu, and (slice B) the mkimage loader surgery. Both
|
|
# need the same extract -> modify -> re-master cycle, so iso-repack.sh does them in ONE pass. The
|
|
# assistant's answer/first-boot payload is untouched; only the GRUB menu/theme and (mkimage) the
|
|
# EFI boot path change. The mkimage recipe is the N100 run's proven workaround (VALIDATION F1) —
|
|
# do NOT re-derive it. See iso-repack.sh for the full rationale. -----------------------------------
|
|
if $BRAND || [[ "$LOADER" == "mkimage" ]]; then
|
|
REPACK_WHAT=""
|
|
$BRAND && REPACK_WHAT="branding"
|
|
[[ "$LOADER" == "mkimage" ]] && REPACK_WHAT="${REPACK_WHAT:+$REPACK_WHAT + }mkimage loader"
|
|
log_step "repacking ISO ($REPACK_WHAT)"
|
|
[[ -f "$HERE/iso-repack.sh" ]] || die "iso-repack.sh not found next to build-felhom-iso.sh"
|
|
cp "$HERE/iso-repack.sh" "$WORK/iso-repack.sh"
|
|
if $BRAND; then
|
|
mkdir -p "$WORK/brand"
|
|
cp "$HERE/grub/grub.cfg.tmpl" "$HERE/grub/felhom-theme.txt" \
|
|
"$HERE/grub/generate-grub-background.sh" "$WORK/brand/"
|
|
cp "$BRAND_IMAGE" "$WORK/brand/card.png"
|
|
$RELEASE && cp "$HERE/grub/grub-release.cfg.tmpl" "$WORK/brand/"
|
|
fi
|
|
REPACK_MENU=single; $RELEASE && REPACK_MENU=release
|
|
REPACK_DEB=""
|
|
# Keep the package's REAL filename inside the ISO: it is how the shipped version is visible from
|
|
# the image alone (release gate G7), and how a tester can name what they installed.
|
|
if [[ -n "${RELEASE_DEB:-}" ]]; then
|
|
cp "$RELEASE_DEB" "$WORK/$(basename "$RELEASE_DEB")"
|
|
REPACK_DEB="/work/$(basename "$RELEASE_DEB")"
|
|
fi
|
|
docker run --rm -v "$WORK":/work \
|
|
-e FELHOM_LOADER="$LOADER" -e FELHOM_BRAND="$($BRAND && echo 1 || echo 0)" \
|
|
-e FELHOM_MENU="$REPACK_MENU" -e FELHOM_DEB="$REPACK_DEB" \
|
|
"$IMAGE" bash /work/iso-repack.sh 2>&1 | sed 's/^/ [repack] /'
|
|
[[ -f "$WORK/final.iso" ]] || die "repack produced no output (see [repack] log above)"
|
|
GRUB_VERSION="$(cat "$WORK/grub-version.txt" 2>/dev/null || echo unknown)"
|
|
cp "$WORK/final.iso" "$OUT_ISO"
|
|
log_success "repack applied ($REPACK_WHAT)"
|
|
else
|
|
cp "$WORK/out.iso" "$OUT_ISO"
|
|
fi
|
|
|
|
# --- sha256 + manifest ----------------------------------------------------------------------------
|
|
OUT_SHA="$(sha256sum "$OUT_ISO" | awk '{print $1}')"
|
|
OUT_SIZE="$(stat -c '%s' "$OUT_ISO")"
|
|
ASSISTANT_VER="$(docker run --rm "$IMAGE" proxmox-auto-install-assistant --version 2>&1 | head -1)"
|
|
echo "$OUT_SHA $(basename "$OUT_ISO")" > "$OUT_ISO.sha256"
|
|
LOADER_NOTE="shim (stock MS-signed chain; Secure Boot OK on compliant firmware)"
|
|
[[ "$LOADER" == "mkimage" ]] && LOADER_NOTE="mkimage (monolithic grub-mkimage UEFI loader, F1 fix — UNSIGNED; target board MUST have Secure Boot OFF)"
|
|
BRAND_NOTE="FELHOM (single entry 'Felhom telepítés', default, 5s; stock installer entries not emitted)"
|
|
$RELEASE && BRAND_NOTE="FELHOM release menu — TWO INTERACTIVE entries ('Felhom telepítés' graphical = default, 'Felhom telepítés (szöveges mód)' = Terminal UI), timeout 15s"
|
|
$BRAND || BRAND_NOTE="STOCK PVE menu (--no-brand; DEBUG BUILD — manual installer reachable, do not ship)"
|
|
MODE_NOTE="direct (env-baked customer-id + retrieval passphrase; secret-bearing)"
|
|
$PAIRING && MODE_NOTE="pairing (GENERIC secret-free universal ISO — box self-registers, operator binds, hub delivers once)"
