force --no-cache in reproduce mode

Makefile

@@ -9,6 +9,7 @@ export
 ## Use env vars from latest release when reproducing
 ifdef REPRODUCE
 include dist/release.env
+NO_CACHE := --no-cache
 export
 endif
 
@@ -30,6 +31,7 @@ out/airgap.iso: Containerfile $(shell git ls-files rootfs)
 		--build-arg GIT_AUTHOR="$(GIT_AUTHOR)" \
 		--build-arg GIT_KEY="$(GIT_KEY)" \
 		--build-arg GIT_TIMESTAMP="$(GIT_TIMESTAMP)" \
+		$(NO_CACHE) \
 		-f Containerfile \
 		.
 

README.md

@@ -66,6 +66,18 @@ make attest
 make sign
 ```
 
+## Provisioning ##
+
+1. Write airgap.iso to CD-ROM or SD Card
+  a. `dd if=out/airgap.iso of=/dev/sda bs=1M conv=sync status=progress`
+  b. `cdrecord out/airgap.iso`
+
+2. Verify media still produces expected hash
+  ```
+  sha256sum out/airgap.iso
+  head -c $(stat -c '%s' airgap.iso) /dev/sda | sha256sum
+  ```
+
 ## Setup ##
 
 Assumes target is running Pureboot or Coreboot/heads

dist/manifest.txt

@@ -0,0 +1,2 @@
+18df33fc5e787057004f0783cbd40f9a808c67943d7a53b7c20cd7b92f6bf2bf airgap.iso
+ec5912ec6bafc7c9a61e3ecee440485c249a57dca1aa1cc2ac15dc13e682875b release.env

dist/release.env

@@ -0,0 +1,5 @@
+VERSION=2024.8.0
+GIT_REF=74bf27bc6601d4f3f0d22c0f854594b854e893d0
+GIT_AUTHOR=Lance R. Vick
+GIT_KEY=6B61ECD76088748C70590D55E90A401336C8AAA9
+GIT_TIMESTAMP=2024-08-02 22:15:34 -0700