V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m0s

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
2025-07-31 23:04:30 +02:00
parent 930f47f827
commit 45ff672479
103 changed files with 1011 additions and 266 deletions

View File

@@ -0,0 +1,78 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
#######################################
# Parsing './.preseed/preseed.yaml' and './.preseed/partitioning.yaml'.
# Globals:
# ARY_BOOTPARAM
# ARY_NTPSRVR
# ARY_PACKAGES
# BASH_REMATCH
# DIR_CNF
# DIR_TMP
# VAR_PRESEED
# VAR_USER_MAX
# Arguments:
# None
# Returns:
# 0: on success
#######################################
yaml_parser() {
### Declare Arrays, HashMaps, and Variables.
# shellcheck disable=SC2034
declare -ag ARY_BOOTPARAM=() ARY_NTPSRVR=() ARY_PACKAGES=()
declare -gix VAR_USER_MAX=0
declare var_index="" var_key="" var_value=""
cat "${DIR_CNF}/preseed.yaml" "${DIR_CNF}/partitioning.yaml" >| "${DIR_TMP}/combined.yaml"
yq -o=shell "${DIR_TMP}/combined.yaml" >| "${VAR_PRESEED}"
### Generate Arrays for [Grub Parameter], [NTPSec Server FQDN], [Software Packages].
while IFS='=' read -r var_key var_value; do
var_value=${var_value#\'}
var_value=${var_value%\'}
# shellcheck disable=SC2034
case "${var_key}" in
grub_parameter_[0-9]*) ARY_BOOTPARAM+=("${var_value}") ;;
ntp_server_[0-9]*) ARY_NTPSRVR+=("${var_value}") ;;
software_[0-9]*) ARY_PACKAGES+=("${var_value}") ;;
esac
done < "${VAR_PRESEED}"
### Search all set variables for user_userN_name patterns.
# shellcheck disable=SC2312
while IFS='=' read -r var_index; do
if [[ "${var_index}" =~ ^user_user([0-9]+)_name$ ]]; then
var_index="${BASH_REMATCH[1]}"
(( var_index > VAR_USER_MAX )) && VAR_USER_MAX="${var_index}"
fi
done < <(compgen -v)
### Delete the respective 'key:value'-variables in the global variable set.
sed -i '/^grub_parameter_[0-9]\+=/d' "${VAR_PRESEED}"
sed -i '/^ntp_server_[0-9]\+=/d' "${VAR_PRESEED}"
sed -i '/^software_[0-9]\+=/d' "${VAR_PRESEED}"
### Substitute all key= by key=""
sed -i -E 's/^(.*)=\s*$/\1=""/' "${VAR_PRESEED}"
### Wrap each key=value by '' e.g., key='value'
sed -i -E "s/^(.*)=([^'\"]+)$/\1='\2'/" "${VAR_PRESEED}"
# shellcheck disable=SC1090
. "${VAR_PRESEED}"
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

View File

