bafdf88fa9
Adds Invoke-PublishWelcome (dotnet publish win-x64 self-contained, runs pre-mount) and Copy-WelcomePayload (copies publish output + flavours/*.json into $mount while install.wim is open) called from Invoke-ServiceWim's try block. Both are gated on SILVERMETAL_WELCOME_ENABLED != '0' (enabled by default). Hardening staging unchanged. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
windows/installer
The custom packed-ISO build pipeline. See ../iso-builder.md for the design.
| File | Role |
|---|---|
build.ps1 |
Pipeline orchestrator (7 stages). Run on Windows + Windows ADK. |
inputs.manifest.json |
Pinned inputs — base ISO SHA-256, driver-pack/Stack/tool versions. The Microsoft ISO is an input, never committed. |
autounattend/autounattend.xml |
OOBE automation — local account (no MSA), regional, BitLocker-ready disk layout, hands off to first-boot. |
oem/SetupComplete.cmd |
First-boot entry point — runs the shared ../hardening/ modules, then schedules Verify. |
Usage (M2+):
.\build.ps1 -SourceIso 'D:\Win11_IoT_Enterprise_LTSC_x64.iso'
Current status: M0 scaffold — stages 2–7 throw NotImplemented until M2/M3.