admin
3172df1927
Closes N100 F1 (HIGH): cheap AMI (AN3PLUS 0.01-class) UEFI firmware can't relocate the ISO's stock signed GRUB from USB (relocation 0x0). The run's live grub-mkimage workaround is now a first-class pipeline mode. - build-felhom-iso.sh: --loader shim|mkimage (default shim, byte-for-byte unchanged; profile-settable FELHOM_LOADER; --loader wins). Loud banner + manifest loader:/grub-mkimage: fields + -mkimage filename suffix. - mkimage-surgery.sh (new): post-prepare-iso, in the assistant container. Builds a monolithic grub-mkimage loader from the ISO's own GRUB (module set from its grub.cfg; embedded search --fs-uuid -> configfile the real menu). Swaps it into the ISO9660 tree (real lowercase path) + the efi.img ESP; xorriso re-master preserves BIOS-hybrid + UEFI + GPT-ESP, drops only Apple HFS+/APM. Recipe from the N100 run evidence, not re-derived. - Dockerfile.assistant: grub-common + grub-efi-amd64-bin + mtools + dosfstools. profiles/n100.profile (new, mkimage + SB-off note). - Validated on nested VM 311 (RUNBOOK-B legs): leg1 shim boots+installs under OVMF SB-enforcing + SeaBIOS; leg2 mkimage boots+installs under SB-off; leg3 (red-proof) mkimage under SB-enforcing FAILS Access Denied (unsigned -> SB must be OFF); leg4 surgery byte-identical payload. bash -n + shellcheck clean. Physical N100 closure folds into the rehearsal (n100-safety match-nothing ISO built + sha-recorded, unbooted). PXE stays a deferred R-21 note.
28 lines
1.4 KiB
Plaintext
28 lines
1.4 KiB
Plaintext
# Felhom ISO build profile — n100 / cheap-board (R-21 slice B).
|
|
#
|
|
# The canonical profile for cheap mini-PCs whose early AMI (AN3PLUS-class) UEFI firmware CANNOT boot
|
|
# the ISO's stock signed GRUB from USB (VALIDATION-n100-baremetal F1, `relocation 0x0`). It flips the
|
|
# loader to `mkimage` — a monolithic grub-mkimage UEFI loader built from the ISO's own GRUB, proven
|
|
# live on the N100 board.
|
|
#
|
|
# ⚠ SECURE BOOT MUST BE OFF on the target board. The mkimage loader is UNSIGNED; with Secure Boot
|
|
# enforcing the firmware refuses it ("Access Denied", no boot — proven, RUNBOOK-B leg 3). Compliant
|
|
# firmware should use the default `shim` loader (drop FELHOM_LOADER) to keep Secure Boot working.
|
|
#
|
|
# This template ships a MATCH-NOTHING disk filter as a safety default — REPLACE the serial with the
|
|
# target SSD's real ID_SERIAL_SHORT (harvested pre-wipe; see README "N100 profile") before a real
|
|
# install, or the installer fails-safe (aborts, touches no disk — spike S5c).
|
|
|
|
FELHOM_FQDN="felhom-host.local"
|
|
|
|
# mkimage loader (F1 firmware fix). Remove this line on Secure-Boot-capable/compliant firmware.
|
|
FELHOM_LOADER="mkimage"
|
|
|
|
FELHOM_DISK_SETUP='[disk-setup]
|
|
filesystem = "ext4"
|
|
filter-match = "all"
|
|
filter.ID_SERIAL_SHORT = "REPLACE-WITH-TARGET-SSD-SERIAL"'
|
|
|
|
# Optional emergency/validation key baked into root's authorized_keys (blank -> not baked):
|
|
# FELHOM_ROOT_SSH_KEY="ssh-ed25519 AAAA... ops@felhom"
|