@@ -0,0 +1,177 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
#######################################
# Reading and extracting variables from "${PRESEED}".
# Globals:
# HMP_RECIPE_DEV_PARTITIONS
# VAR_ARCHITECTURE
# VAR_NUKE
# VAR_PRESEED
# VAR_RECIPE_FIRMWARE
# VAR_RECIPE_HIGHEST_DEVICE
# VAR_RECIPE_STRING
# VAR_RECIPE_TABLE
# architecture
# Arguments:
# None
# Returns:
# 0: on success
# ERR_NO_VALID_RECIPE
#######################################
yaml_reader() {
### Declare Arrays, HashMaps, and Variables.
# shellcheck disable=SC2034
declare -Ag HMP_RECIPE_DEV_PARTITIONS=()
declare -gx VAR_RECIPE_STRING="" VAR_RECIPE_HIGHEST_DEVICE="" VAR_ARCHITECTURE="" VAR_RECIPE_FIRMWARE="" VAR_NUKE="" \
VAR_RECIPE_TABLE="" VAR_NEED_RUN_IN_TARGET="false" VAR_CODENAME=""
### Declare and substitute input files.
declare -r var_if="${VAR_PRESEED}"
declare var_line="" var_middle_part="" var_highest_dev="" var_device="" var_fields="" var_partition="" \
recipe_firmware_var="" recipe_nuke_var="" recipe_table_var=""
### Read "${var_if}" line by line.
while IFS= read -r var_line; do
### Check, if line matches the search pattern.
if [[ "${var_line}" =~ ^recipe_([^_]+)_active=\'true\' ]]; then
var_middle_part="${BASH_REMATCH[1]}"
VAR_RECIPE_STRING="${var_middle_part}"
break
fi
done < "${var_if}"
if [[ -n "${VAR_RECIPE_STRING}" ]]; then
do_log "info" "file_only" "1251() Found active recipe string: '${VAR_RECIPE_STRING}'."
else
do_log "fatal" "file_only" "1251() Found NO active recipe string: '${VAR_RECIPE_STRING}'."
exit "${ERR_NO_VALID_RECIPE}"
fi
### Search "${var_if}" for matching recipe_${VAR_RECIPE_STRING}_dev_* entries and find the highest dev letter.
# shellcheck disable=SC2312
var_highest_dev=$(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}" | awk -F'_' '
{
if (NF >= 4) {
### Extract 4th position (e.g., "recipe_${VAR_RECIPE_STRING}_dev_sda" or "recipe_${VAR_RECIPE_STRING}_dev_vda")
device_field = $4
### Check, if field is at least 3 char wide and last char contains a letter
if (length(device_field) >= 3) {
last_char = substr(device_field, length(device_field), 1) ### Extract last letter of respective field
if (last_char ~ /^[a-z]$/ && last_char > max) {
max = last_char
}
}
}
}
END { print max }
')
### Save the result in VAR_RECIPE_HIGHEST_DEVICE.
VAR_RECIPE_HIGHEST_DEVICE="${var_highest_dev}"
if [[ -n "${VAR_RECIPE_HIGHEST_DEVICE}" ]]; then
do_log "info" "file_only" "1251() Found highest recipe device: '${VAR_RECIPE_HIGHEST_DEVICE}'."
else
do_log "fatal" "file_only" "1251() Found NO highest recipe device: '${VAR_RECIPE_HIGHEST_DEVICE}'."
exit "${ERR_NO_VALID_RECIPE}"
fi
### Read var_if and iterate through all matching entries without executing in a subshell
# shellcheck disable=SC2312
while read -r var_line; do
### Extract fields of line
IFS='_' read -ra var_fields <<< "${var_line}"
### Check that enough fields are available
if [[ "${#var_fields[@]}" -ge 5 ]]; then
var_device="${var_fields[3]}" ### The fourth position includes the device (e.g., sda, vda, xvda)
var_partition="${var_fields[4]}" ### The fifth position includes the partition (e.g., 13)
### Check, if the partition is a number and higher than the current value
if [[ "${var_partition}" =~ ^[0-9]+$ ]]; then
declare -i cur="${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0}"
if (( var_partition > cur )); then
#if [[ -z "${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-}" || "${var_partition}" -gt ${HMP_RECIPE_DEV_PARTITIONS[${var_device}]:-0} ]]; then
# shellcheck disable=SC2004
HMP_RECIPE_DEV_PARTITIONS[${var_device}]="${var_partition}"
fi
fi
fi
done < <(grep -E "^recipe_${VAR_RECIPE_STRING}_dev_" "${var_if}")
for var_device in "${!HMP_RECIPE_DEV_PARTITIONS[@]}"; do
do_log "info" "file_only" "1251() Highest number of partitions: [${var_device}:${HMP_RECIPE_DEV_PARTITIONS[${var_device}]}]."
