Package writing, built up to the wall
selfish-pkg::write assembles a package: header, entry
table, and every entry this repository can account for.
selfish pack --image X -o Y drives it.
The design carries the principle rather than describing it. A build
without 0x400, 0x401 and 0x1002
fails naming each one; a caller supplying
0x1 or 0x100 is refused rather than allowed to
override a computed entry, because two sources for one entry is how a
digest table stops matching what it describes; and every region left
blank is reported on the output with its offset and length, so a hole is
something you read rather than something a console finds.
The check that matters is a test, not an argument:
selfish derive runs against a package write
produced and every claim it re-derives from real packages
holds. Writer and derivation agree, and if they ever stop the suite says
so.
The wall, described precisely
The three remaining entries resisted everything local. Neither RSA key from the fake keyset unwraps any of their 256-byte blocks. None contains the digest of any entry, any region of the package file, the image or any prefix of it, or any of the 134 files extracted from the three packages - SHA-256 and SHA-1 both. The same treatment killed every hypothesis for the two unexplained superblock fields, including HMAC keyed by the seed.
All of that is recorded in D038, and the negatives are the point: the content is not in the package, so no amount of further staring produces it.
And the source has been under our nose
data/pkg-keys.toml has said all along that the fake
keyset comes from LibOrbisPkg, an open-source
packaging tool. A writer is what unblocked the container; this
repository already trusts that project enough to take its keys; and its
source is simply not in the local kit. That is the next move, and it is
one fetch away rather than one insight away.