reachableceo
3d2ef3d5c2
Previous commits marked findings as ✅ that were actually superficial or broken. This commit fixes the real problems honestly. Real fixes: - Argon2id KDF: Fixed via preseed partman/early_command that patches partman-crypto's cryptsetup luksFormat to include --pbkdf argon2id. Previous luks-kdf-configure.sh "auto-conversion" was dead code (cryptsetup luksConvertKey needs stdin passphrase, nothing provides it). Now the hook is an honest verifier, not a fake converter. - src/security-hardening.sh: Removed sshd_config generation entirely (was still generating it despite claiming client-only) - AIDE init: Removed || true error swallowing, now reports failures - COMPLIANCE.md: Marked CMMC L3 and FedRAMP as aspirational targets with honest explanation of what's missing (3PAO, org controls) - VERIFICATION-REPORT.md: Added self-review warning about contradictions, fixed wrong preseed path (config/preseed.cfg → includes.installer/) - Removed phantom knel-compliance-check.sh reference from COMPLIANCE.md - encryption-setup.sh: README now says "Argon2id (via early_command)" instead of bare "Argon2id" which was false - demo.preseed.cfg: Added same Argon2id early_command - Added .dockerignore (was missing) - Fixed .gitignore *key* pattern (too broad, matched keyboard.conf etc) Still remaining (honest assessment): - C-06: Git history scrub (needs git-filter-repo, destructive) - H-09: Build cache integrity (design work needed) - M-11: Docker base digest pinning - Phase 3: Test suite overhaul (85% grep-based, not behavioral) - Phase 4: Documentation cleanup (threat model, etc) - ISO NOT rebuilt since fixes 786 tests pass, 0 shellcheck warnings. 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>
48 lines
513 B
Plaintext
48 lines
513 B
Plaintext
# KNEL-Football ISO build artifacts
|
|
*.iso
|
|
*.sha256
|
|
*.md5
|
|
*.img
|
|
|
|
# Docker build artifacts
|
|
bin/
|
|
lib/
|
|
plan/
|
|
|
|
# Build directories
|
|
knel-build/
|
|
knel-iso/
|
|
knel-custom/
|
|
knel-final/
|
|
artifacts/
|
|
.chroot/
|
|
.cache/
|
|
.build/
|
|
tmp/
|
|
tmp2/
|
|
output/
|
|
|
|
# Live-build output artifacts (repo root only)
|
|
/binary/
|
|
/.cache/
|
|
/bootstrap/
|
|
|
|
# Temporary files
|
|
*.log
|
|
*.tmp
|
|
*~
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Downloaded files
|
|
debian-*.iso
|
|
*.netinst.iso
|
|
*.tar.gz
|
|
*.tar.xz
|
|
|
|
# Security - don't commit sensitive configs
|
|
*.key
|
|
*.pem
|
|
*.crt
|
|
secrets/
|
|
secureboot-keys/ |