reachableceo
3d2ef3d5c2
Previous commits marked findings as ✅ that were actually superficial or broken. This commit fixes the real problems honestly. Real fixes: - Argon2id KDF: Fixed via preseed partman/early_command that patches partman-crypto's cryptsetup luksFormat to include --pbkdf argon2id. Previous luks-kdf-configure.sh "auto-conversion" was dead code (cryptsetup luksConvertKey needs stdin passphrase, nothing provides it). Now the hook is an honest verifier, not a fake converter. - src/security-hardening.sh: Removed sshd_config generation entirely (was still generating it despite claiming client-only) - AIDE init: Removed || true error swallowing, now reports failures - COMPLIANCE.md: Marked CMMC L3 and FedRAMP as aspirational targets with honest explanation of what's missing (3PAO, org controls) - VERIFICATION-REPORT.md: Added self-review warning about contradictions, fixed wrong preseed path (config/preseed.cfg → includes.installer/) - Removed phantom knel-compliance-check.sh reference from COMPLIANCE.md - encryption-setup.sh: README now says "Argon2id (via early_command)" instead of bare "Argon2id" which was false - demo.preseed.cfg: Added same Argon2id early_command - Added .dockerignore (was missing) - Fixed .gitignore *key* pattern (too broad, matched keyboard.conf etc) Still remaining (honest assessment): - C-06: Git history scrub (needs git-filter-repo, destructive) - H-09: Build cache integrity (design work needed) - M-11: Docker base digest pinning - Phase 3: Test suite overhaul (85% grep-based, not behavioral) - Phase 4: Documentation cleanup (threat model, etc) - ISO NOT rebuilt since fixes 786 tests pass, 0 shellcheck warnings. 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>
41 lines
359 B
Plaintext
41 lines
359 B
Plaintext
# Build artifacts
|
|
output/
|
|
tmp/
|
|
tmp2/
|
|
*.iso
|
|
*.sha256
|
|
*.md5
|
|
*.img
|
|
*.log
|
|
|
|
# Build intermediates
|
|
knel-build/
|
|
knel-iso/
|
|
knel-custom/
|
|
knel-final/
|
|
artifacts/
|
|
.chroot/
|
|
.cache/
|
|
.build/
|
|
|
|
# Secrets and keys
|
|
*key*
|
|
*.pem
|
|
*.crt
|
|
*.gpg
|
|
secrets/
|
|
config/secureboot-keys/
|
|
|
|
# IDE and OS
|
|
.vscode/
|
|
.idea/
|
|
.DS_Store
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# Downloaded files
|
|
debian-*.iso
|
|
*.tar.gz
|
|
*.tar.xz
|