3a30a0421e
Add windows/iso-builder.md: reproducible custom-packed-ISO pipeline design for
SilverMetal Enhanced - Windows on IoT Enterprise LTSC. Covers the licensing
frame (IoT = blessed channel for preinstalled custom images; self-apply stays a
builder), 7 build stages (verify/extract/DISM-service/inject-unattend/brand/
oscdimg-repack/attest), the offline-vs-first-boot-vs-firmware control split, an
honest reproducibility scope (pinned inputs + SBOM + attestation, NOT bit-
identical on Windows), and M0-M4 milestones.
Scaffold windows/ per the planned layout:
- installer/ build.ps1 (7-stage orchestrator, stages stubbed to M2),
inputs.manifest.json (pinned-input schema), autounattend.xml
(local-account OOBE), oem/SetupComplete.cmd (first-boot runner)
- hardening/ shared §A-H PowerShell modules + Verify-SilverMetalWindows.ps1
(used by BOTH the ISO first-boot path and the self-apply track).
BitLocker module enforces TPM+PIN and blocks TPM-only.
- policies/ wdac/ debloat/ stack-installer/ drivers/ tests/ scaffolded with
READMEs; wdac/ documents audit->enforce; debloat/ flags Tiny11/NTLite as an
anti-pattern; rename applocker/ -> wdac/ realised.
All 11 PowerShell scripts parse clean; manifest JSON + autounattend XML valid.
Module bodies are M1 scaffold (safe: log + policy-set; interactive/firmware
steps documented, not faked).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
1.4 KiB
PowerShell
28 lines
1.4 KiB
PowerShell
#Requires -Version 5.1
|
|
<# SilverMetal Enhanced - Windows | SilverLABS Application Stack
|
|
The Stack is the spine (design-principle #7). Install native Windows builds
|
|
and set SilverBrowser default + SilverVPN always-on kill-switch.
|
|
Spec: ../hardening-spec.md (#4) | SCAFFOLD (M4): some components are
|
|
Linux-MVP today (windows/README.md) - their Windows builds may lag.
|
|
#>
|
|
[CmdletBinding()] param([string]$StackDir = "$PSScriptRoot\..\stack-installer")
|
|
Set-StrictMode -Version Latest; $ErrorActionPreference = 'Stop'
|
|
Write-Host '[Stack] SilverLABS Application Stack'
|
|
|
|
# Component -> hardening-spec mapping:
|
|
# SilverBrowser (A,H) default browser | SilverVPN (F) always-on kill-switch
|
|
# SilverSync (A) replaces OneDrive | SilverChat (F) E2EE over VPN
|
|
# SilverDuress (G) duress/panic-wipe | SilverKeys (C,A) pwd/2FA + offline BL recovery key
|
|
$components = 'SilverBrowser','SilverVPN','SilverSync','SilverChat','SilverDuress','SilverKeys'
|
|
|
|
foreach ($c in $components) {
|
|
# TODO-M4: install $StackDir\$c\*.msi/.exe silently; verify signature against the
|
|
# SilverLABS signing key (trust-model.md) before install.
|
|
Write-Warning " $c install pending native Windows build (M4)."
|
|
}
|
|
|
|
# TODO-M4: set SilverBrowser as default http/https handler; enable SilverVPN kill-switch
|
|
# (no plaintext fallback); register SilverDuress.
|
|
|
|
Write-Host ' [Stack] mapping staged; installs land at M4.'
|