done
### Extract architecture.
# shellcheck disable=SC2034
VAR_ARCHITECTURE="${architecture,,}"
# shellcheck disable=SC2034
VAR_CODENAME="${distribution,,}"
### Extract chroot secure '/run' mounting strategy.
# shellcheck disable=SC2034
VAR_NEED_RUN_IN_TARGET="${needrun,,}"
### Extract chosen firmware.
recipe_firmware_var="recipe_${VAR_RECIPE_STRING}_control_firmware"
VAR_RECIPE_FIRMWARE="${!recipe_firmware_var}"
### Extract the chosen Nuke mechanism.
recipe_nuke_var="recipe_${VAR_RECIPE_STRING}_control_nuke"
# shellcheck disable=SC2034
VAR_NUKE="${!recipe_nuke_var}"
### Extract chosen partition table.
recipe_table_var="recipe_${VAR_RECIPE_STRING}_control_table"
VAR_RECIPE_TABLE="${!recipe_table_var}"
if [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP 'EF00' necessary."
elif [[ "${VAR_RECIPE_TABLE,,}" == "gpt" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > BIOS Boot Partition 'EF02' necessary."
elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "uefi" ]]; then
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > ESP on MBR needs partition type '0xEF'."
elif [[ "${VAR_RECIPE_TABLE,,}" == "msdos" && "${VAR_RECIPE_FIRMWARE,,}" == "bios" ]]; then
do_log "info" "file_only" "1251() Partition table: '${VAR_RECIPE_TABLE}' and firmware: '${VAR_RECIPE_FIRMWARE}' > No special firmware partition necessary."
fi
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

View File

