1c886deca3
Some checks failed
Build SilverMetal Enhanced - Windows ISO / build (pull_request) Failing after 34s
Implement build.ps1 (M2): mount/extract the base ISO, offline-service install.wim (inject GPD drivers if staged, debloat appx, bake SetupComplete.cmd + hardening modules into \Windows\Setup\Scripts), inject autounattend.xml, oscdimg UEFI repack, emit SHA-256 + SBOM. Elevation + oscdimg guarded. Add .gitea/workflows/build-iso-windows.yaml: runs on the self-hosted silverlabs-runner-win (windows-latest), ensures ADK Deployment Tools, acquires the base ISO from repo var SILVERMETAL_BASE_ISO_URL or a pre-staged path, builds, validates the baked payload offline, uploads SBOM/SHA (+ISO on dispatch/tag), attaches to a Gitea release on win-v* tags. Mirrors build-iso-linux.yaml. Add tests/Assert-IsoStructure.ps1: the no-nested-virt CI gate - mounts the built ISO + install.wim read-only and asserts autounattend.xml, SetupComplete.cmd, and the hardening modules are correctly baked. Full QEMU boot+Verify is a follow-on. Switch autounattend to Windows' native SetupComplete.cmd auto-run (SYSTEM, end of setup) instead of a duplicate FirstLogonCommands call. Untested until first runner execution (dev box is ARM64). All PS parse-clean; autounattend XML + workflow YAML valid. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
67 lines
3.1 KiB
XML
67 lines
3.1 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
SilverMetal Enhanced - Windows : Windows 11 IoT Enterprise LTSC answer file.
|
|
|
|
Purpose: automate OOBE, force a LOCAL account (no Microsoft Account / no cloud
|
|
key escrow), set regional defaults, prepare a BitLocker-ready disk layout, and
|
|
hand off to $OEM$\SetupComplete.cmd for first-boot hardening.
|
|
|
|
SCAFFOLD (M0). Disk layout + image selectors are filled at M2 against the
|
|
licensed media. Do NOT embed product keys, PINs, or secrets here.
|
|
|
|
Design: ../../iso-builder.md Controls: ../../hardening-spec.md (domains A, C)
|
|
-->
|
|
<unattend xmlns="urn:schemas-microsoft-com:unattend">
|
|
|
|
<settings pass="windowsPE">
|
|
<component name="Microsoft-Windows-International-Core-WinPE" processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
|
|
<SetupUILanguage><UILanguage>en-GB</UILanguage></SetupUILanguage>
|
|
<InputLocale>0809:00000809</InputLocale>
|
|
<SystemLocale>en-GB</SystemLocale>
|
|
<UILanguage>en-GB</UILanguage>
|
|
<UserLocale>en-GB</UserLocale>
|
|
</component>
|
|
<component name="Microsoft-Windows-Setup" processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
|
|
<!-- TODO-M2: DiskConfiguration (GPT, ESP + MSR + Windows), single GPT disk, BitLocker-ready.
|
|
ImageInstall/OSImage/InstallFrom MetaData = IoT Enterprise LTSC index (see inputs.manifest.json). -->
|
|
<UserData>
|
|
<ProductKey><!-- TODO-M2: IoT Enterprise LTSC key, build-time injected; NOT committed --></ProductKey>
|
|
<AcceptEula>true</AcceptEula>
|
|
</UserData>
|
|
</component>
|
|
</settings>
|
|
|
|
<settings pass="oobeSystem">
|
|
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64"
|
|
publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
|
|
<OOBE>
|
|
<HideEULAPage>true</HideEULAPage>
|
|
<HideOnlineAccountScreens>true</HideOnlineAccountScreens> <!-- force local account -->
|
|
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
|
|
<ProtectYourPC>3</ProtectYourPC> <!-- disable "send data" express settings -->
|
|
</OOBE>
|
|
<UserAccounts>
|
|
<!-- TODO-M2: provision a local admin (no MSA). Password set at provisioning, not committed. -->
|
|
<LocalAccounts>
|
|
<LocalAccount wcm:action="add" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
|
|
<Name>silvermetal</Name>
|
|
<Group>Administrators</Group>
|
|
<DisplayName>SilverMetal</DisplayName>
|
|
</LocalAccount>
|
|
</LocalAccounts>
|
|
</UserAccounts>
|
|
<!--
|
|
Hardening runs from C:\Windows\Setup\Scripts\SetupComplete.cmd, which
|
|
Windows Setup executes automatically (as SYSTEM) at the end of setup,
|
|
before first interactive logon. build.ps1 stages it + the hardening/
|
|
modules into the image. No FirstLogonCommands needed (avoids a double-run).
|
|
-->
|
|
<RegisteredOwner>SilverMetal</RegisteredOwner>
|
|
<RegisteredOrganization>SilverLABS</RegisteredOrganization>
|
|
</component>
|
|
</settings>
|
|
|
|
</unattend>
|