- Use armada-3720-espressobin-v7-emmc.dtb to enable both SDHCI controllers
- Fix root device: /dev/mmcblk1p2 (eMMC is mmc1 with dual controller DTB)
- Add modprobe.blacklist=mv88e6xxx,dsa_core to prevent DSA probe loop
- Add sdhci.debug_quirks2=0x40 to fix xenon-sdhci DDR timing issues
- Add initramfs hooks for sdhci-xenon and mv88e6xxx blacklist
- Add systemd service to load mv88e6xxx after rootfs mount
- Fix fstab tmpfs mount (remove non-existent user reference)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- build-image.sh: Fix boot.scr to load from boot partition (mmc 1:1)
with files at root level (Image, not /boot/Image)
- build-rpi-usb.sh: Make initramfs generation failure non-fatal
(Pi can boot without initramfs, just with reduced functionality)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Consistent with build-image.sh:
- --slipstream installs packages from output/debs/
- Falls back to cache/repo/pool if not using slipstream
- Installs secubox-core first (dependency)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Configuration.md: TOML config, modules, double-buffer system
- Troubleshooting.md: Common issues, diagnostics, recovery
- All pages translated to French and Chinese
- Sidebar updated to v1.5.3 with new sections
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- ARM-Installation-FR.md (French translation)
- ARM-Installation-ZH.md (Chinese translation)
- ESPRESSObin-ZH.md (Chinese translation)
- UI-COMPARISON.md (moved from docs/wiki/)
- Updated sidebar with all language links
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Bug: ARM images had empty /boot (no kernel)
- Fix: Add linux-image-arm64 to debootstrap for all ARM boards
- Copy vmlinuz → /boot/Image for U-Boot
- Copy DTBs from /usr/lib/linux-image-*/marvell/
- Generate extlinux.conf for distroboot
- Generate boot.scr for U-Boot autoboot
- Update wiki with automatic boot methods
Affected boards: espressobin-v7, espressobin-ultra, mochabin
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Document storage constraints for ARM boards:
- ESPRESSObin 4GB eMMC: max 3.5GB image
- ESPRESSObin 8GB/MOCHAbin: 4GB default, 6GB max
- MOCHAbin SATA/NVMe alternative for larger installs
- Added MOCHAbin README.md with U-Boot flash guide
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Comprehensive guide for flashing SecuBox to ARM boards via U-Boot:
- ESPRESSObin v7/Ultra and MOCHAbin procedures
- USB and SD card source options
- gzwrite to eMMC/SATA
- Troubleshooting section
- Board-specific notes
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Document U-Boot flash procedure for installing SecuBox to eMMC
from USB drive. Includes:
- USB to eMMC flash via gzwrite
- SD card alternative method
- Network interface mapping
- Troubleshooting tips
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Include disk partitioning tools (parted, dosfstools, e2fsprogs)
and hardware detection (pciutils, usbutils) in the RPi image
for consistency with other build scripts.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The secubox-install script requires parted for disk partitioning
and dosfstools for mkfs.fat on ESP. Also added grub-pc-bin for
legacy BIOS boot support, matching build-installer-iso.sh.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- TUI mode switch and persist verified
- Kiosk mode switch back verified
- Both modes work with --now flag
- Modes persist across reboots
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Release v1.5.1 complete with all images
- Downloaded and tested v1.5.1 image
- startup.nsh verified in ESP partition
- VirtualBox boot confirmed working
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- cmdline-handler: Use systemctl mask to prevent kiosk startup
- cmdline-handler: Kill X11/Chromium if already running
- cmdline-handler: Create generator drop-in for correct target
- kiosk.service: Wait for cmdline handler before starting
- tui.service: Wait for cmdline handler before starting
Fixes: TUI boot menu option was loading Kiosk GUI instead
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- build-image.yml: Download packages from build-packages workflow
and pass --slipstream flag to include them in images
- build-live-usb.yml: Remove redundant cache copy, improve logging
- release.yml: Update package count from 93 to 124
- build-image.yml: Update package count from 33 to 124
All 124 SecuBox packages will now be slipstreamed into live USB
and system images when built via CI.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The VirtualBox EFI firmware doesn't always detect the fallback boot
loader at /EFI/BOOT/BOOTX64.EFI. Adding a startup.nsh script to the
ESP root ensures the EFI shell automatically loads GRUB.
