SnapshOT 0.3.0 alpha

SnapshOT 0.3.0 alpha (pre-release)

This is an alpha and the first public release of SnapshOT. The image is usable
for evaluation and lab work; menus, scripts, file locations and the package
selection may change between releases. Installer QA on VMware Fusion and real
hardware is still in progress for this build (see Caveats). Report problems in
GitHub issues, and
vulnerabilities through private vulnerability reporting as
SECURITY.md
describes.

Debian 13 (trixie), pinned to snapshot.debian.org 20260901T022952Z
(SOURCE_DATE_EPOCH 1788229792). Each image records its version, architecture,
pin and build commit in /etc/snapshot-release, and every package and vendored
tool in /usr/share/snapshot/reference/BUILD-MANIFEST.txt.

Built from commit: 26cd8d7 (26cd8d72b7d2fbf81712eb69c9cf632caa6e807d)

Verified in QEMU 10.0 (TCG, on an Apple Silicon Mac), each VM with 4 GiB of
RAM, a 20 GiB disk and no network adapter:

• arm64, AAVMF without Secure Boot, on the virt machine with its serial
  port. The live ISO booted to the desktop (with a black screen until then;
  see Caveats). /etc/snapshot-release names
  0.3.0-alpha, arm64 and 26cd8d7; nmcli radio wifi reports disabled;
  dumpcap has cap_net_admin,cap_net_raw and tshark -D lists interfaces
  without sudo; /opt/snapshot/bin holds ics-python, the OPC UA command-line
  tools and plcscan; no Autopsy package is installed. The installer (Erase
  disk, Encrypt system) completed, showed "Restarting in 5 seconds" with the
  progress bar at 96% and restarted on its own. The installed system booted
  from its SnapshOT entry to the themed GRUB menu and, with nothing typed at
  GRUB, the splash asked for the passphrase on screen with the caret, the hint
  and one square per keystroke (BackSpace removed one); the keyboard unlocked
  the disk and the login worked. /proc/cmdline ends in
  plymouth.ignore-serial-consoles and has splash once. Removing the word at
  the GRUB prompt put the prompt back on the serial port, where the disk
  unlocked as well. Checklist items 1 to 10, 12 and 13 passed.
• amd64, OVMF with Secure Boot enforced and Microsoft's keys. The live ISO
  booted through shim to the splash and the desktop, with the same checks
  (opcua-client is in /opt/snapshot/bin too) and SecureBoot enabled. The
  installer refused the login operator ("'operator' is not allowed as
  username.", Next disabled), installed with Erase disk and Encrypt system,
  showed "Restarting in 5 seconds" at 96% and restarted on its own. The
  installed system then booted with Secure Boot on twice: from a fresh copy of
  the Microsoft-keys variable store, through the removable media path
  EFI/BOOT (shim's fallback recreated the SnapshOT boot entry), and from the
  variable store the installer wrote, through the SnapshOT entry. Both times
  the themed GRUB menu appeared, the splash asked for the passphrase with the
  caret, the hint and one square per keystroke, the disk unlocked and the login
  worked. Its command line does not carry the arm64 parameter. Checklist items
  1 to 10, 12 to 14 and the operator half of 15 passed (item 12 without a
  Wi-Fi adapter: the switch reads disabled).
• Checked on the previous build only (63e1680, the same tree without the
  arm64 fix): the Whisker menu's folders, the SnapshOT Wiki in Firefox ESR and
  about:policies. Nothing they depend on changed.
• Not run: VMware Fusion, Parallels, UTM, real hardware, BIOS boot, an
  arm64 install with Secure Boot on, and checklist item 11 (a VM with 2 GB of
  RAM).

Why 0.3.0 alpha

The image gains a Wi-Fi client, installed systems now boot with Secure Boot on,
the offline update stick works, and the installer and the boot splash get a set
of fixes, hence 0.3.0. It is an
alpha because installer QA on VMware Fusion and real hardware is not finished
and the interfaces may still change. It replaces v0.2.1, which is withdrawn;
this is the only published image.

Images

• snapshot-amd64.hybrid.iso: BIOS and UEFI, for x86-64 laptops and VMs.
  1,887,596,544 bytes (1.76 GiB), SHA-256
  18f53964eb0c69021c325b6cd45b5ada3fca3ff361a80b2393f435d9e1f9b2b4.
• snapshot-arm64.hybrid.iso: UEFI only, for arm64 VMs (UTM, Parallels,
  VMware Fusion on Apple Silicon) and UEFI arm64 hardware. It does not boot an
  Apple Silicon Mac directly. 1,845,569,536 bytes (1.72 GiB), SHA-256
  b4e37cdae81b69afc2ce188d3572156a51d7f13ee7519cb8299a93839db020a3.
• SHA256SUMS: the SHA-256 of both images.

Both images are under GitHub's 2 GiB asset limit and are published whole, not in
parts.

