admin
01a8155c5a
Design inputs: SPIKE-universal-iso-{1,2,3,4}-2026-07-31.md. Every choice below is a measurement.
NEW: scripts/iso/pkg/ — the felhom-bootstrap .deb, built from committed source.
Two files only (script + unit), NOT three: felhom-bootstrap.sh:91 reads /etc/felhom/bootstrap.env
only 'if [[ -r ]]', and its defaults at :95-96 are EXACTLY what the pairing env set
(build-felhom-iso.sh:257-258) — so shipping it would add a 0600 file to a public package to express
values the script already defaults to. NO dependencies: the binaries it calls run at FIRST BOOT,
not at postinst time, so SPIKE 4's open 'dpkg --configure -a' ordering question does not arise.
The postinst is structurally incapable of failing (no 'set -e', every statement guarded, ends
'exit 0'); build-deb.sh self-asserts G8/G9 and REFUSES to emit a package that violates them.
iso-repack.sh — two changes, both narrowing rather than deleting:
- R-155 guard: now applies to FELHOM_MENU=single ONLY. It protected the single-entry mode's promise
(one button labelled 'install' must not drop into a disk-picker); a release image carries no
auto-installer-mode.toml BY DESIGN (gate G1), so refusing it would be the guard firing on the
shape it describes rather than the one it prevents.
- the menu collapse now has a release mode: two INTERACTIVE entries, Graphical default, timeout 15.
Entry-count and banned-token gates are per-mode; the six-token list is UNCHANGED for single mode.
- .deb injection into /proxmox/packages/, with a skip-list collision check (a colliding name would
be dropped silently — the inert-payload class) and a post-remaster assertion that it landed in
final.iso, not merely in the extract tree.
build-felhom-iso.sh — --release: no profile, no root hash, no answer.toml, no prepare-iso at all.
Skipping prepare-iso is what removes the Automated entry by construction, since the stock grub.cfg
emits it only inside 'if [ -f auto-installer-mode.toml ]'.
R-128 RULING — FIXED, by correcting the claim rather than inventing an assertion for it. The comment
said ISO_VERSION 'aligns with SCRIPT_VERSION'; nothing evaluated it and the two had drifted. The
coupling does not exist: the ISO is frozen, felhom-host-install.sh is fetched at run time from main
(R-94/R-110), so an assertion would invent a constraint. Comment corrected, ISO_VERSION -> 1.26.0.
Release gate G6 AMENDED before the build, with its reasoning recorded in the runbook: the six-token
ban existed to keep users away from the manual installer, which the ruling makes the product.
'proxtui' (the TUI installer we ship) and 'nomodeset' (its graphics fallback) are dropped for
release images; proxdebug/Rescue Boot/memtest/fwsetup stay banned in both modes.
46 lines
2.4 KiB
Bash
Executable File
46 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# felhom-bootstrap postinst.
|
|
#
|
|
# THIS SCRIPT MUST NOT BE ABLE TO FAIL. It runs under `dpkg --configure -a` INSIDE THE PVE INSTALLER
|
|
# CHROOT, in the middle of a customer's installation. A non-zero exit surfaces to that customer as an
|
|
# install error — far worse than the bootstrap simply not running. The stub not running costs one
|
|
# documented command; a broken install costs the machine.
|
|
#
|
|
# Four constraints, every one MEASURED in SPIKE-universal-iso-4-2026-07-31.md §3:
|
|
# 1. NO `set -e` — it converts any unexpected non-zero into the failure above.
|
|
# 2. NO systemctl start / daemon-reload — pid1 in the chroot is `unconfigured.sh` and NO systemd is
|
|
# running; those verbs are meaningless there. `enable` is the only one
|
|
# that works, and it was measured to work (it wrote the symlink).
|
|
# 3. NO network use — the network was up in the probe ONLY because the installer's DHCP
|
|
# happened to hold. A box installed with the cable out has none.
|
|
# 4. Real work at first boot — the unit does it, where systemd, network and a booted kernel exist.
|
|
#
|
|
# Every statement below is therefore individually guarded and the script ends `exit 0` unconditionally.
|
|
|
|
UNIT=felhom-bootstrap.service
|
|
LOG=/var/log/felhom-bootstrap-postinst.log
|
|
|
|
# A positive observable that this ran. SPIKE 2 R-150: a hook that never ran is indistinguishable from
|
|
# one that succeeded if you only look for errors.
|
|
{
|
|
echo "felhom-bootstrap postinst: arg1=${1:-} date=$(date -u -Is 2>/dev/null || echo unknown)"
|
|
} >> "$LOG" 2>&1 || true
|
|
chmod 0644 "$LOG" 2>/dev/null || true
|
|
|
|
if [ "${1:-}" = "configure" ]; then
|
|
# `enable` only. Guarded, and its outcome recorded either way.
|
|
if systemctl enable "$UNIT" >> "$LOG" 2>&1; then
|
|
echo "felhom-bootstrap postinst: enabled $UNIT via systemctl" >> "$LOG" 2>&1 || true
|
|
else
|
|
# Fallback: write the wants-symlink by hand. Also guarded — if this fails too, the unit is
|
|
# simply not enabled and the operator runs the documented one-liner. The install still succeeds.
|
|
mkdir -p /etc/systemd/system/multi-user.target.wants 2>/dev/null || true
|
|
ln -sf "/lib/systemd/system/$UNIT" \
|
|
"/etc/systemd/system/multi-user.target.wants/$UNIT" 2>/dev/null || true
|
|
echo "felhom-bootstrap postinst: systemctl enable failed; wrote wants-symlink by hand" \
|
|
>> "$LOG" 2>&1 || true
|
|
fi
|
|
fi
|
|
|
|
exit 0
|