9af1c6d89a
A freshly installed server could not build standard or engineer: about 8 GB they install from existed only on the running server. scripts/capture-site-content.sh pulls it over SSH into the gitignored payload: - _shared/Applications/extra (Office, Adobe, OpenText, Java, fonts, Wi-Fi, Zscaler), without pxe-status/ (the playbook deploys that); - each image's own Deploy/Applications files and folders (GE CA certificates, the Engineering Layer payload), without the repo-managed Install-EngineeringLayer.ps1 and without stale BPRT copies; - the links images keep there, as links.txt; - fresh bios-staging (*.exe plus models.txt, which the Dell update rewrites), boot.wim, and the known Blancco file set. It dry-runs by default, compares by checksum (a Blancco config.img had the same size and time as the stale copy), writes SHA256SUMS, and refuses what FAT32 cannot hold: files of 4 GiB or more, Windows-illegal names, and case-only name clashes. build-usb.sh copies site-content/ unsplit and refuses to build without it (unless --skip-site-content), or when SHA256SUMS is missing or does not cover every file. The playbook checks SHA256SUMS, then merges the content into winpeapps and recreates the links. It only links to folders that exist, so it never creates an empty _shared BPRT, which would stop the first MCL import from seeding it. Link lines are validated before anything is copied. pull-bios.sh is gone. It read a path the server no longer uses, with a hard-coded password.
135 lines
4.0 KiB
Plaintext
135 lines
4.0 KiB
Plaintext
# Large binary files — download/build these, don't commit them
|
|
*.deb
|
|
*.zip
|
|
*.wim
|
|
*.iso
|
|
*.efi
|
|
*.sdi
|
|
|
|
# OneDrive download artifacts
|
|
OneDrive_*/
|
|
|
|
# Error folders from OneDrive download
|
|
__*/
|
|
___*.txt
|
|
|
|
# Original OneDrive folder structure (reorganized into autoinstall/ and playbook/)
|
|
WestJeff*/
|
|
|
|
# Duplicate at root (canonical copy in unattend/)
|
|
/FlatUnattendW10.xml
|
|
|
|
# Offline packages (built by download-packages.sh)
|
|
offline-packages/
|
|
|
|
# Boot tool binaries (built by prepare-boot-tools.sh)
|
|
boot-tools/
|
|
# Track the Blancco GRUB config as source-of-truth for grubx64.efi rebuilds.
|
|
# prepare-boot-tools.sh rebuilds grubx64.efi from this file via grub-mkstandalone.
|
|
!boot-tools/blancco/grub-blancco.cfg
|
|
|
|
# WinPE boot files (wimboot, boot.wim, BCD, ipxe.efi, etc.)
|
|
boot-files/
|
|
# Exception: track undionly.kpxe (open-source iPXE BIOS-mode NBP for
|
|
# legacy PXE clients, ~70KB, from boot.ipxe.org). Makes air-gapped USB
|
|
# build self-contained without a separate fetch step.
|
|
!boot-files/undionly.kpxe
|
|
|
|
# Python wheels for offline install (built by download-packages.sh)
|
|
pip-wheels/
|
|
|
|
# Deployment images (imported via webapp or USB)
|
|
geastandardpbr/
|
|
|
|
# OS files
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Python
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
venv/
|
|
|
|
# MOK Secure Boot signing keys (contains private key)
|
|
mok-keys/
|
|
|
|
# Secrets
|
|
secrets.md
|
|
**/eMxInfo*.txt
|
|
*.ppkg
|
|
enrollment/
|
|
drivers-staging/
|
|
bios-staging/
|
|
.claude/
|
|
|
|
# Secrets and credentials (defensive)
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
!.env.*.example
|
|
*.pem
|
|
*.key
|
|
id_rsa
|
|
id_rsa.*
|
|
*.ppk
|
|
*.p12
|
|
*.pfx
|
|
secrets.json
|
|
secrets.yaml
|
|
secrets.yml
|
|
*_secret
|
|
*_secrets
|
|
credentials.json
|
|
|
|
# GE-internal WiFi / 802.1X profiles - contain SSID + trusted-root thumbprint.
|
|
# Staged on PXE share at /srv/samba/enrollment/MachineAuth/ and copied to
|
|
# bays during imaging. Never check these into git.
|
|
AESFMA.xml
|
|
8021x.xml
|
|
BLUESSO.xml
|
|
WiFi-Profile.xml
|
|
*.wlanprofile
|
|
*.lanprofile
|
|
|
|
# Pre-staged binary (142 MB) - track via LFS or stage on PXE server, not in regular git
|
|
playbook/shopfloor-setup/Shopfloor/PrinterInstallerMap.exe
|
|
|
|
# Keyence VR-6000 InstallShield payload (560 MB). InstallShield MSIs split
|
|
# the compressed payload into Data1.cab; without it next to the MSI, msiexec
|
|
# exits 1603 with "SECREPAIR: Failed to open Data1.cab" (see
|
|
# /home/camp/pxe-images/keyence/Logs/Keyence/install.log for the signature).
|
|
# Canonical source on the GE-Enforce SFLD share:
|
|
# tsgwp00525\sfld$\v2\shared\dt\shopfloor\gea-shopfloor-keyence\apps\Data1.cab
|
|
# before building the USB image.
|
|
playbook/shopfloor-setup/gea-shopfloor-waxtrace/captured-binary/
|
|
|
|
# Keyence per-model installer payloads - too big for git, staged via sync-keyence.sh
|
|
playbook/shopfloor-setup/gea-shopfloor-keyence/vr3000/installers/Data*.cab
|
|
playbook/shopfloor-setup/gea-shopfloor-keyence/vr3000/installers/*.msi
|
|
playbook/shopfloor-setup/gea-shopfloor-keyence/vr5000/installers/Data*.cab
|
|
playbook/shopfloor-setup/gea-shopfloor-keyence/vr5000/installers/*.msi
|
|
playbook/shopfloor-setup/gea-shopfloor-keyence/vr6000/installers/Data1.cab
|
|
|
|
# Part Marker (Telesis) utility password - secret, deployed via the enrollment
|
|
# share from the working tree, never committed.
|
|
playbook/shopfloor-setup/gea-shopfloor-partmarker/PartMarker/Mark/utilpassword.txt
|
|
|
|
# HeatTreat per-machine DNC .reg exports (6601-6604) - contain DNC FtpPasswd
|
|
# credentials. Deployed via the enrollment share from the working tree.
|
|
playbook/shopfloor-setup/gea-shopfloor-heattreat/reg/*.reg
|
|
|
|
# SIC e10 controller config files carry the programmer/supervisor password
|
|
# in cleartext. Never commit them. See reference/e10/README.md
|
|
reference/e10/**/ConfigCtrl*
|
|
reference/e10/**/*.kind1
|
|
# GE part programs carry part numbers and marking content. Keep them out of
|
|
# git; they live in ~/pxe-images/e10-testing/partprograms/
|
|
reference/e10/partprograms/
|
|
|
|
# Per-site playbook values (NIC MACs); template: playbook/site-vars.example.yml
|
|
playbook/site-vars.yml
|
|
|
|
# Site content pulled from a live server (scripts/capture-site-content.sh)
|
|
site-content/
|