|
|
$RELEASE && MODE_NOTE="release (PUBLIC image — NO answer.toml, NO baked credential, interactive disk selection)"
|
|
cat > "$OUT_ISO.manifest.txt" <<EOF
|
|
Felhom bare-metal ISO build manifest (R-21 slice A+B+C)
|
|
built : $(date -Is)
|
|
iso-version-tag : v${ISO_VERSION}
|
|
pve-version : ${PVE_VERSION}
|
|
source-iso : ${ISO_BASE}
|
|
source-iso-sha256 : ${ISO_SHA256}
|
|
assistant-version : ${ASSISTANT_VER}
|
|
profile : $( $RELEASE && echo 'none (a release image bakes no disk selection)' || echo "${PROFILE_NAME}" )
|
|
fqdn : ${FELHOM_FQDN}
|
|
mode : ${MODE_NOTE}
|
|
loader : ${LOADER_NOTE}
|
|
grub-mkimage : ${GRUB_VERSION:-n/a (shim mode; loader unchanged)}
|
|
boot-menu : ${BRAND_NOTE}
|
|
$( if $RELEASE; then
|
|
echo "menu-entries : 2 (graphical default + Terminal UI; timeout 15s)"
|
|
echo "menu-removed : debug variants, Rescue Boot, memtest86+, UEFI Firmware Settings"
|
|
echo "automated-entry : NOT PRESENT — no auto-installer-mode.toml, so the stock grub.cfg does"
|
|
echo " not emit it. Disk selection is INTERACTIVE by construction."
|
|
else
|
|
$BRAND && cat "$WORK/brand-report.txt" 2>/dev/null || true
|
|
fi )
|
|
host-install-url : $(grep -oE 'FELHOM_INSTALL_URL=[^ ]*' "$BOOTSTRAP_ENV" 2>/dev/null || echo 'https://felhom.eu/scripts/felhom-host-install.sh (default)')
|
|
secret-bearing : ${SECRET_BEARING}$( $RELEASE && echo ' (PUBLIC image — carries NO credential of any kind)' || { $PAIRING && echo ' (GENERIC ISO — carries NO customer secret)' || echo ' (embeds the customer retrieval passphrase — supervised/single-use, delete after the run)'; } )
|
|
root-password : $( $RELEASE && echo 'NONE — not baked. The installer prompts the person installing (release gate G2).' || echo "see $(basename "$OUT_ISO").rootpw.txt (operator-only; NEVER commit or paste into REPORTs)" )
|
|
answer-file : $( $RELEASE && echo 'NONE — no answer.toml, no auto-installer-mode.toml (release gate G1)' || echo 'baked (/answer.toml)' )
|
|
felhom-package : $( [[ -n "$RELEASE_DEB" ]] && echo "$(basename "$RELEASE_DEB") sha256=$(sha256sum "$RELEASE_DEB" | cut -d\ -f1)" || echo 'n/a (day-0 rides the answer file first-boot hook)' )
|
|
repo-commit : $(cd "$HERE" && git rev-parse HEAD 2>/dev/null || echo unknown)
|
|
output : $(basename "$OUT_ISO")
|
|
output-sha256 : ${OUT_SHA}
|
|
output-size-bytes : ${OUT_SIZE}
|
|
EOF
|
|
|
|
log_success "ISO built: $OUT_ISO"
|
|
log_info "sha256 : $OUT_SHA"
|
|
log_info "size : $OUT_SIZE bytes"
|
|
log_info "manifest : $OUT_ISO.manifest.txt"
|
|
if $RELEASE; then
|
|
log_info "root-pw : NONE — no password is baked and no .rootpw.txt is emitted (release gate G2)"
|
|
else
|
|
log_info "root-pw : $OUT_ISO.rootpw.txt (0600, operator-only — the console credential for this build; never commit/paste)"
|
|
fi
|
|
if $RELEASE; then
|
|
log_success "PUBLIC RELEASE image — no answer file, no baked credential, interactive disk selection."
|
|
log_info "Run the release gate before publishing: documentation/runbooks/iso-release-gate.md"
|
|
elif $PAIRING; then
|
|
log_success "GENERIC secret-free ISO — carries NO customer secret. Bind the box on the hub after it registers."
|
|
else
|
|
log_warn "SECRET-BEARING ISO (embeds the retrieval passphrase). Supervised/single-use; never distribute; delete after the run."
|
|
fi
|