diff options
| -rwxr-xr-x | build.sh | 23 |
1 files changed, 23 insertions, 0 deletions
@@ -477,6 +477,24 @@ cp "$INSTALLER_DIR/zfssnapshot" "$PROFILE_DIR/airootfs/usr/local/bin/" mkdir -p "$PROFILE_DIR/airootfs/root" cp "$INSTALLER_DIR/archangel.conf.example" "$PROFILE_DIR/airootfs/root/" +# Copy machine profiles so unattended reinstalls have them at /root/ on the +# live ISO — without this a profile only exists in the repo checkout, which +# a bare-metal recovery doesn't have. The profiles are gitignored and may +# carry credentials; the ISO is a portable unencrypted image, so warn when a +# profile holds anything beyond a known placeholder. +machine_profiles=("$INSTALLER_DIR"/*.conf) +if [[ -e "${machine_profiles[0]}" ]]; then + cp "${machine_profiles[@]}" "$PROFILE_DIR/airootfs/root/" + info "Copied machine profiles: $(basename -a "${machine_profiles[@]}" | tr '\n' ' ')" + for conf in "${machine_profiles[@]}"; do + if grep -E '^[A-Z_]*(PASSPHRASE|PASSWORD)=' "$conf" | grep -vqE '=(changeme|welcome)?$'; then + warn "$(basename "$conf") carries a non-placeholder credential — it will ride the ISO unencrypted" + fi + done +else + warn "No machine profiles (installer/*.conf) found — ISO carries only archangel.conf.example" +fi + # Copy rescue guide info "Copying rescue guide..." cp "$INSTALLER_DIR/RESCUE-GUIDE.txt" "$PROFILE_DIR/airootfs/root/" @@ -518,8 +536,13 @@ ARCHSETUP_DIR="${ARCHSETUP_DIR:-}" if [[ -d "$ARCHSETUP_DIR" ]]; then info "Copying archsetup into ISO..." mkdir -p "$PROFILE_DIR/airootfs/code" + # .ai and inbox are untracked personal-tooling state (session logs, + # private design docs, cross-project handoffs) — they must not ride a + # portable ISO image. rsync -a --exclude='.git' \ --exclude='.claude' \ + --exclude='.ai' \ + --exclude='inbox' \ --exclude='vm-images' \ --exclude='test-results' \ --exclude='*.qcow2' \ |