SilverLABS/SilverMetal

Fork 0

Files

History

SysAdmin 33e1501611

Build SilverMetal Linux ISO (reproducibility-gated) / builder-image (push) Successful in 1s

Details

Build SilverMetal Linux ISO (reproducibility-gated) / build-and-verify (push) Failing after 35m47s

Details

fix(linux/build): scrub apt lists + apt/dpkg logs from chroot (M1.1 iter33)

Run #4280 cleared every previously-seen non-determinism (post-process
ran end-to-end, all five iter32-fixed flag paths worked). The next
diffoscope-flagged set is the runtime state that *every* Debian build
captures and reproducible-rebuilders strip:

  /var/lib/apt/lists/127.0.0.1:9977_debian-fasttrack_…/InRelease
      The InRelease file from the FastTrack repo carries
      `Date:` and a fresh PGP signature with a 30-minute drift
      between Build A's fetch (22:00 UTC) and Build B's fetch
      (22:30 UTC). FastTrack re-signs roughly daily, so apt
      pickup lands on different signed files when the two builds
      bracket a re-sign. snapshot.debian.org doesn't cover
      FastTrack so we can't pin upstream — strip the file
      instead. apt-get update regenerates it on first boot.

  /var/lib/apt/lists/_home_user_derivative-binary_aptrepo_local_…/Release
      The locally-built kicksecure apt repo's Release file.
      reprepro stamps this with wall-clock time when it generates
      the repo. SOURCE_DATE_EPOCH is honoured for the underlying
      package metadata but reprepro writes Release with the
      current time regardless.

  /var/log/apt/history.log
  /var/log/apt/term.log
  /var/log/dpkg.log
      Wall-clock-stamped logs from package installation. Every
      apt/dpkg invocation prepends a timestamp.

Cleanup added:
  * /var/log/apt/*.log
  * /var/log/{dpkg,alternatives}.log
  * /var/lib/apt/lists/{everything except lock and partial/}

The live system regenerates all of these on first use. Standard
reproducible-Debian rebuilder behaviour (Tails, Whonix-public-iso,
debian-cd all do the equivalent).

If the diffoscope output for run #4280 is honest about the full
delta — and grep ├── shows exactly five entries — this should be
the last divergence. Crossing fingers for run #4281.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-07 23:50:14 +01:00

build

fix(linux/build): scrub apt lists + apt/dpkg logs from chroot (M1.1 iter33)

2026-05-07 23:50:14 +01:00

README.md

docs(naming): adopt OS / Enhanced product-line framing + align with existing repos

2026-04-25 03:30:45 +01:00

README.md

SilverMetal OS — Linux

Status: Phase 1 (planning) → moving to milestone 1.1 (reproducible Kicksecure fork build)

🔒 SilverMetal OS product line — we ship the operating system.

The reference SilverMetal flavour. Tier A — full kernel-level hardening, verified boot we control, Debian/Kicksecure-based.

Scope (v1)

See ../docs/roadmap.md Phase 1.

Hardening must-haves

Kicksecure base (Debian-derived, hardened upstream)
linux-hardened kernel + KSPP sysctl/build flags
Secure Boot with our shim/MOK
TPM2 PCR-bound LUKS2 unlock (Argon2id), full-disk encryption mandatory
AppArmor strict profiles for browsers, mail, viewers, networked daemons
GrapheneOS hardened_malloc as system allocator
bubblewrap + Flatpak primary; firejail for legacy .deb
nftables default-deny inbound, encrypted DNS, SilverVPN always-on default
Zero upstream telemetry — verified by integration test
SilverBrowser default (ungoogled-chromium-rebranded v1)
SilverVPN integrated from existing SilverLABS/SilverVPN (Linux client + tunnel service)
SilverSync v1 (Nextcloud-backed, client-side encryption)
A/B updates with rollback, signed by our keys
Optional amnesic session mode

Out of scope (v1)

Atomic / immutable root (v1.1 — ostree experiment)
dm-verity on / (v1.1)
ARM64 / Apple Silicon (v2)
Tor-by-default variant (sibling product later)

Directory layout

linux/
├── build/             # live-build pipeline, reproducible-build config
├── kernel/            # config fragments, linux-hardened pinning
├── overlay/           # /etc + /usr/share/silvermetal + skel hardening overlay
├── packages/
│   ├── include.list   # what's installed
│   └── exclude.list   # what's purged (snap, telemetry, etc.)
├── apparmor/          # custom strict profiles
├── nftables/          # default ruleset
├── installer/         # Calamares branding + hardened defaults
├── update-server/     # signing + repo hosting (infra-as-code)
└── tests/
    ├── lynis-baseline/
    ├── kspp-check/
    └── telemetry-leak/

Verification gates (must pass before public alpha)

Two clean builds from same commit → identical SHA256
kconfig-hardened-check passes
Lynis hardening score ≥ 90
30-min idle telemetry capture: zero packets to MS/Google/Apple/Mozilla/Canonical/Debian/analytics
TPM tamper test: LUKS correctly falls back to passphrase
AppArmor: every networked binary confined or documented
Independent privacy-engineering review

Upstream we depend on

Kicksecure — fork base
linux-hardened — kernel patchset
GrapheneOS hardened_malloc — allocator
KSPP — kernel config authority
secureblue — reference for v1.1 immutable design
SilverLABS/SilverVPN — VPN client + tunnel service (existing, integrated)