Verify the image, then write it to a USB stick (/dev/sdX is the whole stick,
and it is erased):

sha256sum -c --ignore-missing SHA256SUMS            # Linux, next to the downloaded ISO
shasum -a 256 snapshot-amd64.hybrid.iso             # macOS: compare with SHA256SUMS
certutil -hashfile snapshot-amd64.hybrid.iso SHA256 # Windows: compare with SHA256SUMS
sudo dd if=snapshot-amd64.hybrid.iso of=/dev/sdX bs=4M conv=fsync status=progress

docs/getting-started.md covers macOS, Etcher, Rufus (DD Image mode), Ventoy
and images published in parts. For a VM, enable UEFI and give it 4 GB of RAM
(the installer needs at least 3 GiB) and a 20 GB disk; Secure Boot can stay on.

Live session: user snapshot, password live. Install with the Install
SnapshOT icon on the desktop.

New since v0.2.1

• Wi-Fi client, with the radio off. wpasupplicant is on the image, so
  NetworkManager can join Wi-Fi and wired 802.1X networks; v0.2.1 could do
  neither. NetworkManager's Wi-Fi switch ships off, live and installed: every
  Wi-Fi adapter stays unused and the laptop sends no probe requests at a site.
  Turn Wi-Fi on from the network icon (Enable Wi-Fi) or with
  nmcli radio wifi on; it then scans in the background with a random MAC
  address for its probes. Switching it off soft-blocks the radios through
  rfkill. The wiki explains how to run an airodump-ng survey beside the switch.
• Secure Boot on installed systems. The image carries shim-signed and
  the Debian-signed GRUB (grub-efi-amd64-signed or grub-efi-arm64-signed).
  On UEFI the installer puts shim, the signed GRUB and MokManager in
  EFI/SnapshOT, with the firmware boot entry SnapshOT, and again at the
  removable media path EFI/BOOT, so a machine that has lost its boot entry
  still boots and shim's fallback recreates the entry. Calamares' own fallback
  copy, which put an unsigned GRUB over the shim, is off. The live ISO build
  now fails if the signed boot files are missing.
• Visible passphrase prompt. An encrypted install used to wait for its
  disk passphrase behind a splash that showed only the lockup. The splash
  now shows "Please unlock disk luks-...", a blinking red caret, the hint
  "Type the passphrase, then press Enter" and a red square per keystroke.
• The arm64 prompt stays on screen. QEMU's arm64 virt machine, which UTM
  uses, names its serial port as the console, and Plymouth then asked for the
  passphrase on that serial port only: the screen stayed black and typing did
  nothing. arm64 installs now boot with plymouth.ignore-serial-consoles, so
  the splash asks on screen; amd64 is unchanged. To unlock over a serial
  console instead, remove the word at the GRUB prompt (e, then Ctrl-x), as
  docs/offline-install.md describes.
• The installer refuses logins that already exist. The users page refuses
  a login that is already a user or group name in the image, such as
  operator, daemon or wireshark ("'operator' is not allowed as
  username."), where the install used to fail at its last step.
• Installer RAM check. The welcome page requires 3 GiB of RAM and stops
  below that before anything is written: the LUKS2 format (Argon2id) ran a
  2 GiB live session out of memory and took the desktop down with it.
• Automatic restart. The installer shows "Restarting in 5 seconds" under
  the progress bar, which stands at about 96% at that point, and reboots by
  itself five seconds later; the Finished page appears only if that reboot
  fails.
• Slideshow background. The installer slideshow's dark background fills
  the window, with no white frame around each slide.
• No stale version in the installer. The partition and summary pages say
  "Erase disk and install SnapshOT", where they said "SnapshOT 0.1".
• The offline update stick works. scripts/make-update-usb.sh, run on a
  networked Debian host, failed at its publish step with trixie's aptly; it now
  publishes through an aptly filesystem endpoint. The stick holds a signed apt
  repository of the named packages from trixie main at the release's pin, for
  amd64 and arm64, on FAT32 or exFAT. The script checks the snapshot's
  signature against debian-archive-keyring and its own signature with gpgv,
  and prints the commands for the laptop: the public key in
  /etc/apt/keyrings, a signed-by source for the stick, and removing it
  afterwards (docs/updates.md). Tested in debian:trixie containers on
  amd64 and arm64 with a few small packages, onto FAT32 and exFAT images: a
  clean trixie client holding only the public key passed apt-get update with
  signature verification and installed from the stick, and refused a wrong key
  and an edited InRelease, Release, Packages index or .deb. A full
  mirror of trixie main (154.5 GiB for both architectures, so a 256 GB
  stick) has not been run. Re-imaging remains the way to move between releases.
• Documentation. The SnapshOT Wiki covers the Wi-Fi switch, Secure Boot
  and kernel lockdown, the refused logins and the laptop side of the update
  stick, and uses American spelling throughout. SECURITY.md says which
  releases receive fixes.

SnapshOT's own packages: calamares-settings-snapshot 0.1.1...