Asami Linux Enroller — remote-enrollment development

Standalone CLI for direct SSH enrollment on Debian 13 with running systemd. Edit only deployment-profile.json and rebuild with scripts/build.sh. The CLI requires neither GTK nor Python. The optional GUI uses system GTK 3. No endpoint environment override. CORE WMI owns approval/naming.

After SAS approval only: native APT packages, unique Asami account (existing password/UID/home preserved), dedicated root-owned authorized key, validated sudoers NOPASSWD bootstrap, stable Ed25519 host key, bounded SSH Match and systemd service. Nftables inserts only owned source-scoped SSH allows in actual input filter chains; third-party rules remain. Batch validation precedes apply. Public source policy and an owned systemd unit preserve those rules at boot. Success requires current CORE SSH/admin/SFTP proof.

Tests: go test -race ./... ; go vet ./... ; sh -n worker.sh . Automated native execution has passed in an initially unconfigured Debian 13 systemd container, using a QA-only build with the QA CORE origin. The production deployment profile is unchanged. The campaign covers approval/SAS, actual CORE SSH/admin/SFTP verification, reassociation, refusal, cancellation, and real 15-minute pending expiry across CORE restarts.

A separate automated campaign on a Debian 13 KVM guest with an existing Asami account has also passed native enrollment and a real kernel reboot. The account, password, home authorized keys, host key, sudoers and managed policy were preserved. After reboot, the owned firewall unit and SSH were active, and CORE verified SSH/admin/SFTP again without rerunning the Enroller.

The container evidence alone does not prove a kernel reboot. The VM campaign uses a known existing SSH/account baseline rather than a newly installed OS. Human qualification of the exact final candidate remains open. REM1/HH/Receipes stages are outside this implementation.

Versioned Linux S1 release assets

VERSION is the official SemVer used by --version and the release build. On the qualified Debian 13 amd64 builder, scripts/build-release-assets.sh creates a versioned standalone ELF, its SHA-256 sidecar, and an unsigned compatibility manifest containing the source commit/tree, target tuple, protocol range, invocation, size, and digest. The manifest is metadata, not a cryptographic signature; for this initial bootstrap binary the canonical GitLab project over HTTPS is the agreed distribution trust boundary. Ed25519-signed package contracts for later Tunneler/HostHelper downloads are separate and unchanged.

The first official tuple is Debian 13 amd64 and the current enrollment bootstrap protocol is version 1. Unsupported tuples must be rejected rather than treated as compatible.

Diagnostic (--debug)

Run the Enroller with --debug to record execution phases and errors in a unique <executable>.*.log file beside the executable and mirror them to stderr. The log never dumps protocol payloads or credentials. Debug logs remain after success. The diagnostic option does not change SAS approval or privileged operations.

Graphical interface and dedicated Linux icon

Run ./asami-enroller --gui to open the optional native GTK 3 interface. Its title is “Enrôleur de machine Asami”. The dedicated operator artwork is shown on the left with 5px corner radius; the title, SAS and status are centered in the right column. Details stay left aligned and receive all extra height. SAS/help disappear after WMI approval. Errors freeze progress until explicit retry.

The GUI starts the same CLI protocol/worker using pkexec for local administration when needed. Its private stdin channel carries only retry/cancel UI commands; all CORE capabilities remain in the worker. It neither replaces SAS approval nor performs SSH changes before approval. Closing during installation is refused until the worker reaches a safe terminal or retry state. GUI diagnostics are saved beside the executable; errors and debug keep them.

GTK is loaded only for --gui. The ordinary CLI, --help and --version still run without a display, GTK, Python or Cgo. The first approved tuple remains Debian 13 amd64. --gui-self-test exercises the production window with no CORE or privileged worker; --gui-snapshot PATH saves that self-test's window.

Run ./asami-enroller --install-desktop as the desktop user to install a copy of the executable, its dedicated icon and application launcher under XDG_DATA_HOME (default ~/.local/share). This opt-in action does not contact CORE or change SSH. The launcher opens the native GUI with its own app-id, WM_CLASS and icon, rather than changing a terminal's global icon. Remove ~/.local/share/applications/net.lodlp.Asami.Enroller.desktop and ~/.local/share/asami-enroller to remove the optional launcher (adapt to XDG_DATA_HOME).