ba3ef0d45a
All checks were successful
Build SilverMetal Enhanced - Windows ISO / build (push) Successful in 4m12s
VM runtime test (offline disk mount) revealed SetupComplete.cmd ran but its inline
multi-line `powershell -Command` (cmd ^-continuation + nested escaped quotes) failed
to parse ("string is missing the terminator") -> the §A-H modules never executed.
Offline CI assertions only proved the files were BAKED, not that they RUN.
Fix: move the module runner into hardening/Invoke-Hardening.ps1 and call it with
-File (no cmd quoting). Runner runs 00*..08* in order then Verify (writes
verify-report.json in-line as SYSTEM; reboot/PIN-dependent gates show pending).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
948 B
Batchfile
21 lines
948 B
Batchfile
@echo off
|
|
REM ===========================================================================
|
|
REM SilverMetal Enhanced - Windows : first-boot entry point.
|
|
REM Windows runs %WINDIR%\Setup\Scripts\SetupComplete.cmd automatically (as
|
|
REM SYSTEM) at the end of setup. It hands off to Invoke-Hardening.ps1 via -File
|
|
REM to avoid cmd/PowerShell quoting fragility (an inline -Command one-liner
|
|
REM here previously failed to parse, so the §A-H modules never ran).
|
|
REM
|
|
REM Design: ../../iso-builder.md Controls: ../../hardening-spec.md
|
|
REM ===========================================================================
|
|
|
|
set LOG=C:\Windows\Setup\Scripts\silvermetal-firstboot.log
|
|
set HARD=C:\Windows\Setup\Scripts\hardening
|
|
|
|
echo [%DATE% %TIME%] SilverMetal first-boot start >> "%LOG%"
|
|
|
|
powershell -NoProfile -ExecutionPolicy Bypass -File "%HARD%\Invoke-Hardening.ps1" >> "%LOG%" 2>&1
|
|
|
|
echo [%DATE% %TIME%] SilverMetal first-boot done >> "%LOG%"
|
|
exit /b 0
|