mirror of
https://github.com/jamesstringer90/appsandbox.git
synced 2026-10-22 11:03:15 -05:00
James Stringer
434bfb64ab
Replace the prebuilt-ELF/prebuilt-.ko shipping model with three
in-process prefetchers that populate per-VM staging from authoritative
sources at create time:
--prefetch-repo GitHub tarball (agent + DKMS sources, units)
--prefetch-build-deps archive.ubuntu.com Packages closure walk
(xz-embedded for Packages.xz, BCrypt SHA-256
verify, synthetic Packages file for offline apt)
--prefetch-wsl-deps Microsoft NuGet libd3d12*/libdxcore.so
The Ubuntu guest's firstboot script then builds the agent from source
(make + make install), installs both kernel modules via DKMS, and
optionally enables openssh-server — all offline, against an isolated
apt sources dir pinned to /opt/appsandbox/local-apt{,-extras}.
xz-embedded gained CRC64 support (XZ_USE_CRC64 + xz_crc64.c compiled in)
because Ubuntu's Packages.xz uses 0x04/CRC64 in its stream check; without
this the decoder bails at the first block header. Decompression also
streams to disk in 4 MiB chunks instead of buffering the whole ~50 MiB
output in RAM.
Linux VM credentials now flow from the create-VM modal:
- host hashes admin_pass into glibc $6$ SHA-512 (unix_password_hash,
same path Windows autounattend uses); plaintext is wiped immediately
- two marker files staged into the rootfs:
/etc/appsandbox-admin-user (UTF-8 username)
/etc/appsandbox-admin-hash (consumed and wiped by STEP 5)
- firstboot useradd + usermod -p so /etc/shadow gets the hash directly
- gdm autologin + GNOME OOBE skip now use $ASB_USER, not hardcoded test
- SSH gated on /etc/appsandbox-ssh-enabled marker; STEP 7.5 installs
openssh-server from local-apt-extras, enables ssh.service + ssh.socket,
opens ufw
ComPorts/com1 restored as a Linux-only debug pipe — systemd's
console output goes to \.\pipe\<vm>.com1 so the host can see firstboot
progress without an SSH session into the guest.
STEP 17 verification now resolves the asb_drm card by walking
/sys/class/drm/card*/device/driver instead of hardcoding card0 — with
efifb=off and asb-evict-simpledrm.service, asb_drm lands as card1.