Files

Build SilverMetal Linux ISO (reproducibility-gated) / build-and-verify (push) Failing after 1m13s

Details

fix(linux/build): correct derivative-maker CLI invocation (M1.1)

Run #4253 finally got past all the harness failures and into
derivative-maker's actual build steps, where 1100_sanity-tests
rejected our invocation with:

    unknown option (1): '--build'

The CLI we'd been passing was built from invented flag names rather
than the real grammar in derivative-maker/help-steps/parse-cmd.
Concretely:

  - `--build`  is not a real option (just wrong)
  - `--flavour` should be `--flavor` (upstream uses American spelling)
  - `--dist`   is not a real option; dist is implicit from `--flavor`
                (kicksecure-cli ⇒ bookworm)
  - `--config` is not a real option; the silvermetal-base.conf is
                sourced into env above the invocation, no flag needed
  - `--freedom true|false` was missing entirely; parse-cmd requires it
                for `--arch amd64` (line 70 in parse-cmd) — the script
                exits if neither is set

Fix: build-inner.sh now invokes
    ./derivative-maker --flavor … --target … --arch … --freedom …
which is the minimal valid form per parse-cmd's case-branches.

Set DERIVATIVE_FREEDOM=false in silvermetal-base.conf, matching
Kicksecure's own public-ISO choice — `--freedom true` would omit
firmware-nonfreedom and the resulting ISO wouldn't initialise wifi /
many GPUs / Intel microcode on most hardware. Privacy/functionality
trade-off documented inline; the hardening overlay in M1.2+ can
revisit if that conversation becomes useful.

Verified: bash -n on both scripts. No image rebuild needed — pure
script and config changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-07 11:18:38 +01:00

build

fix(linux/build): correct derivative-maker CLI invocation (M1.1)

2026-05-07 11:18:38 +01:00

README.md

docs(naming): adopt OS / Enhanced product-line framing + align with existing repos

2026-04-25 03:30:45 +01:00

README.md

SilverMetal OS — Linux

Status: Phase 1 (planning) → moving to milestone 1.1 (reproducible Kicksecure fork build)

🔒 SilverMetal OS product line — we ship the operating system.

The reference SilverMetal flavour. Tier A — full kernel-level hardening, verified boot we control, Debian/Kicksecure-based.

Scope (v1)

See ../docs/roadmap.md Phase 1.

Hardening must-haves

Kicksecure base (Debian-derived, hardened upstream)
linux-hardened kernel + KSPP sysctl/build flags
Secure Boot with our shim/MOK
TPM2 PCR-bound LUKS2 unlock (Argon2id), full-disk encryption mandatory
AppArmor strict profiles for browsers, mail, viewers, networked daemons
GrapheneOS hardened_malloc as system allocator
bubblewrap + Flatpak primary; firejail for legacy .deb
nftables default-deny inbound, encrypted DNS, SilverVPN always-on default
Zero upstream telemetry — verified by integration test
SilverBrowser default (ungoogled-chromium-rebranded v1)
SilverVPN integrated from existing SilverLABS/SilverVPN (Linux client + tunnel service)
SilverSync v1 (Nextcloud-backed, client-side encryption)
A/B updates with rollback, signed by our keys
Optional amnesic session mode

Out of scope (v1)

Atomic / immutable root (v1.1 — ostree experiment)
dm-verity on / (v1.1)
ARM64 / Apple Silicon (v2)
Tor-by-default variant (sibling product later)

Directory layout

linux/
├── build/             # live-build pipeline, reproducible-build config
├── kernel/            # config fragments, linux-hardened pinning
├── overlay/           # /etc + /usr/share/silvermetal + skel hardening overlay
├── packages/
│   ├── include.list   # what's installed
│   └── exclude.list   # what's purged (snap, telemetry, etc.)
├── apparmor/          # custom strict profiles
├── nftables/          # default ruleset
├── installer/         # Calamares branding + hardened defaults
├── update-server/     # signing + repo hosting (infra-as-code)
└── tests/
    ├── lynis-baseline/
    ├── kspp-check/
    └── telemetry-leak/

Verification gates (must pass before public alpha)

Two clean builds from same commit → identical SHA256
kconfig-hardened-check passes
Lynis hardening score ≥ 90
30-min idle telemetry capture: zero packets to MS/Google/Apple/Mozilla/Canonical/Debian/analytics
TPM tamper test: LUKS correctly falls back to passphrase
AppArmor: every networked binary confined or documented
Independent privacy-engineering review

Upstream we depend on

Kicksecure — fork base
linux-hardened — kernel patchset
GrapheneOS hardened_malloc — allocator
KSPP — kernel config authority
secureblue — reference for v1.1 immutable design
SilverLABS/SilverVPN — VPN client + tunnel service (existing, integrated)