lfg2025/archy
1
0
Fork 0
Code Issues 20 Pull Requests Actions Packages Projects Releases 61 Wiki Activity

docs(tracker): tick §F per-device secrets + ISO checksums (caf9e6d3)

Browse Source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Dorian 2026-07-13 13:42:23 +01:00
parent caf9e6d3a3
commit 533c0713c7
1 changed files with 17 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
docs/1.8.0-RELEASE-HARDENING-PLAN.md
View File

@ -295,15 +295,22 @@ media (latest artifact only one minor behind).
so alpha/beta testers get frictionless AI (deliberate — per user 2026-07-02). **Do NOT
remove for alpha/beta.** Before public GA it MUST be removed + rotated + injected at runtime
(a second copy also exists in a worktree). Track it here so it can't be forgotten at launch.
- [ ] 🔴 **Per-device secrets on first boot.** The self-signed TLS **private key is generated
at build time** (`:426`) → every device ships the same key; SSH host keys likewise not
regenerated. Generate TLS + SSH host keys on first boot.
- [x] 🔴 **Per-device secrets on first boot.** DONE 2026-07-13 (`caf9e6d3`):
`archipelago-first-boot-secrets.service` (enabled on the installed target, ordered
Before=ssh/nginx/archipelago, marker-guarded) regenerates the self-signed TLS keypair
with the device hostname in the SAN and all SSH host keys via staging-first swap —
a failed regeneration keeps the baked keys instead of leaving the device keyless.
**Unverified on hardware**: needs one RC-ISO install to confirm the service fires
and sshd/nginx pick up the new keys.
- [ ] 🟠 **Kill default credentials.** `archipelago`/`archipelago` (SSH+root), web `password123`,
and SSH `PasswordAuthentication yes` (`:411`) all ship. Lock root, force credential
creation in onboarding, disable SSH password auth (or force-change on first login).
- [ ] 🟠 **Sign + checksum the ISO.** Pipeline ends at `xorriso` with no `SHA256SUMS`, no
GPG/minisign, no Secure Boot (`BOOTX64.EFI` is unsigned though `grub-efi-amd64-signed` is
installed). Emit + sign checksums; wire signed Secure Boot.
- [~] 🟠 **Sign + checksum the ISO.** Checksums DONE 2026-07-13 (`caf9e6d3`): the builder
emits `<iso>.sha256` after xorriso, and `scripts/sign-iso-checksums.sh` signs
`{artifact, sha256, size}` as a JSON doc with the release-root ceremony (verify with
`archipelago ceremony verify` against the pinned anchor; build host never holds the
key). **Still open:** Secure Boot — `BOOTX64.EFI` is unsigned though
`grub-efi-amd64-signed` is installed.
- [ ] 🟠 **Registries over HTTPS in the image too** — `146.59.87.168:3000`
are baked `insecure=true`/`tls_verify:false` (`:216`, `:2308`). (Ties to §A.)
- [ ] 🟡 **Add `unattended-upgrades` + a default-deny nftables firewall** (allow 22/80/443 +
@ -404,8 +411,7 @@ media (latest artifact only one minor behind).
6. **Before public GA only (NOT alpha/beta):** remove + rotate the Anthropic key (§F) —
intentionally left in for frictionless AI during alpha/beta.
*Last updated: 2026-07-08 PM (hardening session 3: §C secrets verified on .228,
§B release-path guards `e77ccff0`, §H test creds/timeouts `380f4f19`, mempool
umbrella lifecycle fix `161a6e4d` from the first quadlet-mode gate run; new
finding: manifests hardcoding secrets in plain `environment:`). Update this
line + tick boxes with commit shas as items land.*
*Last updated: 2026-07-13 (hardening session 4: §F per-device first-boot
secrets + ISO checksum emission/ceremony signing `caf9e6d3` — both need one
RC-ISO install to verify on hardware; Secure Boot remains the open half of
ISO signing). Update this line + tick boxes with commit shas as items land.*