flan/arch-turnkey
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity
Files
master
arch-turnkey/CHANGELOG.md
T
flan 620980b730 Lint: scope the private-infra guard to the build and source 
The guard exists so a stranger's install is never pointed at the
maintainer's forge — a property of what an install executes and ships
(bootstrap.sh, firstboot.sh, configs/, iso/), not of documentation.
Grep only those paths, so README/docs may link to the canonical forge
(fixes the red master from the build-status badge).
2026-08-04 02:55:29 +00:00

3.3 KiB
Raw Permalink Blame History

Changelog

All notable changes to arch-turnkey are documented here. Format: Keep a Changelog; versioning: SemVer.

[Unreleased]

Changed

  • The private-infrastructure lint guard is scoped to the build and source (bootstrap.sh, firstboot.sh, configs/, iso/) instead of the whole tree. The guarantee it enforces is that nothing an install executes or ships points at the maintainer's infrastructure; docs and the README may now link there (e.g. a build-status badge for the canonical forge's CI).

Added

  • site.env — personal provisioning is now opt-in and out of the repo. The install runs in two phases: a generic base (LUKS + btrfs subvolumes + snapper + yay) that works from a fresh clone with no configuration, and a personal phase (vault unlock → register the new machine's SSH key with your forge → clone your dotfiles → yadm bootstrap) driven by a gitignored site.env. With no site.env, firstboot reports what it is skipping and leaves a complete system. See docs/SITE.md and configs/site.env.example.
  • iso/build.sh bakes site.env into a custom ISO, so an unattended personal install stays a single boot with no extra typing. Without one it builds a generic installer ISO.
  • ARCH_TURNKEY_BASE — one fetch root feeds bootstrap.sh, the archinstall custom-commands (via an @@BASE@@ placeholder) and the ISO autorun. Defaults to the public GitHub mirror; set it to install from your own forge instead.
  • GitHub CI: shellcheck + bash -n on every script, archinstall.json JSON validation, a check that no @@BASE@@ placeholder survives substitution, and a guard that fails the build if private infrastructure is ever referenced from this public repo.
  • MIT LICENSE. Without one, an "install script for everyone" was legally unusable by anyone.

Fixed

  • The installer only worked for its author. bootstrap.sh and the archinstall custom-commands fetched from one specific private Gitea, and firstboot.sh cloned a private dotfiles repo from it. Anyone else cloning this got an installer that could not work and that pointed them at a repository they cannot read.
  • The README advertised ISO downloads from a Releases page that did not, and could not, exist. It now tells you to build the ISO with iso/build.sh and explains why no prebuilt image is published.

Security

  • bootstrap.sh now verifies the fetched archinstall.json before running it. Its custom-commands execute as root during install, so a config poisoned by a compromised mirror was root RCE at install time — TLS authenticates the transport, not the upstream. The config is checked against a SHA-256 pinned in the script by default; ARCH_TURNKEY_CONFIG_SHA256 overrides it (=skip opts out), and ARCH_TURNKEY_PUBKEY switches to detached GPG-signature verification (configs/archinstall.json.sig), the only mode that resists a fully compromised upstream.
  • Docs no longer reference the maintainer's forge, private dotfiles, or personal username: docs/CI.md uses a generic forge URL, docs/nginx-redirect.conf is an explicit template, docs/INSTALL.md no longer hardcodes a user or point at a private recovery doc, and the ISO publisher metadata matches the identity the repo is actually published under.
Reference in New Issue View Git Blame Copy Permalink