This fixes the "PXE boot" issue when testing live USB images in
VirtualBox with UEFI firmware enabled.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Boot Banner Improvements:
- /etc/issue: Gold ASCII art pre-login banner with credentials
- /etc/motd: Colorful LIVE USB banner with access info
- secubox-status: New command showing system overview with CRT colors
- secubox-help: Quick reference for all secubox commands
- secubox-logs: Live security log viewer shortcut
- profile.d: Login status display with mode/service/IP indicators
Mode Switching:
- cmdline-handler: Fixed TUI mode to start (not just enable) service
- secubox-mode: Updated with CRT colors and emoji status indicators
GRUB Menu:
- Kiosk GUI is now default when --kiosk flag used
- All entries have emoji indicators (⚡🖼️📟🌉🛡️💾🚀🔧🚨🐛)
- CRT-style menu colors (cyan on black, yellow highlights)
CI Workflows:
- build-live-usb.yml: Updated boot options and credentials in release notes
- release.yml: Updated to 93 packages, new boot options, correct credentials
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add secubox-install script for interactive disk installation
- Add "Install SecuBox to Disk" GRUB menu entry
- Add secubox.install=1 kernel parameter support
- Auto-launch installer when booted with install option
The installer:
- Lists available disks with size and model
- Asks for confirmation before wiping
- Creates GPT partitions (ESP + root + data)
- Copies live filesystem to disk
- Installs GRUB bootloader (UEFI + BIOS)
- Generates proper fstab
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The installer was creating users.json with SHA256 hash of "admin" instead
of "secubox", causing login failures when trying admin/secubox credentials.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- build-packages.yml: Add workflow_call with secrets
- build-image.yml: Add workflow_call with inputs, fix matrix for all event types
- publish-packages.yml: Add workflow_call with inputs and secrets
This fixes the release.yml workflow which was failing because it tried
to call these workflows as reusable workflows without the workflow_call
trigger defined.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update Home.md with VirtualBox (2 Minutes) quick start section
- Update Home-FR.md with French translation
- Update Home-ZH.md with Chinese translation
- Update version to v1.5.0 and package count to 93
- Add VM creation script options documentation
- Reference create-secubox-vm.sh script with --download option
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
With set -euo pipefail, find on non-existent directories causes script
failure even with stderr redirected. Add directory existence checks
before running find commands to prevent CI failures.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Go binaries are cross-compiled (arm64 on x86_64 runner) and already
stripped with -ldflags "-s -w". The native strip tool can't recognize
the ARM64 binary format, causing build failures.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add tmpfiles.d/secubox.conf with mode 1777 (sticky + world-writable)
- Update postinst to create /run/secubox with correct permissions
- Run systemd-tmpfiles --create on package install
This fixes permission denied errors when services try to create
Unix sockets in /run/secubox directory.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add require_jwt dependency to all public endpoints:
- /dashboard
- /alerts
- /network_summary
- /system_health
- /network_mode (GET)
- /menu
- /board_summary
Only /health remains public for monitoring.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add checkAuth() function to verify token on page load
- Redirect to login if no token present
- Clear invalid tokens on 401 response
- Block page content until auth verified
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New Phase 9 System Tools modules:
- secubox-rtty: Remote terminal access via web interface
- secubox-smtp-relay: SMTP relay status and queue monitoring
- secubox-routes: Routing table viewer with IPv4/IPv6 support
- secubox-reporter: System report generation and scheduling
All modules include:
- FastAPI backend with JWT auth
- P31 Phosphor CRT-style web interface
- Auth verification and auto-refresh
- Nginx reverse proxy configuration
- Systemd service and menu integration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add c3box binary build alongside secuboxd and secuboxctl
- Pre-build React app for soc-web before dpkg-buildpackage
- Update soc-web debian/rules to skip npm if dist/ pre-built
- Remove nodejs/npm Build-Depends (now pre-built in CI)
Fixes build failures for secubox-daemon and secubox-soc-web packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
