# Forge Repair Live builder

This source-only package assembles SystemRescue 13.02 amd64 with the signed
Forge Rescue 0.15.1 payload. It contains no vendor ISO, credentials, session
capability or customer data. No Git checkout or private repository access is
needed. Use is subject to the included Ready IT authorization and LICENSE.

## Prerequisites

On Windows, use PowerShell 7 and an existing Ubuntu WSL environment with
Python 3.11+, curl, GnuPG, OpenSSL and xorriso. The builder does not install
dependencies or need elevation. Allow about 5 GB of free working space.
Read `docs/repair-live-usb.md` for the complete operating and safety guidance.

Extract the complete ZIP into a new folder and open PowerShell there. Keep
the `scripts` directory and its files together.

## Download the signed Forge payload and build

Run this from the extracted builder folder. The output paths must be new.
The three files are an immutable production release, not a session bootstrap:

```powershell
$ErrorActionPreference = 'Stop'
$bundle = Join-Path $PWD 'rescue-0.15.1'
$null = New-Item -ItemType Directory -Path $bundle -ErrorAction Stop
$origin = 'https://forge.readyit.dk/cli/v2/payloads/rescue-bundle/linux-x64/0.15.1'
foreach ($name in @('forge-host', 'release-manifest.json', 'release-manifest.sig')) {
    Invoke-WebRequest -Uri "$origin/$name" -OutFile (Join-Path $bundle $name) `
        -MaximumRedirection 0 -TimeoutSec 120
}
pwsh -NoProfile -File .\scripts\New-ForgeRepairMedia.ps1 `
    -BundleDirectory $bundle `
    -OutputDirectory (Join-Path $PWD 'repair-output-0.15.1')
if ($LASTEXITCODE -ne 0) { throw 'Build failed; do not use partial output.' }
```

The builder downloads the official SystemRescue ISO and verifies its detached
GPG signature and pinned checksum. It independently verifies the Forge payload
against the included release public-key pin before assembly. Do not replace a
pin to accommodate a failed signature. Forge payload SHA-256:
`3c27c619b368853d24c899d069cc81b46505a2b2dcd9ce68a4323de09cfc6baa`.
A checksum alone does not replace the signature checks.

For a WSL distribution named differently, pass its exact registered name using
`-WslDistribution`. Linux can use `scripts/repair-media/fetch.py` and
`scripts/repair-media/build.py` directly; their `--help` documents the explicit
paths and inputs.

The new output directory contains the hybrid ISO, its SHA-256 sidecar and
`provenance.json`. These record the actual locally assembled image; assembly
is not claimed bit-for-bit deterministic. Preserve the provenance and verify
the checksum again after copying the image.

## Boot, pair and repair

Boot the ISO in an authorized compatible VM, or use upstream's
[USB installation instructions](https://www.system-rescue.org/Installing-SystemRescue-on-a-USB-memory-stick/)
with Rufus ISO mode and an explicitly selected disposable USB. Writing the
image erases that USB. Preserve the `RESCUE1302` volume label. The builder never
selects or writes physical disks. Secure Boot is not supported; do not bypass
firmware policy or silently change its settings.

Boot first and connect networking. Then the authorized technician uses a
signed-in Forge Agent CLI with the configured production Rescue issuer:

```text
forge rescue session create --platform linux-x64 --label "<device>" --out "<private-folder>"
forge rescue session connect --code <session-id>
```

Privately enter the generated **22-character `rescue.code`** at the live boot
prompt, not the six-character session ID. Never embed a capability in reusable
media or a public URL. Rescue expires at most 60 minutes after session creation.
It creates no permanent device enrollment.

Inspect the installed system separately from the live OS. Start read-only,
identify the exact disk and partition, preserve backups, and make only the
authorized repair. Finish with `forge rescue session close --code <session-id>`,
check cleanup, sync/unmount the specific repaired filesystem, and boot the
installed system without the live media.

## Scope and redistribution

The bounded acceptance covers a Debian ext4/fstab repair and reboot, with a
subsequent signed-payload refresh. It does not establish general Windows
recovery, Secure Boot, physical USB, UEFI firmware or every storage/network
configuration. Consult `docs/repair-live-usb-acceptance.md` for the evidence and
limits.

The derived image is a local integration, not an official SystemRescue release.
Public redistribution of a modified ISO requires separate component notices
and corresponding-source compliance; this package does not grant that clearance.
Official upstream inputs remain upstream downloads.