lfg2025/archy
1
0
Fork 0
Code Issues 20 Pull Requests Actions Packages Projects Releases 61 Wiki Activity

iso: per-device first-boot secrets + checksum emission/signing #75

Closed
lfg2025 wants to merge 0 commits from iso-first-boot-secrets into main
pull from: iso-first-boot-secrets
merge into: lfg2025:main
Conversation 0 Commits - Files Changed -
lfg2025 commented 2026-07-13 12:44:10 +00:00
Owner
Copy Link
  • archipelago-first-boot-secrets.service: regenerates TLS keypair (hostname SAN) + SSH host keys on first boot, staging-first swap, marker-guarded, enabled on the installed target (§F critical)
  • builder emits .sha256 after xorriso; scripts/sign-iso-checksums.sh signs {artifact,sha256,size} with the release-root ceremony (§F)
  • tracker ticked with shas

🤖 Generated with Claude Code

- archipelago-first-boot-secrets.service: regenerates TLS keypair (hostname SAN) + SSH host keys on first boot, staging-first swap, marker-guarded, enabled on the installed target (§F critical) - builder emits <iso>.sha256 after xorriso; scripts/sign-iso-checksums.sh signs {artifact,sha256,size} with the release-root ceremony (§F) - tracker ticked with shas 🤖 Generated with [Claude Code](https://claude.com/claude-code)
lfg2025 added 2 commits 2026-07-13 12:44:11 +00:00 
- archipelago-first-boot-secrets.service regenerates the self-signed TLS
  keypair (device hostname in SAN) and all SSH host keys on the installed
  system's first boot, before ssh/nginx start — the squashfs bakes one
  key set at build time, so every flashed device shared them (§F 🔴)
- staging-first swaps: a failed regeneration keeps the baked keys rather
  than leaving the device keyless
- the builder now emits <iso>.sha256 next to the ISO, and
  scripts/sign-iso-checksums.sh signs {artifact,sha256,size} as a JSON
  doc with the release-root ceremony (verify: ceremony verify) (§F 🟠)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ai closed this pull request 2026-07-13 12:49:40 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ai ssmithx lfg2025
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: lfg2025/archy#75
No description provided.
Delete Branch "iso-first-boot-secrets"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?