150b3730ef
Some checks failed
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Docs CI / lint-and-preview (push) Has been cancelled
Mirror Thin Bundle Sign & Verify / mirror-sign (push) Has been cancelled
api-governance / spectral-lint (push) Has been cancelled
34 lines
1.7 KiB
Markdown
34 lines
1.7 KiB
Markdown
# Bootstrap Pack (Airgap 56-004)
|
|
|
|
Guidance to build and install the bootstrap pack that primes sealed environments.
|
|
|
|
## Contents
|
|
- Core images/charts for platform services (Authority, Excititor, Concelier, Export Center, Scheduler) with digests.
|
|
- Offline NuGet/npm caches (if permitted) with checksum manifest.
|
|
- Configuration defaults: sealed-mode toggles, trust roots, time-anchor bundle, network policy presets.
|
|
- Verification scripts: hash check, DSSE verification (if available), and connectivity probes to local mirrors.
|
|
|
|
## Build steps
|
|
1. Gather image digests and charts from trusted registry/mirror.
|
|
2. Create `bootstrap-manifest.json` with:
|
|
- `bundleId`, `createdAt` (UTC), `producer`, `mirrorGeneration`
|
|
- `files[]` (path, sha256, size, mediaType)
|
|
- optional `dsseEnvelopeHash`
|
|
3. Package into tarball with deterministic ordering (POSIX tar, sorted paths, numeric owner 0:0).
|
|
4. Compute sha256 for tarball; record in manifest.
|
|
|
|
## Install steps
|
|
1. Transfer pack to sealed site (removable media).
|
|
2. Verify tarball hash and DSSE (if present) using offline trust roots.
|
|
3. Load images/charts into local registry; preload caches to `local-nugets/` etc.
|
|
4. Apply network policies (deny-all) and sealed-mode config.
|
|
5. Register bootstrap manifest and mirrorGeneration with Excititor/Export Center.
|
|
|
|
## Determinism & rollback
|
|
- Keep manifests in ISO-8601 UTC; no host-specific metadata in tar headers.
|
|
- For rollback, retain previous bootstrap tarball + manifest; restore registry contents and config snapshots.
|
|
|
|
## Related
|
|
- `docs/airgap/mirror-bundles.md` — mirror pack format and validation.
|
|
- `docs/airgap/sealing-and-egress.md` — egress enforcement used during install.
|