Docs: Pin the verified Panama bootstrap

2026-08-27 10:14:55 -04:00
parent 0d1841cf86
commit dce00e45d1
5 changed files with 156 additions and 16 deletions
@@ -94,6 +94,22 @@ it against the real system.

 Never bare `sudo`. Load the `panama-sudo` skill first. Migrations already follow the rule.

+## Initial bootstrap trust
+
+Use the complete command in `README.md` for a new machine. It downloads `boot`
+from the documented commit URL into a private temporary directory, enforces the
+documented curl time and byte limits, verifies the committed blob with
+`sha256sum -c`, and passes both pins to the verified script. Desktop and server
+bootstrap use the same commit and digest. Never substitute a branch URL, pipe a
+response into Bash, or invent a newer pin from an uncommitted file.
+
+`boot` validates the full lowercase commit and SHA-256 before Git or install. A
+fresh destination fetches only that revision and creates a tracked local `main`
+after HEAD matches. An existing checkout must be clean and an ancestor of the
+requested revision; it advances with fast-forward only. Dirty, divergent,
+fetch-failed, or mismatched checkouts stop without reset or install. Once Panama
+exists, use `panama update` for normal updates.
+
 `boot --server` is the one exception where a new Fedora VPS may begin as root.
 Before it offers SSH hardening, it copies a safe root key when possible or
 verifies the target key. The target user's `.ssh` must be owned by that user at