admin
3172df1927
Closes N100 F1 (HIGH): cheap AMI (AN3PLUS 0.01-class) UEFI firmware can't relocate the ISO's stock signed GRUB from USB (relocation 0x0). The run's live grub-mkimage workaround is now a first-class pipeline mode. - build-felhom-iso.sh: --loader shim|mkimage (default shim, byte-for-byte unchanged; profile-settable FELHOM_LOADER; --loader wins). Loud banner + manifest loader:/grub-mkimage: fields + -mkimage filename suffix. - mkimage-surgery.sh (new): post-prepare-iso, in the assistant container. Builds a monolithic grub-mkimage loader from the ISO's own GRUB (module set from its grub.cfg; embedded search --fs-uuid -> configfile the real menu). Swaps it into the ISO9660 tree (real lowercase path) + the efi.img ESP; xorriso re-master preserves BIOS-hybrid + UEFI + GPT-ESP, drops only Apple HFS+/APM. Recipe from the N100 run evidence, not re-derived. - Dockerfile.assistant: grub-common + grub-efi-amd64-bin + mtools + dosfstools. profiles/n100.profile (new, mkimage + SB-off note). - Validated on nested VM 311 (RUNBOOK-B legs): leg1 shim boots+installs under OVMF SB-enforcing + SeaBIOS; leg2 mkimage boots+installs under SB-off; leg3 (red-proof) mkimage under SB-enforcing FAILS Access Denied (unsigned -> SB must be OFF); leg4 surgery byte-identical payload. bash -n + shellcheck clean. Physical N100 closure folds into the rehearsal (n100-safety match-nothing ISO built + sha-recorded, unbooted). PXE stays a deferred R-21 note.
30 lines
1.7 KiB
Docker
30 lines
1.7 KiB
Docker
# scripts/iso/Dockerfile.assistant — the build host for the Felhom bare-metal ISO pipeline (R-21).
|
|
#
|
|
# Debian trixie == PVE 9.x codename; the proxmox-auto-install-assistant is pinned to the ISO
|
|
# generation by installing it from the PVE no-subscription repo of the ISO's Debian codename
|
|
# (spike SPIKE-baremetal-iso-2026-07-16.md §15.6: pair by major.minor). Rebuild this image when the
|
|
# target PVE generation changes (e.g. PVE 10 -> Debian forky) and record both versions in the build
|
|
# manifest.
|
|
#
|
|
# Build: docker build -f scripts/iso/Dockerfile.assistant -t felhom-iso-assistant:trixie scripts/iso
|
|
FROM debian:trixie
|
|
|
|
# xorriso: ISO (re-)mastering. shellcheck: lint. grub-mkimage (+ x86_64-efi module dir) and mtools:
|
|
# the slice-B mkimage loader surgery — build a monolithic UEFI loader from the ISO's own GRUB modules
|
|
# and inject it into the efi.img ESP (FAT, via mtools). grub 2.12 on trixie == the PVE 9.x ISO's
|
|
# 2.12-9+pmx2 generation, so the tool matches the modules it embeds.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates wget gnupg xorriso shellcheck \
|
|
grub-common grub-efi-amd64-bin mtools dosfstools \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# PVE 9.x (trixie) no-subscription repo — pairs the assistant to the 9.2 ISO generation.
|
|
RUN wget -q https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg \
|
|
-O /etc/apt/trusted.gpg.d/proxmox-release-trixie.gpg
|
|
RUN echo "deb http://download.proxmox.com/debian/pve trixie pve-no-subscription" \
|
|
> /etc/apt/sources.list.d/pve.list
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
proxmox-auto-install-assistant \
|
|
&& rm -rf /var/lib/apt/lists/*
|