1c886deca3
Some checks failed
Build SilverMetal Enhanced - Windows ISO / build (pull_request) Failing after 34s
Implement build.ps1 (M2): mount/extract the base ISO, offline-service install.wim (inject GPD drivers if staged, debloat appx, bake SetupComplete.cmd + hardening modules into \Windows\Setup\Scripts), inject autounattend.xml, oscdimg UEFI repack, emit SHA-256 + SBOM. Elevation + oscdimg guarded. Add .gitea/workflows/build-iso-windows.yaml: runs on the self-hosted silverlabs-runner-win (windows-latest), ensures ADK Deployment Tools, acquires the base ISO from repo var SILVERMETAL_BASE_ISO_URL or a pre-staged path, builds, validates the baked payload offline, uploads SBOM/SHA (+ISO on dispatch/tag), attaches to a Gitea release on win-v* tags. Mirrors build-iso-linux.yaml. Add tests/Assert-IsoStructure.ps1: the no-nested-virt CI gate - mounts the built ISO + install.wim read-only and asserts autounattend.xml, SetupComplete.cmd, and the hardening modules are correctly baked. Full QEMU boot+Verify is a follow-on. Switch autounattend to Windows' native SetupComplete.cmd auto-run (SYSTEM, end of setup) instead of a duplicate FirstLogonCommands call. Untested until first runner execution (dev box is ARM64). All PS parse-clean; autounattend XML + workflow YAML valid. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
windows/tests
Verification gates for a SilverMetal Enhanced — Windows build
(../hardening-spec.md §6).
| Test | What it proves | Status |
|---|---|---|
| Hardening-baseline | All control gates pass | ../hardening/Verify-SilverMetalWindows.ps1 (M1) |
| Telemetry-leak | Captures egress on a clean build; classifies every Microsoft contact; publishes the residual (we do not claim zero) | TODO-M3 |
| VPN kill-switch | Tunnel-drop → zero egress | TODO-M1 |
| Update path | A test update applies + rolls back (update-or-die) | TODO-M3 |
The telemetry-leak test is the honesty gate: it documents the minimum-feasible Microsoft contact that remains, per design-principle #2.