From 533c0713c76c2423a98e023f74fbdc0dc29ff0a5 Mon Sep 17 00:00:00 2001 From: Dorian Date: Mon, 13 Jul 2026 13:42:23 +0100 Subject: [PATCH] =?UTF-8?q?docs(tracker):=20tick=20=C2=A7F=20per-device=20?= =?UTF-8?q?secrets=20+=20ISO=20checksums=20(caf9e6d3)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- docs/1.8.0-RELEASE-HARDENING-PLAN.md | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/docs/1.8.0-RELEASE-HARDENING-PLAN.md b/docs/1.8.0-RELEASE-HARDENING-PLAN.md index e3f39431..4c2a2c24 100644 --- a/docs/1.8.0-RELEASE-HARDENING-PLAN.md +++ b/docs/1.8.0-RELEASE-HARDENING-PLAN.md @@ -295,15 +295,22 @@ media (latest artifact only one minor behind). so alpha/beta testers get frictionless AI (deliberate — per user 2026-07-02). **Do NOT remove for alpha/beta.** Before public GA it MUST be removed + rotated + injected at runtime (a second copy also exists in a worktree). Track it here so it can't be forgotten at launch. -- [ ] 🔴 **Per-device secrets on first boot.** The self-signed TLS **private key is generated - at build time** (`:426`) → every device ships the same key; SSH host keys likewise not - regenerated. Generate TLS + SSH host keys on first boot. +- [x] 🔴 **Per-device secrets on first boot.** DONE 2026-07-13 (`caf9e6d3`): + `archipelago-first-boot-secrets.service` (enabled on the installed target, ordered + Before=ssh/nginx/archipelago, marker-guarded) regenerates the self-signed TLS keypair + with the device hostname in the SAN and all SSH host keys via staging-first swap — + a failed regeneration keeps the baked keys instead of leaving the device keyless. + **Unverified on hardware**: needs one RC-ISO install to confirm the service fires + and sshd/nginx pick up the new keys. - [ ] 🟠 **Kill default credentials.** `archipelago`/`archipelago` (SSH+root), web `password123`, and SSH `PasswordAuthentication yes` (`:411`) all ship. Lock root, force credential creation in onboarding, disable SSH password auth (or force-change on first login). -- [ ] 🟠 **Sign + checksum the ISO.** Pipeline ends at `xorriso` with no `SHA256SUMS`, no - GPG/minisign, no Secure Boot (`BOOTX64.EFI` is unsigned though `grub-efi-amd64-signed` is - installed). Emit + sign checksums; wire signed Secure Boot. +- [~] 🟠 **Sign + checksum the ISO.** Checksums DONE 2026-07-13 (`caf9e6d3`): the builder + emits `.sha256` after xorriso, and `scripts/sign-iso-checksums.sh` signs + `{artifact, sha256, size}` as a JSON doc with the release-root ceremony (verify with + `archipelago ceremony verify` against the pinned anchor; build host never holds the + key). **Still open:** Secure Boot — `BOOTX64.EFI` is unsigned though + `grub-efi-amd64-signed` is installed. - [ ] 🟠 **Registries over HTTPS in the image too** — `146.59.87.168:3000` are baked `insecure=true`/`tls_verify:false` (`:216`, `:2308`). (Ties to §A.) - [ ] 🟡 **Add `unattended-upgrades` + a default-deny nftables firewall** (allow 22/80/443 + @@ -404,8 +411,7 @@ media (latest artifact only one minor behind). 6. **Before public GA only (NOT alpha/beta):** remove + rotate the Anthropic key (§F) — intentionally left in for frictionless AI during alpha/beta. -*Last updated: 2026-07-08 PM (hardening session 3: §C secrets verified on .228, -§B release-path guards `e77ccff0`, §H test creds/timeouts `380f4f19`, mempool -umbrella lifecycle fix `161a6e4d` from the first quadlet-mode gate run; new -finding: manifests hardcoding secrets in plain `environment:`). Update this -line + tick boxes with commit shas as items land.* +*Last updated: 2026-07-13 (hardening session 4: §F per-device first-boot +secrets + ISO checksum emission/ceremony signing `caf9e6d3` — both need one +RC-ISO install to verify on hardware; Secure Boot remains the open half of +ISO signing). Update this line + tick boxes with commit shas as items land.*