The package name in Debian repositories is sbsigntool (singular), not
sbsigntools (plural). This typo was causing ISO builds to fail with:
E: Unable to locate package sbsigntools
Files fixed:
- config/package-lists/knel-football.list.chroot - package list
- tests/unit/secureboot_test.bats - test reference
- docs/TEST-COVERAGE.md - documentation
- docs/PRD.md - requirements documentation
Reference: Security audit FINDING-007 (test coverage)
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Add EFI System Partition (ESP) for UEFI boot support
- Add $defaultignore{ } to LVM partitions for proper crypto handling
- Add in_vg{ knel_vg } and lv_name{ } for explicit volume placement
- Change debconf priority from critical to high to allow user password prompts
- Update documentation dates to 2026-02-19
- Update ISO size references from 450 MB to 816 MB
- Update checksums to current values
Fixes installer error "No root file system is defined"
Fixes missing non-root user password prompt
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
- Add check_host_fde() function to run.sh that detects LUKS encryption
- Block ./run.sh iso if host lacks full disk encryption
- Block ./run.sh test:iso commands if host lacks FDE
- Add FR-011 to PRD.md documenting the host FDE requirement
- Update AGENTS.md with new mandatory requirement
- Add 9 tests for host FDE check in run_comprehensive_test.bats
Rationale: Building a secure OS on an unencrypted host creates supply
chain risk. The host must have LUKS encryption to ensure the entire
build pipeline is secure.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
PRD fixes:
- Remove duplicate 'Installation Behavior' section
- Fix malformed terminology table (missing pipe separator)
Documentation alignment with FR-006:
- README.md: Change SSH/firewall to client-only, no inbound access
- TEST-COVERAGE.md: Remove 'Firewall allows SSH inbound'
- VERIFICATION-REPORT.md: Fix password config docs to match preseed.cfg
- COMPLIANCE.md: Change 'SSH Hardening' to 'SSH Client-Only'
Test enhancements:
- Expand unit tests for encryption, firewall, security hardening
- Add comprehensive coverage for FR-001 through FR-009 requirements
All changes ensure documentation and tests align with PRD.md FR-006
which requires SSH client-only with no server or inbound access.
💘 Generated with Crush
Assisted-by: GLM-4.7 via Crush <crush@charm.land>
Consolidate all documentation files under docs/ directory.
Update AGENTS.md and README.md to reflect new file locations.
💘 Generated with Crush
Assisted-by: GLM-5 via Crush <crush@charm.land>
