lfg2025/archy
1
0
Fork 0
Code Issues 24 Pull Requests 1 Actions 1 Packages Projects Releases 63 Wiki Activity
archy/image-recipe/_archived
History
Dorian caf9e6d3a3 feat(iso): per-device secrets on first boot + checksum emission and signing 
- archipelago-first-boot-secrets.service regenerates the self-signed TLS
  keypair (device hostname in SAN) and all SSH host keys on the installed
  system's first boot, before ssh/nginx start — the squashfs bakes one
  key set at build time, so every flashed device shared them (§F 🔴)
- staging-first swaps: a failed regeneration keeps the baked keys rather
  than leaving the device keyless
- the builder now emits <iso>.sha256 next to the ISO, and
  scripts/sign-iso-checksums.sh signs {artifact,sha256,size} as a JSON
  doc with the release-root ceremony (verify: ceremony verify) (§F 🟠)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-13 13:41:16 +01:00
..
.gitea-workflows
chore: purge retired git.tx1138.com registry host from the codebase
2026-07-10 18:55:32 +01:00
branding
chore(release): archive ISO build recipes, tarball-only releases
2026-04-23 15:36:00 -04:00
scripts
chore(release): archive ISO build recipes, tarball-only releases
2026-04-23 15:36:00 -04:00
build-auto-installer-iso.sh
feat(iso): per-device secrets on first boot + checksum emission and signing
2026-07-13 13:41:16 +01:00
BUILD-ISO-STATUS.md
chore(release): archive ISO build recipes, tarball-only releases
2026-04-23 15:36:00 -04:00
build-unbundled-iso.sh
chore(release): archive ISO build recipes, tarball-only releases
2026-04-23 15:36:00 -04:00
ISO-BUILD-CHECKLIST.md
chore(release): archive ISO build recipes, tarball-only releases
2026-04-23 15:36:00 -04:00
README.md
chore(release): archive ISO build recipes, tarball-only releases
2026-04-23 15:36:00 -04:00
test-iso-qemu.sh
chore(release): archive ISO build recipes, tarball-only releases
2026-04-23 15:36:00 -04:00

README.md

Archived ISO build recipes

These scripts built the Archipelago auto-installer ISO (bundled and unbundled variants). As of v1.7.43-alpha, ISOs are no longer part of the release deliverable. Releases ship as tarballs consumed by scripts/self-update.sh on existing nodes.

Archived here rather than deleted so they can be resurrected if ISO distribution is reintroduced.

Contents

  • build-auto-installer-iso.sh — orchestrator, bundles container images into squashfs
  • build-unbundled-iso.sh — thin wrapper that sets BUNDLE_IMAGES=0 and delegates
  • test-iso-qemu.sh — smoke-tests a built ISO under QEMU
  • scripts/convert-iso-to-disk.sh — converts an ISO to a raw disk image
  • BUILD-ISO-STATUS.md, ISO-BUILD-CHECKLIST.md — contributor guides
  • branding/isohdpfx.bin — isolinux MBR hybrid image
  • .gitea-workflows/build-iso-dev.yml — CI workflow that ran the build+smoke-test

To resurrect

  1. git mv image-recipe/_archived/* image-recipe/ (adjust paths back)
  2. Restore .gitea/workflows/build-iso-dev.yml
  3. Re-add release-process references (see scripts/create-release.sh, docs/BETA-RELEASE-CHECKLIST.md, docs/hotfix-process.md, README.md).

Why archived

The release flow is simpler and faster as tarball-only:

  • releases/vX.Y.Z-alpha/archipelago (backend binary)
  • releases/vX.Y.Z-alpha/archipelago-frontend-X.Y.Z-alpha.tar.gz (frontend + AIUI + filebrowser UI assets)
  • releases/manifest.json (pointers + changelog)

Nodes pull these via scripts/self-update.sh from either Gitea mirror. Filebrowser and AIUI remain bundled inside the frontend tarball and deployed atomically by self-update.sh.