@@ -0,0 +1,190 @@
#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
#######################################
# Extended dynamic network variable checks and declarations depending on preseed.yaml.
# Globals:
# ARY_IPV4_NS
# ARY_IPV6_NS
# VAR_FINAL_FQDN
# VAR_FINAL_IPV4
# VAR_FINAL_IPV4_GW
# VAR_FINAL_IPV4_SUBNET
# VAR_FINAL_IPV6
# VAR_FINAL_NIC
# VAR_LINK_IPV6
# network_autoconfig_enable
# network_choose_interface_static
# network_hostname
# network_static_ipv4address
# network_static_ipv4gateway
# network_static_ipv4nameserver_0
# network_static_ipv4nameserver_1
# network_static_ipv4nameserver_2
# network_static_ipv4nameserver_3
# network_static_ipv4nameserver_fallback_0
# network_static_ipv4nameserver_fallback_1
# network_static_ipv4netmask
# network_static_ipv6address
# network_static_ipv6nameserver_0
# network_static_ipv6nameserver_1
# network_static_ipv6nameserver_2
# network_static_ipv6nameserver_3
# network_static_ipv6nameserver_fallback_0
# network_static_ipv6nameserver_fallback_1
# Arguments:
# None
# Returns:
# 0: on success
#######################################
yaml_validator() {
### Declare Arrays, HashMaps, and Variables.
# shellcheck disable=SC2034
declare -ag ARY_IPV4_NS=() ARY_IPV6_NS=()
declare var_auto_nic="" var_auto_ipv4="" var_auto_ipv4_ccidr="" var_auto_ipv4_subnet="" var_auto_ipv4_gw="" \
var_auto_ipv6="" var_auto_ipv6_ccidr="" var_auto_ipv6_gw="" var_link_ipv4="" var_link_ipv6="" var_auto_fqdn=""
declare -gx VAR_FINAL_NIC="" VAR_FINAL_FQDN="" VAR_FINAL_IPV4="" VAR_FINAL_IPV4_GW="" VAR_FINAL_IPV4_SUBNET="" \
VAR_FINAL_IPV6="" VAR_LINK_IPV6=""
ARY_IPV4_NS+=("${network_static_ipv4nameserver_0}")
[[ -v network_static_ipv4nameserver_1 ]] && ARY_IPV4_NS+=( "${network_static_ipv4nameserver_1}" )
[[ -v network_static_ipv4nameserver_2 ]] && ARY_IPV4_NS+=( "${network_static_ipv4nameserver_2}" )
[[ -v network_static_ipv4nameserver_3 ]] && ARY_IPV4_NS+=( "${network_static_ipv4nameserver_3}" )
[[ -v network_static_ipv4nameserver_fallback_0 ]] && ARY_IPV4_NS+=( "${network_static_ipv4nameserver_fallback_0}" )
[[ -v network_static_ipv4nameserver_fallback_1 ]] && ARY_IPV4_NS+=( "${network_static_ipv4nameserver_fallback_1}" )
ARY_IPV6_NS+=("${network_static_ipv6nameserver_0}")
[[ -v network_static_ipv6nameserver_1 ]] && ARY_IPV6_NS+=( "${network_static_ipv6nameserver_1}" )
[[ -v network_static_ipv6nameserver_2 ]] && ARY_IPV6_NS+=( "${network_static_ipv6nameserver_2}" )
[[ -v network_static_ipv6nameserver_3 ]] && ARY_IPV6_NS+=( "${network_static_ipv6nameserver_3}" )
[[ -v network_static_ipv6nameserver_fallback_0 ]] && ARY_IPV6_NS+=( "${network_static_ipv6nameserver_fallback_0}" )
[[ -v network_static_ipv6nameserver_fallback_1 ]] && ARY_IPV6_NS+=( "${network_static_ipv6nameserver_fallback_1}" )
### Check current network connection and configure variables
# shellcheck disable=SC2312
var_auto_nic=$(ip -o link show | awk -F': ' '/state UP/ && $2!="lo" {print $2; exit}')
# shellcheck disable=SC2312
var_auto_ipv4_ccidr=$(ip -4 -o addr show "${var_auto_nic}" | awk '{print $4; exit}')
# shellcheck disable=SC2312
var_auto_ipv4_subnet=$(generate_subnetmask "${var_auto_ipv4_ccidr}")
# shellcheck disable=SC2312
var_auto_ipv4=$(echo "${var_auto_ipv4_ccidr}" | awk -F'/' '{print $1}')
# shellcheck disable=SC2312
var_auto_ipv4_gw=$(ip route show default dev "${var_auto_nic}" | awk '/^default/ {print $3; exit}')
# shellcheck disable=SC2312
var_auto_ipv6_ccidr=$(ip -6 -o addr show "${var_auto_nic}" | awk '/scope global/ {print $4; exit}')
if [[ -n "${var_auto_ipv6_ccidr}" ]]; then
# shellcheck disable=SC2312
var_auto_ipv6=$(echo "${var_auto_ipv6_ccidr}" | awk -F'/' '{print $1}')
# shellcheck disable=SC2312
var_auto_ipv6_gw=$(ip -6 route show default dev "${var_auto_nic}" | awk '/^default/ {print $3; exit}')
fi
# shellcheck disable=SC2312
var_link_ipv4=$(ping -q -c 1 -W 1 -4 debian.org > /dev/null 2>&1 && echo "true" || echo "false")
# shellcheck disable=SC2312
var_link_ipv6=$(ping -q -c 1 -W 1 -6 debian.org > /dev/null 2>&1 && echo "true" || echo "false")
if [[ -f "/var/lib/dhcp/dhclient.${var_auto_nic}.leases" ]]; then
# shellcheck disable=SC2312
var_auto_fqdn=$(grep -m1 'option host-name' "/var/lib/dhcp/dhclient.${var_auto_nic}.leases" | sed -E 's/.*"([^"]+)".*/\1/')
else
var_auto_fqdn=""
fi
do_log "info" "file_only" "1252() Live environment network check: Auto NIC ='${var_auto_nic}'."
