ScottW514 e9443a60ef Keep debug-tweaks out of release images; harden the installer ...

- Move the passwordless-root debug-tweaks image feature out of the
  shared kas config into forgefirm-image-dev.bb, so the release
  forgefirm-image built from the same config is not passwordless-root.
  release.sh gains a gate that reads the built rootfs /etc/shadow and
  fails on an empty root password, plus a config-level guard that
  debug-tweaks is not present in the resolved kas dump. (B-1)
- The installer copies ffboot out of the signature-verified new rootfs
  it already mounts, instead of fetching and executing it from a mutable
  GitHub raw ref. (B-2)
- Record audit remediation Phase 2 (GATE B) status in BRINGUP.md,
  including the bench pass still required to close the gate.

2026-08-14 16:20:02 -04:00

..

conf

Port meta-forgefirm to Scarthgap

2026-06-19 10:33:52 -04:00

recipes-bsp/firmware-imx

docs: describe the firmware that exists; ship the NXP firmware EULA

2026-08-13 12:34:48 -04:00

recipes-extended

image: slot-sized release rootfs, ext4 artifact, fwup, mkfw.sh

2026-08-08 11:37:19 -04:00

recipes-forgefirm

Keep debug-tweaks out of release images; harden the installer

2026-08-14 16:20:02 -04:00