V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

lib/cdi_0060_traps/0070_trap_exit.sh

@@ -34,6 +34,9 @@ trap_exit() {
 
   trap - DEBUG ERR EXIT INT TERM
 
+  ### Defensive shell behavior inside trap.
+  set +e +o pipefail
+
   if [[ -n "${__preexec_invoke:-}" ]]; then
     debug_trap_logger "${var_exit_code}" "${VAR_LAST_CMD}"
     unset __preexec_invoke

lib/cdi_0100_arg/0102_arg_parser.sh

@@ -113,5 +113,7 @@ arg_parser() {
           ;;
     esac
   done
+
+  guard_dir && return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

lib/cdi_0100_arg/0103_arg_priority_check.sh

@@ -39,5 +39,7 @@ arg_priority_check() {
     var=$(ionice -p $$) > /dev/null 2>&1
     do_log "info" "file_only" "0103() New ionice value: '${var}'."
   fi
+
+  guard_dir && return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

lib/cdi_0100_arg/0104_arg_passphrase_modules.sh

@@ -25,12 +25,17 @@ guard_sourcing
 #######################################
 generate_salt() {
   declare var_salt=""
+
   while :; do
+
     # shellcheck disable=SC2312
     var_salt=$(head -c 12 /dev/random | base64 | tr -dc 'A-Za-z0-9' | head -c 16) || return "${ERR_GENERATE_SALT}"
     [[ ${#var_salt} -eq 16 ]] && break
+
   done
+
   printf '%s%b' "${var_salt}" "${NL}"
+
   return 0
 }
 
@@ -51,19 +56,24 @@ read_password_file() {
   declare -n var_output_file="${2}"
   declare -a lines=()
 
-  ### TODO: PASSWORD REMINDER
+  ### TODO: PASSWORD REMINDER START
   ### No tracing for security reasons
   [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
+
   if [[ ! -f "${var_input_file}" ]]; then
+
     do_log "fatal" "file_only" "0104() Password file '${var_input_file}' not found."
     return "${ERR_READ_PASS_FILE}"
+
   fi
 
   mapfile -t lines < "${var_input_file}"
 
   if (( ${#lines[@]} != 1 )); then
+
     do_log "fatal" "file_only" "0104() Password file '${var_input_file}' MUST contain exactly one line."
     return "${ERR_READ_PASS_FILE}"
+
   fi
 
   var_output_file="${lines[0]}"
@@ -72,15 +82,32 @@ read_password_file() {
   var_output_file="${var_output_file%"${var_output_file##*[![:space:]]}"}" ### trailing
 
   if [[ -z "${var_output_file}" ]]; then
+
     do_log "fatal" "file_only" "0104() Password file '${var_input_file}' contains only whitespace."
     return "${ERR_READ_PASS_FILE}"
+
   fi
 
   ### Turn on tracing again
   [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
-  ### TODO: PASSWORD REMINDER
+  ### TODO: PASSWORD REMINDER STOP
+
+  sync
+
+  if shred -vfzu -n 5 "${var_input_file}" > /dev/null 2>&1; then
+
+    do_log "info" "file_only" "0104() Password file '${var_input_file}': shred -vfzu -n 5 >> done."
+
+  else
+
+    do_log "warn" "file_only" "0104() Password file '${var_input_file}': shred -vfzu -n 5 >> NOT successful."
+
+  fi
+
+  sync
 
   unset lines
+
   return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh

lib/cdi_0100_arg/0105_arg_nuke_converter.sh

@@ -29,44 +29,43 @@ nuke_passphrase() {
   declare -r var_nuke_pwd_file="${DIR_CNF}/password_luks_nuke.txt"
   declare    var_temp_nuke_hash="" var_temp_plain_nuke_pwd="" var_salt=""
 
-  ### TODO: PASSWORD REMINDER
+  ### TODO: PASSWORD REMINDER START
   ### No tracing for security reasons
+
   [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
+
   if ! read_password_file "${var_nuke_pwd_file}" var_temp_plain_nuke_pwd; then
+
     return "${ERR_READ_NUKE_FILE}"
   fi
+
+
   ### Turn on tracing again
   [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
-  ### TODO: PASSWORD REMINDER
+  ### TODO: PASSWORD REMINDER STOP
 
   if ! var_salt="$(generate_salt)"; then
+
     return "${ERR_GENERATE_SALT}"
   fi
 
-  ### TODO: PASSWORD REMINDER
-  ### No tracing for security reasons ### --rounds=8388608
+
+  ### TODO: PASSWORD REMINDER START
+  ### No tracing for security reasons
   [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
-  var_temp_nuke_hash=$(mkpasswd --method=sha-512 --salt="${var_salt}" --rounds=16384 "${var_temp_plain_nuke_pwd}")
+
+  var_temp_nuke_hash=$(mkpasswd --method=sha-512 --salt="${var_salt}" --rounds="${VAR_NUKE_ROUNDS:-8388608}" "${var_temp_plain_nuke_pwd}")
+
   ### Turn on tracing again
   [[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
-  ### TODO: PASSWORD REMINDER
+  ### TODO: PASSWORD REMINDER STOP
 
   declare -grx VAR_NUKE_HASH="${var_temp_nuke_hash}"
   unset var_temp_nuke_hash var_temp_plain_nuke_pwd
 
   do_log "debug" "file_only" "0105() NUKE hash starts with: ${VAR_NUKE_HASH:0:32}..."
 
-  sync
-  if shred -vfzu -n 5 "${var_nuke_pwd_file}" > /dev/null 2>&1; then
-    do_log "info" "file_only" "0105() Password file '${var_nuke_pwd_file}': shred -vfzu -n 5 >> done."
-  else
-    do_log "warn" "file_only" "0105() Password file '${var_nuke_pwd_file}': shred -vfzu -n 5 >> NOT successful."
-  fi
-  sync
-
-  do_log "info" "file_only" "0105() Nuke Hash generated."
-
-  return 0
+  guard_dir && return 0
 }
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh