951af764fb
fix( #623 ): close review gaps — 3 chmod 750 /var/log clobbers + tmpfiles defense-in-depth
...
Review found two gaps the install-d sweep missed:
- chmod-form clobber: soc-gateway/soc-agent/ui-manager did 'chmod 750
/var/log/secubox' (same #511 traversal class) -> now 0755.
- secubox-core tmpfiles.d only declared /run/secubox; now declares all 5 shared
parents at 0755 (mode-only, owner-agnostic) for boot/install-time self-heal.
core 1.1.7 -> 1.1.8.
2026-06-18 10:39:52 +02:00
bd7dda0c6f
feat(secubox): complete meta-script generator Tasks 14-17
...
Task 14: Arch Profiles
- Add profiles/arch/arm64.yaml and profiles/arch/amd64.yaml
- Add ResolveWithArch() to merger for base → arch → tier chain
- Add tests for arch profile resolution
Task 15: Package secubox.yaml for All Packages
- Add scripts/generate-secubox-yaml.py generator script
- Generate 131 debian/secubox.yaml files with:
- Category detection (security, network, system, etc.)
- Tier assignment (all, lite, standard, pro)
- API socket and UI path detection
Task 16: APT Repository Setup
- Add apt/conf/ reprepro configuration (multi-arch arm64/amd64)
- Add apt/hooks/lintian-check pre-publish validation
- Add scripts/apt-publish.sh and scripts/apt-sync.sh
- Add apt/README.md documentation
Task 17: CI Integration
- Add .github/workflows/build-secubox-cli.yml
- Build for linux-amd64 and linux-arm64
- Version injection via ldflags
- GitHub releases on tag push
Code Quality Fixes (Tasks 10-13):
- Add atomic writes for OTA boot control files (0600 perms)
- Fix NVME device extraction (nvme0n1p2 → nvme0n1)
- Add scanner.Err() checks in hardware detection
- Fix URL injection validation in fetch command
- Add proper cleanup on checksum failures
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-05-11 05:32:29 +02:00
acde1344aa
fix: Remove :9443 from internal kiosk URLs
...
The kiosk scripts were using port 9443 for internal connections,
but nginx listens on port 443 inside the VM. Port 9443 is only
used for host port forwarding (QEMU/VirtualBox NAT).
URLs changed:
- https://192.168.255.1:9443/ → https://192.168.255.1/
- https://localhost:9443/ → https://localhost/
- https://127.0.0.1:9443/ → https://127.0.0.1/
This fixes the kiosk "connection refused" error in VM environments.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-04-10 11:30:38 +02:00
d9d2eb4edf
docs: Add modules architecture documentation
...
- modules-architecture.md: 6-domain module organization
- secubox_modules_architecture.svg: Visual diagram
2026-04-10 10:47:35 +02:00
9690412f29
feat: Add secubox-ui-manager, boot architecture docs, and plymouth theme
...
New features:
- secubox-ui-manager: Unified UI management with KUI/TUI/Console fallback
- State machine for mode transitions
- Hypervisor detection and optimization
- Modular debug system (levels 0-5)
- Health monitoring with automatic fallback
- Plymouth secubox-cube theme with CRT effects and module icons
- Boot architecture documentation (ANSSI CSPN reference)
- Chain de boot diagram (SVG)
- Execution modes: PROMPT/KIOSK/API
Fixes:
- build-live-usb.sh: Remove Type=idle from getty override
- build-live-usb.sh: Add StandardInput/StandardOutput for proper TTY
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-04-10 10:23:54 +02:00
