Amc/Blueforce-Linux
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Blueforce-Linux/provisioning
History
emirhanmamak-blueforce e28783e563 feat(offline-repo): build the APT index so installs work without network 
The package pool was committed but the installer still stopped at "no local
package repository": it requires the compiled bundle (Packages, Packages.gz,
packages.lock.tsv, SHA256SUMS), and building that had never run.

The bundle
- 1321 packages, 884 MiB, Ubuntu 26.04 amd64, built with apt-ftparchive on the
  fleet's own release so the closure matches the devices.
- built/pool/ is gitignored: those .deb files are already tracked once under
  provisioning/offline-repo/packages/, and the same ~890 MB does not need a
  second path. What the installer reads from the bundle is the index.
- The output directory is chmod 0755: mktemp -d created it 0700 and left it
  so, which made a valid bundle unreadable to the installer's probe.

dpkg-deb output was parsed wrong in four places
- `dpkg-deb -f <file> Package Version` prints "<Field>: <value>", and the
  callers kept the whole line, so the value carried its label. build-index.sh
  therefore accepted no package at all and reported an empty pool;
  add-packages.sh rejected every real .deb as an invalid name, missed version
  conflicts, and copied a duplicate; build-offline-repo.sh never matched a pin.
- The test suite could not see any of this: its dpkg-deb stub emitted bare
  values. The stub now prints the labels exactly as the real tool does, which
  is what surfaced the remaining three sites.

Tests
- The secret scan covers the files we author, not apt-ftparchive's index over
  third-party packages: polkit's own description reads "...asked for their
  password:", which is prose in the packages, not a leak. Any secret reaching a
  manifest, README or tool is still caught.
- The "test build must not touch the bundle" assertion now compares the
  directory before and after instead of demanding it be empty, so a
  maintainer's real build is not reported as test spill.
2026-09-16 21:42:27 +03:00
..
autoinstall feat(field-os): provisioning layer, real ISO build, offline contracts 2026-09-16 11:14:42 +03:00
enrollment feat(field-os): provisioning layer, real ISO build, offline contracts 2026-09-16 11:14:42 +03:00
firstboot feat(install): internet-free install flow, auto-discovered local packages 2026-09-16 16:53:24 +03:00
iso feat(install): internet-free install flow, auto-discovered local packages 2026-09-16 16:53:24 +03:00
offline-repo feat(offline-repo): build the APT index so installs work without network 2026-09-16 21:42:27 +03:00
release feat(field-os): provisioning layer, real ISO build, offline contracts 2026-09-16 11:14:42 +03:00
README.md feat(field-os): provisioning layer, real ISO build, offline contracts 2026-09-16 11:14:42 +03:00

README.md

Blueforce OS provisioning

Bu dizin işletim sistemi provisioning kapsamının sahibidir. Mevcut scripts/install/ uygulama bootstrap'ı olarak kalır ve burada taşınmaz.

Güvenlik sınırları:

  • Bu iskelet cihaz kimliği, parola, private key, token veya bayiye özel veri içermez.
  • Autoinstall V1 disk seçmez ve silmez; interactive-sections: [storage] teknisyen seçimini zorunlu tutar.
  • Upstream ISO ve paketler örtük indirilmez. Her ISO işleminden önce açık SHA256 doğrulaması gerekir.
  • Remaster araçları xorriso yoksa veya boot metadatası desteklenmiyorsa başarısız olur.
  • Firstboot sadece sekiz haneli bayi numarası biçimini denetler; kurucu veya enrollment çağrısı yapmaz.

Kontrol:

tests/check-provisioning-static.sh

LAB doğrulaması, hedef Ubuntu sürümü, boot menüsü entegrasyonu, gerçek identity storage ve enrollment taşıma güvenliği sonraki fazların açık işleridir.