do_log "info" "file_only" "1252() Live environment network check: Auto IPv4 ='${var_auto_ipv4}'."
do_log "info" "file_only" "1252() Live environment network check: Auto IPv4 CCIDR ='${var_auto_ipv4_ccidr}'."
do_log "info" "file_only" "1252() Live environment network check: Auto IPv4 Subnet ='${var_auto_ipv4_subnet}'."
do_log "info" "file_only" "1252() Live environment network check: Auto IPv4 Gateway ='${var_auto_ipv4_gw}'."
do_log "info" "file_only" "1252() Live environment network check: Auto IPv6 ='${var_auto_ipv6}'."
do_log "info" "file_only" "1252() Live environment network check: Auto IPv6 CCIDR ='${var_auto_ipv6_ccidr}'."
do_log "info" "file_only" "1252() Live environment network check: Auto IPv6 Gateway ='${var_auto_ipv6_gw}'."
do_log "info" "file_only" "1252() Live environment network check: Auto IPv4 Link ='${var_link_ipv4}'."
do_log "info" "file_only" "1252() Live environment network check: Auto IPv6 Link ='${var_link_ipv6}'."
do_log "info" "file_only" "1252() Live environment network check: Auto FQDN ='${var_auto_fqdn}'."
### Export hostname and IPv4 and IPv6 addresses for further processing according to dynamic results and preseed.yaml settings.
if [[ "${network_autoconfig_enable,,}" == "true" ]]; then
# shellcheck disable=SC2034
VAR_FINAL_NIC="${var_auto_nic}"
# shellcheck disable=SC2034
VAR_FINAL_FQDN="${var_auto_fqdn}"
# shellcheck disable=SC2034
VAR_FINAL_IPV4="${var_auto_ipv4}"
# shellcheck disable=SC2034
VAR_FINAL_IPV4_GW="${var_auto_ipv4_gw}"
# shellcheck disable=SC2034
VAR_FINAL_IPV4_SUBNET="${var_auto_ipv4_subnet}"
do_log "info" "file_only" "1252() Network IPv4 autoconfiguration: [${network_autoconfig_enable,,}]."
else
# shellcheck disable=SC2034
VAR_FINAL_NIC="${network_choose_interface_static}"
# shellcheck disable=SC2034
VAR_FINAL_FQDN="${network_hostname}"
# shellcheck disable=SC2034
VAR_FINAL_IPV4="${network_static_ipv4address}"
# shellcheck disable=SC2034
VAR_FINAL_IPV4_GW="${network_static_ipv4gateway}"
# shellcheck disable=SC2034
VAR_FINAL_IPV4_SUBNET="${network_static_ipv4netmask}"
do_log "info" "file_only" "1252() Network IPv4 autoconfiguration: [${network_autoconfig_enable,,}]."
fi
if [[ "${network_autoconfig_enable,,}" == "true" && "${var_link_ipv6,,}" == "true" ]]; then
# shellcheck disable=SC2034
VAR_FINAL_IPV6="${var_auto_ipv6}"
# shellcheck disable=SC2034
VAR_LINK_IPV6="${var_link_ipv6}"
do_log "info" "file_only" "1252() Network IPv6 autoconfiguration: [${network_autoconfig_enable,,}] and IPv6 Link: [${var_link_ipv6,,}]."
elif [[ "${network_autoconfig_enable,,}" == "false" && -n "${network_static_ipv6address}" ]]; then
# shellcheck disable=SC2034
VAR_FINAL_IPV6="${network_static_ipv6address}"
do_log "info" "file_only" "1252() Network IPv6 autoconfiguration: [${network_autoconfig_enable,,}] and IPv6 static: [${network_static_ipv6address}]."
else
# shellcheck disable=SC2034
VAR_FINAL_IPV6=""
do_log "info" "file_only" "1252() Network IPv6 autoconfiguration: no IPv6 configuration applied."
fi
return 0
}
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh