Files

Build SilverMetal Linux ISO (reproducibility-gated) / build-and-verify (push) Failing after 18m13s

Details

fix(linux/build): pin user_name=user, mkdir derivative-binary (M1.1)

Run #4259 (the systemd-in-container debut) cleared every prior failure
class, ran for 15 minutes, then died inside 1100_sanity-tests'
aptgetopt_conf_add at:

    tee: /home/root/derivative-binary/30_derivative-maker.conf:
    No such file or directory
    last_failed_bash_command: tee --append -- "$dist_aptgetopt_file" > /dev/null

Two compounding bugs:

1. **user_name resolves to "root" via $SUDO_USER**

   derivative-maker/help-steps/variables (lines 80-93) computes
   user_name with these fallbacks, in order:

       [ -n "$user_name" ]   || user_name="$SUDO_USER"
       [ -n "$user_name" ]   || user_name="$(logname 2>/dev/null)"
       if [ -z "$user_name" ] && [ "$(id -u)" != "0" ]; then
          user_name="$(whoami)"
          [ -n "$user_name" ] || user_name="$USER"
       fi

   build.sh enters the container as root (systemd's
   docker-entrypoint.service runs as root), then sudoes to user via
   `sudo --preserve-env -u user --`. sudo always sets SUDO_USER to the
   *calling* user (= root), regardless of --preserve-env. So
   variables.sh hits the first fallback and computes user_name="root",
   then HOMEVAR=/home/root, then binary_build_folder_dist=
   /home/root/derivative-binary — a directory that does not exist
   because root's home is /root (not /home/root).

   Fix: build-inner.sh now exports user_name=user before sourcing the
   config, satisfying the first-priority check in variables.sh and
   short-circuiting the SUDO_USER fallback. The comment in the script
   notes the failure mode for the next reader.

2. **Missing mkdir of derivative-binary**

   Upstream's derivative-maker-docker-start does:
       mkdir --parents -- "${HOME}/derivative-binary"
   before invoking derivative-maker. Our build-inner.sh skipped that
   because previous iterations didn't reach the point where it
   mattered. Now that we do, we replicate it.

3. **Output collection path correction**

   derivative-maker writes its ISO/manifest output into
   ${HOME}/derivative-binary (per variables.sh:109) — not into the
   source tree under linux/build/derivative-maker. The previous
   `find . -maxdepth 6 -type f -name "*.iso"` would have missed
   everything once we got that far. Updated to
   `find "${HOME}/derivative-binary" ...`.

No image rebuild needed — this is a pure script-and-env change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-07 12:47:47 +01:00

build

fix(linux/build): pin user_name=user, mkdir derivative-binary (M1.1)

2026-05-07 12:47:47 +01:00

README.md

docs(naming): adopt OS / Enhanced product-line framing + align with existing repos

2026-04-25 03:30:45 +01:00

README.md

SilverMetal OS — Linux

Status: Phase 1 (planning) → moving to milestone 1.1 (reproducible Kicksecure fork build)

🔒 SilverMetal OS product line — we ship the operating system.

The reference SilverMetal flavour. Tier A — full kernel-level hardening, verified boot we control, Debian/Kicksecure-based.

Scope (v1)

See ../docs/roadmap.md Phase 1.

Hardening must-haves

Kicksecure base (Debian-derived, hardened upstream)
linux-hardened kernel + KSPP sysctl/build flags
Secure Boot with our shim/MOK
TPM2 PCR-bound LUKS2 unlock (Argon2id), full-disk encryption mandatory
AppArmor strict profiles for browsers, mail, viewers, networked daemons
GrapheneOS hardened_malloc as system allocator
bubblewrap + Flatpak primary; firejail for legacy .deb
nftables default-deny inbound, encrypted DNS, SilverVPN always-on default
Zero upstream telemetry — verified by integration test
SilverBrowser default (ungoogled-chromium-rebranded v1)
SilverVPN integrated from existing SilverLABS/SilverVPN (Linux client + tunnel service)
SilverSync v1 (Nextcloud-backed, client-side encryption)
A/B updates with rollback, signed by our keys
Optional amnesic session mode

Out of scope (v1)

Atomic / immutable root (v1.1 — ostree experiment)
dm-verity on / (v1.1)
ARM64 / Apple Silicon (v2)
Tor-by-default variant (sibling product later)

Directory layout

linux/
├── build/             # live-build pipeline, reproducible-build config
├── kernel/            # config fragments, linux-hardened pinning
├── overlay/           # /etc + /usr/share/silvermetal + skel hardening overlay
├── packages/
│   ├── include.list   # what's installed
│   └── exclude.list   # what's purged (snap, telemetry, etc.)
├── apparmor/          # custom strict profiles
├── nftables/          # default ruleset
├── installer/         # Calamares branding + hardened defaults
├── update-server/     # signing + repo hosting (infra-as-code)
└── tests/
    ├── lynis-baseline/
    ├── kspp-check/
    └── telemetry-leak/

Verification gates (must pass before public alpha)

Two clean builds from same commit → identical SHA256
kconfig-hardened-check passes
Lynis hardening score ≥ 90
30-min idle telemetry capture: zero packets to MS/Google/Apple/Mozilla/Canonical/Debian/analytics
TPM tamper test: LUKS correctly falls back to passphrase
AppArmor: every networked binary confined or documented
Independent privacy-engineering review

Upstream we depend on

Kicksecure — fork base
linux-hardened — kernel patchset
GrapheneOS hardened_malloc — allocator
KSPP — kernel config authority
secureblue — reference for v1.1 immutable design
SilverLABS/SilverVPN — VPN client + tunnel service (existing, integrated)