be9f14ce34
A small helpdesk system: an office Pixel running a patched GrapheneOS Dialer answers technician calls, records both call legs as separate channels, and a Ruby backend transcribes them through Whisper and files an AI summary against the caller. Squashed to a single commit for sharing. No credentials are included; secrets live outside the repo in /etc/helpdesk/env on the server or a gitignored .claude/env.local locally. See .claude/env.local.example for the shape. Start at README.md, then docs/architecture.md.
52 lines
2.7 KiB
Bash
52 lines
2.7 KiB
Bash
#!/usr/bin/env bash
|
|
# GrapheneOS bring-up — STAGE 1: provision, fetch, verify, sync (Pixel 10a "stallion").
|
|
# Commands verified against grapheneos.org/build on 2026-07-07.
|
|
# The source tree is huge (~136 GiB w/ history) and is NOT committed (.gitignore: resources/grapheneos/).
|
|
# Run on the dedicated build box. Stages 2-4 (adevtool, keys, build, flash) are in
|
|
# docs/runbooks/graphene-build.md. This script is deliberately step-gated — read before running.
|
|
set -euo pipefail
|
|
|
|
# ── the ONE thing to get right: the current Stable tag (re-verify it lists "Pixel 10a") ──
|
|
TAG="${1:-2026062800}" # Stable as of 2026-07-07. Check https://grapheneos.org/releases for newer.
|
|
DEST="${2:-$HOME/grapheneos-$TAG}"
|
|
|
|
echo "==> Target: Pixel 10a (stallion), GrapheneOS tag refs/tags/$TAG"
|
|
echo " ⚠ Confirm on grapheneos.org/releases that $TAG is current Stable AND lists 'Pixel 10a'."
|
|
echo
|
|
|
|
echo "==> Host prerequisites (Debian/Ubuntu):"
|
|
cat <<'EOF'
|
|
sudo apt install repo yarnpkg zip rsync git python3 gnupg openssh-client curl
|
|
# + Node.js 24 LTS on PATH (NodeSource/nvm) for adevtool
|
|
# + 32-bit libs: sudo dpkg --add-architecture i386 && sudo apt update \
|
|
# && sudo apt install libc6:i386 lib32stdc++6 lib32gcc-s1
|
|
# + Debian PATH: echo 'export PATH=$PATH:/sbin:/usr/sbin:/usr/local/sbin' >> ~/.bashrc
|
|
# Needs: x86_64, >=32 GiB RAM, ~300 GiB free disk.
|
|
EOF
|
|
command -v repo >/dev/null || { echo "!! install the 'repo' tool first (sudo apt install repo)"; exit 1; }
|
|
command -v git >/dev/null || { echo "!! install git first"; exit 1; }
|
|
|
|
mkdir -p "$DEST" && cd "$DEST"
|
|
|
|
echo "==> repo init (signed Stable tag — NOT a device branch; there is no 17-stallion OS branch)"
|
|
repo init -u https://github.com/GrapheneOS/platform_manifest.git -b "refs/tags/$TAG"
|
|
# bleeding-edge dev alternative (unsigned): repo init ... -b 17
|
|
|
|
echo "==> Verify the manifest tag signature before syncing"
|
|
curl -fsS https://grapheneos.org/allowed_signers > "$HOME/.ssh/grapheneos_allowed_signers"
|
|
( cd .repo/manifests \
|
|
&& git config gpg.ssh.allowedSignersFile "$HOME/.ssh/grapheneos_allowed_signers" \
|
|
&& git verify-tag "$(git describe)" ) # expect: Good "git" signature ... contact@grapheneos.org
|
|
|
|
echo "==> repo sync (hours; safe to re-run to resume if the network drops)"
|
|
repo sync -j"$(nproc)"
|
|
|
|
cat <<EOF
|
|
|
|
==> Sync complete. NEXT (see docs/runbooks/graphene-build.md §3-§7), from $DEST:
|
|
source build/envsetup.sh
|
|
yarnpkg --cwd vendor/adevtool/ install
|
|
adevtool generate-all -d stallion # vendor blobs (phone not needed)
|
|
# then: generate keys (§4), patch the Dialer on callrecV2 (§5),
|
|
# lunch stallion-cur-user && m target-files-package (§6), sign, flash+relock (§7).
|
|
EOF
|