# Publishing and configuring this project

This is a sanitized publication copy of the DS1812+ ramdisk recovery and
Debian 13 / OpenMediaVault 8 work. The technical investigation, boot payloads,
rebuild tooling, storage protection, hardware monitoring and tests are retained.

## Privacy changes

Personal SSH public keys and the site-specific remote key-roster installer were
removed. Internal addresses/domains, host names, device serials, MAC addresses,
array/filesystem/boot/session identifiers and private checkout paths were replaced
with examples. Operator handoffs were removed or generalized. The OMV API's
standard new-object UUID is retained because it is a protocol constant.

`192.0.2.*` and `example.invalid` are documentation examples. MACs starting
`02:00:00:00:00:`, `11111111…` UUIDs, serials containing `EXAMPLE` or
`DISK-SERIAL`, and `LOCAL_TIMEZONE` are placeholders. QEMU's standard
`10.0.2.2` / `10.0.2.15` emulator addresses are retained. Compiled BusyBox
DHCP-server pool defaults are also retained, with an exception restricted to
the reviewed binary checksum in the publication scanner.

All four release ramdisks were unpacked and inspected. Only their `init` entry
was sanitized; other entry payloads are unchanged. The EFI selector is unchanged.
`release/ds1812-unlock/SHA256SUMS` covers the sanitized files. Checksums in older
lab notes describe original artifacts and must not be used to validate these
publication images. No SSH private keys were found in the tracked release images.
Generated per-device recovery images and captured OS archives are different:
they contain credentials and must stay private.

## Configure before building

The release diagnostic images are historical templates. They still expose an
unauthenticated recovery shell and diagnostics, and their anonymized array/MAC
values cannot boot your installation as-is. Hardware boot results in the logs
refer to the original lab artifacts; the sanitized images have not been booted
on a NAS.

Use the [separate OS/storage rebuild procedure](../scripts/ds1812/rebuild/README.md)
for the Debian 13 / OMV 8 path. Its image builder requires your actual
`--lan1-mac`, your own `--keys` file, a private `--rescue-host-key`, and the root
UUIDs from your reviewed rebuild plan. It replaces the sample LAN1 identity and
removes unauthenticated diagnostics. Use `scripts/ds1812/rebuild/init-template.sh`
as its `--init` input and the sanitized revision-o archive as its `--source`.
Store its output outside the public tree.

Set the same actual MAC in `10-ds1812-lan1.link` before installing it. The
post-install `network` step requires `--lan1-mac` and checks that file matches.
Choose your own client IP allowlists and network settings. Disk inventories and
plans must be generated for your hardware, never copied from the historical logs.

For historical shared-root diagnostics only, customize a private copy of
`release/ds1812-unlock/init.sh` with your MAC and array UUID, then repack using
`scripts/ds1812/replace-ramdisk-init.py SOURCE.gz INIT.sh OUTPUT.gz`. That helper
preserves every other archive entry. The older Debian 12 installer scripts are
retained as historical work, not the Debian 13 rebuild procedure. Their provision
script now refuses to proceed without operator-supplied `AUTHORIZED_KEYS_FILE`.
`installer_authorized_keys.example` intentionally contains no key.

## Publish from a fresh repository

The existing development repository's history, author metadata, remote settings
and ignored `dist/` directory remain private. A normal push of that repository
would publish old sensitive revisions. Use the separately prepared clean export,
which contains no `.git`, `dist/`, build caches, private backups or redaction map.
Initialize a new repository in that export and choose the public author identity
before making its first commit. Do not import or merge the old history.

Run from the clean export:

```sh
python3 scripts/check-publication.py --export
(cd release/ds1812-unlock && sha256sum -c SHA256SUMS)
git init
# Set your intended public user.name and user.email before committing.
```

The scanner checks text and decompressed newc entries for common key/token/hash
formats, private IPv4 addresses and device MACs. It is a regression check, not a
guarantee against every form of identifying prose or opaque binary data. Review
new files before publishing; `.gitignore` does not remove already tracked files.

## Validation of this scrub

See [publication validation](VALIDATION.md) for the completed checks and limits.

## Public source snapshot

The public catalog and source browser use only the parentless `public` branch.
The private development branch and old tags are excluded. The source snapshot
omits the obsolete Debian 12 preseed, installer builder, provision script and
installer-key example: the publishing platform excludes unattended installer
credentials. Use the Debian 13 rebuild tooling; the Debian 12 notes are retained
only as historical investigation. No versioned binary release is declared by
this initial source publication.