- scripts/secureboot/gen-keys.sh: generates a Machine Owner Key pair
(MOK.priv / MOK.pem / MOK.der) for self-signing the boot chain.
- scripts/secureboot/sign-image.sh: signs kernels and EFI binaries
(already-signed files skipped) with sbsign.
- arcline-mok-enroll.service (+ script): one-time MOK enrollment at first
boot via mokutil; no-ops when no key was shipped.
- build-iso.sh: ARCLINE_SIGN=1 signs the live boot chain and ships the
public MOK in the image. Smoke test now asserts the enroll unit exists.
- toolchain/build-vendor.sh: packages the observability components that
are not in Debian main — grafana (official OSS deb, vendored as-is),
loki + promtail (static binaries from the Loki GitHub release, wrapped
in minimal debs that install the overlays/server configs and systemd
units from toolchain/vendor/). Version-pinned, overridable, and
download failures skip with a warning (never break the OS build).
- configure-system.sh: auto-enables grafana-server/loki/promtail when
their binaries land in the image.
- New `make vendor` target.
- deploy-disk.sh: the shared "write a finished system to a disk" step —
partition (GPT bios/efi) -> btrfs layout via btrfs/init.sh -> rsync
rootfs -> chroot (real fstab, GRUB, hostname). Carries the optional
ARCLINE_SIGN hook; the signing tooling itself lands in a later commit.
- apply-fstab.sh: renders the edition fstab template with real root/efi
UUIDs and drops the swap line.
- build-image.sh: rootfs -> bootable qcow2/raw disk image (sparse file +
loop device + deploy), the cloud edition's primary output.
- install.sh: scripted installer for a real disk, confirmation-gated.
- Makefile: image-<edition> targets (+ minimal variants); build-edition.sh
learns the "image" stage; cloud metadata now ships a disk image.
- check-host-deps.sh / GitLab CI: add gdisk, parted, rsync, dosfstools,
qemu-utils, dpkg, sbsigntool to the build image.
Document the design and how to operate it: architecture, building
(including toolchain-free/minimal builds), hardening guide, editions,
observability, and the toolchain. README ties it together.
Harness that clones the 11 Go tools (arcline-uptime, -check, -audit,
-dns, -vault, -email, -migrate, -billing, -portal, -website, -status)
from git.arcline.it, builds release binaries, and packages each into a
.deb that configure-system installs into the image. Tools that cannot
be fetched or built are skipped without breaking the OS build.
- init.sh: creates the @ / @home / @log / @snapshots subvolume layout
on a target device (the installer step).
- snapshot.sh: scheduled read-only snapshots with pruning, installed as
/usr/local/sbin/arcline-snapshot.
- rollback.sh: safe boot-to-snapshot rollback that refuses to touch the
live @ and promotes a snapshot atomically.
Define the three flagship editions as plain-text manifests:
- server (bastion): production server - observability stack, containers.
- workstation (forge): curated KDE Plasma + dev toolchains.
- cloud (nimbus): cloud kernel, cloud-init, guest agents.
Each manifest carries metadata (services to enable/mask), a package
list, a hardened kernel cmdline, and a btrfs fstab template.
Scaffold the Arcline OS build system ("the wires"): a transparent,
auditable pipeline that turns a Debian bookworm base into hardened OS
images for the server, workstation, and cloud editions.
- Makefile orchestrates everything (make iso-<edition>, check, test,
toolchain, clean); versions.mk is the single source of truth for
versions and paths.
- scripts/ is the plain-bash pipeline: debootstrap -> install packages
-> apply overlays -> in-chroot configure -> live ISO, plus a rootfs
archive along the way.
- ARCLINE_TOOLCHAIN=auto|skip|require controls whether the 11 Go tools
are bundled into an image (auto by default; minimal builds available
via make iso-<edition>-minimal).
- GPL-3.0 licensed, sponsored by Arcline IT LLC.
